united-kingdom gdpr
Are Phone Number lists with no other personal data allowed under GDPR?
<p>Given a phone number list stored in a format such as this: </p>

<p>02321 203201, 203120 023102, etc.</p>

<p>Would this be classed as personally identifiable information under the new GDPR regulations or as there is no other personal data associated with these numbers, would they be compliant under GDPR?</p>

<p>Yes, phone numbers would generally qualify as Personal Data under GDPR. It would be so irrespective of whether you have also stored other information along with the phone numbers or not, since also information that indirectly could identify a natural person is Personal Data (provided that there are, somewhere else, public or not public, a register of who holds the specific phone number). See <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Article 4(1) GDPR</a>.</p>

<p>(One could possibly argue that the phone numbers would not be considered personal data if there is no actual register of who owns a specific phone number with any other party. Or if such register is in practice not available for anyone. It might be so in some cases, although I would not rely on it.)</p>

<p>Whether you have the right to process the phone numbers must be assessed based on its lawfulness (see <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6 GDPR</a>). It could be based on consent, performance of contract, legitimate interest or any other ground set out therein.</p>
