Recall works locally on the client machine from what I understand. The snapshots don't leave your computer, so all this may not be under GDPR's purview.