The [...] you omitted is "and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part o

The [...] you omitted is "and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." - if your company takes notes on your customers with pen and paper and puts these notes in a drawer for further use in your business processes, GDPR definitely does apply. A random real example is that I used to work in a building which had a paper logbook where people sign the time and name when taking/returning keys for the meeting rooms. That logbook falls under GDPR as it has personally identifiable information - there's the legitimate need use case justifying it; but if the company suddenly wanted to use the stored data for some other purpose, that might be restricted.