GDPR and PLOS One Data Sharing
This is a very broad topic, and specific guidance should come from lawyers and the requisite PIs, but in general terms: 


there are a lot of reasons a given data set may be too sensitive to share, and containing PII- the domain of GDPR- is only one of them, but when PII is involved, it absolutely applies, and academic research is one of the many domains specifically identified in GDPR language, and is granted more privilege than other domains
when it comes to PII, GDPR does not prevent the storage, sharing or processing of data for legitimate purposes, it just prescribes lifecycle protocols that those who participate in storage, sharing or processing have to follow
those lifecycle protocols are intended to allow for the enforcement of the rights provided by GDPR to the humans whose data is legitimately shared, stored, and processed- to have their data removed, to have processing explained to them, etc.
those who participate in the sharing, storage or processing of data are either "controllers" or "processors" and different responsibilities are attributed to each. Controllers generally are responsible for the acts of their processors, and processors have to do their work in accordance with their controllers
a data sharing agreement has to define those roles and responsibilities for the parties involved, and ensure the sharing protocol fulfills the requirements of GDPR


A granular review of the issue in the context of research is here:  

https://iapp.org/news/a/how-gdpr-changes-the-rules-for-research/