Private messages, notes and such are usually excepted(in the vast majority of cases). Giving out someone else's messages or notes, however...
> This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
https://gdpr-info.eu/art-2-gdpr/
> The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
https://gdpr-info.eu/art-15-gdpr/
Talk to a lawyer if you are upset.