Article 4 (6) of the GDPR sets the definition for a ‘filing system’. If the personal data that the company processes manually is in structured form and the processing is conducted in a database, then yes GDPR does apply. If the processing is one-off and the company does not use a database, then GDPR might not apply.

Why Every Organisation Needs a Solid GDPR Foundation: Lessons from the SportAdmin Breach
Lesson 1: Privacy Isn’t Optional — It’s a Safety Issue In the SportAdmin breach, attackers gained access to a database containing personal information from over