Whether the name is stored on paper or somewhere else does not matter. When you leak personal identifiable information (PII), which a name and surname are, it is regarded a data leak. This is what is a data breach under GDPR article 4:
‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Article 33 states the following regarding the mandatory notification:
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. [...]
Just a name and surename is unlikely to result in a risk for the individual and it is therefor not mandatory to notify the supervisory authority. Please note this might be different depending on the area where you work, an invoice for renting a pornographic movie for example might be harmful to someone. In the end, you are faced with a decision regarding the severity of the incident and if you should report it or not.
As you can read here, you should be asking yourself the following questions to determine if you need to file a report or not.
- What Happened? What kind of incident was this, did you leave an AWS bucket with all of your users financial data protected or did you just send the wrong customer the wrong email?
- How many people were affected? Is this a large-scale breach or is it limited to just a handful of people. Most literature around GDPR puts the cut off for “large-scale” at 500 data subjects.
- What personal data was compromised? Is this just a customer’s name and email address? Or is it more sensitive data like financial information or special categories of personal data?
- What is the risk to the affected data subjects? Worst case scenario, what could be done with this information to harm the data subject either financially, materially or reputationally?
- What caused this situation? Was it an attacker exploiting your security? Was this a technical mistake? Human error?
- How easily can this issue be mitigated? Will this take months to fix or is this just a simple tweak? When will you be able to accomplish this?
If you can answer those questions, you should be able to weigh what risks this personal data breach could pose to those affected and whether or not this incident rises to the level of reporting.