I'm not an expert, nor even a lawyer (hint - if it likely impacts you consult one prior to taking random advice from a forum obviously) with that said - From [

I'm not an expert, nor even a lawyer (hint - if it likely impacts you consult one prior to taking random advice from a forum obviously) with that said - From [1] a quick scan showed up something so I think even storing a phone number would fall under it as in "indirect identifier" - to quote >>There are more factors to consider with indirect identification. Indirect identification means you cannot identify an individual through the information you are processing alone, but you may be able to by using other information you hold or information you can reasonably access from another source. A third party using your data and combining it with information they can reasonably access to identify an individual is another form of indirect identification. An easy example of information that could be used to indirectly identify someone is an individual’s license plate number. The police (a third party) can quickly match a name to a license plate number.>> So given that phone numbers can be traced back to an individual, I would guess that it would fall under the GDPR. Especially since (I would assume) you would be recording the orginators IP address [1] https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/