The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 on the protection of personal data. A camera drone captures personal data — people's faces, licence plates, private yards — which means the pilot becomes a data processor with all the obligations that carries.
In practice this requires a lawful basis for any filming, data minimisation — do not record more than you need — and respect for people's privacy. Crucially, drone rules and the GDPR apply in parallel: a flight that is legal under aviation rules does not automatically make the filming legal.