[kenbaylor]

If it's not exposed to the internet no problem. Not true unfortunately under the GDPR nor it's predecessor, if the notes are publicly available:

Bodil Lindquist v Åklagarkammaren (2003) Mrs. Lindquist (whose purposes were mostly charitable and religious) published on a private home page personal data about her colleagues, including telephone numbers and information about a coworker’s injured foot and medical leave. This case raised the question if a private home page accessible to only those who have the address is permitted under one of the exclusions (household activity). The European Court of Justice ruled that it is not.

[DanBC]

I'm not sure why you reposted this, because what you're describing isn't something purely for household use.

https://gdpr-info.eu/recitals/no-18/

> This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

[3rdPartyDD]

>> not sure why you reposted this Probably an edit issue

The case is the precedent for the GDPR recital. Both of you are correct.