GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)