GDPR compliant multitenant MYSQL DB
Regardless of how you solve the problem, you have to go through some sort of "router".  And that may be the least secure part.

Separate computer for each customer -- you need to tell user which machine to go to.

Separate process or API or VM on same machine -- user must log into the appropriate path.

Separate databases (one per customer) on single MySQL server -- either API or MySQL could handle security.

Single database, but separate rows in the tables -- Now the API must take responsibility for security.  That is, the user must not have direct access to MySQL, only indirect through an API layer.

Each has "privacy by design".