First of all, I'm not a lawyer or a legal consultant, just a instance admin that wants to make sure that his instance complies.
Lemmy does not store any PII (birthdates, legal names, addresses,securitynumbers). But users are able to share whatever they want. And that can be a problem.
Check out my instances legal page: https://Laguna.chat/legal
In the future I want to make sure that my instances content can only be shared by GDPR respecting instances.
The top three instances a currently overcrowded. I recommend checking out a smaller instance (for example https://laguna.chat).
Smaller instances are still able to access to same content. But it is just a different server that processes the content.