Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?