They aren’t by default; has the label been changed on your forum?
I don’t personally share this concern, but you could always include it in a site notice if it would make you more comfortable with the situation. I can appreciate that peace of mind is important. 
When it comes to the GDPR, Discourse displays user-submitted data in topics, messages - and chats, if you have installed that plugin - which is the purpose the user had in mind when providing that data in the first place. Their consent is provided at that time. Provided that the user can request a copy of their data & delete their account (Discourse offers both features), it should be perfectly safe in a legal context. You aren’t obtaining the data from a third-party or sharing it with one (I assume?).
You are expected to have access to it. Performing moderation is not just a right that you have, but is increasingly a legal responsibility you bear. Both European institutions and member countries of the EU have sued large companies for failing to adequately moderate their online spaces to shield their users from harm. Nowhere in the GDPR does it specify that you must only have access to content following a report from another user. Indeed, I’m not sure such would be considered sufficient.