> This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
Which makes sense, just keeping customer data on paper instead of in digital storage shouldn't mean you don't have to protect it.
Don't think it does. Basically everything involving a computer probably qualifies as "automated", and an Excel document is probably structured enough to be a "filing system".
What kind of notes? I am not an expert in GDPR law since I don't track people, hopefully someone here would explain exactly what is PI and what is tracking and if will apply in this exact case.
> This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
Which makes sense, just keeping customer data on paper instead of in digital storage shouldn't mean you don't have to protect it.