What to do when being responsible for data protection in your lab, yet advice is ignored? I work in a lab where we conduct research on data acquire from human subjects. As we investigate the effects of different diseases and the related treatments, the data is highly sensitive in regards to data protection. 

Most of the lab members work with Windows 10 and I am supposed to set up additional Windows 10 PCs. I have serious concerns about this as Windows 10 is known for sharing much data with Microsoft, e.g. every file which is related to a software crash may or may not be send to Microsoft and thereby unintentionally sharing sensitive health related information with Microsoft. 

When mentioning these issues, they are usually waved aside with arguments like "nobody else cares about that" or "this would slow down our work". In general is there very little interest in data protection and the associated risks.

I know the risk of a data leak actually having a effect is rather small, yet I'd like to know how to back myself up in this situation. Should things for whatever reason go sour, I'd like to be on the safe side.

I am in a PhD position actually hired for doing research. Yet due to my background in computer science, I am 'officially' responsible for everything related in our lab to electronic data processing.
There is a trove of documents from Microsoft with advice on GDPR compliance, such as "Windows and the GDPR: Information for IT Administrators and Decision Makers" and has a pretty thorough explanation of what data moves where.

According to the document itself, it takes 17 minutes to read.  I think you'll feel better after you've done so.

There's a lot of paranoia about Microsoft, some of it possibly justified, but the hard fact is that MS cannot afford to ignore the GDPR or, in the U.S., HIPAA.

I did read the answer in Information Security SE, and did not find it helpful; the quotation from MS has to do with disclosure of data as required by law or legal process.