I believe gdpr holds true for business transactions, or where money or services are exchanged.
I don't believe it applies to non business transactions such as the for simple act of sharing something with another person where no receipt of transaction is provided.
There are other laws to protect you there such as libel and slander laws.