Interesting one this.
GDPR does have a section that has been included for physiological data such as height, weight, ethnicity etc, but other than that I think they've got a tough battle on their hands. For example, where does that info come from? Well it has to be either the club's themselves or the players management company/agent so at some point there must have been some consent from the player.
The other issue is of course relating to performance stats. Obviously there is always going to be errors in the collection of data. For example I've noticed on several occasions where a stats provider has recorded an assist for completely the wrong player. I'm assuming there is an element of players that are worried that their stats might have a bearing on career development if they are not very good.
Regarding the vests you see players wearing, these are supplied by different organisations. I think Notts use Catapult Sports. The clubs pay for these devices as it provides them with slightly different information relating to a players physical attributes such as how far they have run, heart rate, burst acceleration etc. I'm not sure if these are stats you generally get from companies like Football Radar, I certainly haven't seen any. I think things like heatmaps and all other stats you see in general use are created by 'Watchers' who collate all this information from match videos. So again, absolutely no breach of GDPR that I can tell from that.
As mentioned in an earlier post anyone can pay to watch a football match and collate a load of stats, right or wrong. Also, the original reason for all this data including things like xG etc was so the betting syndicates could find an edge on the bookmakers by being able to more accurately predict the outcome of certain matches, it's only in more recent times that the data is now being used for player development. Either way it will be interesting to keep an eye on how this progresses.