It's not their data explicitly but that doesn't mean you can do what you want with it or that companies have no obligation to them just because it's your note.

It's not their data explicitly but that doesn't mean you can do what you want with it or that companies have no obligation to them just because it's your note. They may not be able to request access to view that note or take advantage of the many GDPR provisions, but if the note contains personally identifiable information about them and said note is leaked to the public then companies will still need to remove that information at their request despite it being your note. This is similar to some other laws, you can be as slanderous as you want to someone in private but if that slander makes publication then you open yourself up to a lawsuit. You may own copyrights to the image you take of someone in public, but you cannot use their image in your merchandise despite owning the copyright to that image. If someone is doxed in an email, and the email hosting provider used is compromised and has their emails linked to the public, the person who was doxed has just as much right to request that the publicly available emails be removed from search engines, etc.