GDPR doesn't care if its in a database or in your notebook, you are still subject to the same laws and as such the data in this case is the property of John. Y

GDPR doesn't care if its in a database or in your notebook, you are still subject to the same laws and as such the data in this case is the property of John. You need his permission to record it.