Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.

GDPR has exemptions built in but being open source project is not one.