The ICO is pretty zealous though in this regard. To quote recital 18:[1]

This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity.

[1] https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#rct_18