A legal basis under the GDPR is required for manually writing a note on a sheet of paper.

Each processing activity that falls under the GDPR requires a legal basis for processing.

For every processing of personal data, the prior consent of the data subject must be obtained.

The GDPR differentiates between legal bases depending on whether the data concerns “simple” personal data or special categories of data.