The GDPR applies to all personal data which is processed by a business or organization. Non-personal data processed electronically is not included and personal data held on paper is included. However, paper-based records have to be in a structured format, so scribbled notes don’t count.