Any government sending any request to any company is very likely to get a compliant answer if they want to operate in that market.

You can only trust services like signal which make it impossible for the operators to access your data

GDPR is mainly against corporations making money out of knowing who you are across the web, it won't save you from a government actor