Our World in Data in run by Oxford University, so outside of EU. The applicability of EU GDPR laws outside EU is a complicated topic.
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
If you are big (like this site here) you have lawyers so you also don't worry about it.