First, the GDPR is only relevant for scientifc data from human participants (i.e., irrelevant for most scientific disciplines).
Second, the GDPR is only relevant for personal data. If the data provided by human subjects is anonymous (e.g., most of psychology's data), the GDPR does not apply.
For our own lab (at a psychology department), it had the following impact:
- We revamped our consent forms. In case of personal data which cannot be anonymized, we ask for consent to share it.
- We make better checks whether data sets really are anonymous before making them open.
- We tried to improve our operational security (e.g., safer handling of pseudonym lists).