⚠️ GDPR + Mastodon
It's part of personal note so is stored on the instance of the person writing it, who in theory is the only person who should see it.
I made a clarification here. Personal notes are exempt from GDPR (unless they are made in a professional capacity, which I guess could be a potential scenario as the number of instances grow).