I work at a college as web-dev contractor, however most of my work is on private servers because head of the lab wants to avoid bureaucracy. I'm very privacy-conscious and I would like everything that I do to be under a gdpr-like policy. I'm also worried that they just take away the servers and dismiss me. So how can I subtly address my concerns and ensure that what I do isn't being used for profit without my consent or university's?
Technically you cannot. When you work for someone in software, the IP rights of the work is managed by the person paying you the money ( unless its explicitly agreed beforehand and in writing). Please refer to your contract, it is a standard practise in this part of the works to include this in the contract.
If you don't own the rights on your work and have vested them to the university, your consent is not needed since the university owns whatever work you have produced for them.
Since you mentioned it may be used for private gain ( i am assuming by someone from university without university consent) as well, you should include copyright in the name of university in each source code file. If university agrees, you can put your contact information in there. But thats about it. Where it goes from there is not in your control.