I did read the GDPR. A specific exemption for national defense (and by the way, you missed the one on health) is not the same as "exempting the government". The vast majority of governmental bodies have to comply.

It's like saying that "governmental employees are allowed to pilot fighter jets" just because the army employs some pilots.