According to Article 2(1) GDPR:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
In my country, Poland, we have a national identification number called PESEL. It has 11 digits which encode date of birth, sex, ordinal number and one checksum digit. All combinations can be easily generated on todays computers.
Article 87 GDPR states that:
Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation.
if I generate all 1,826,210,000 PESEL number combinations, do I become the holder of the personal database of all Polish people and (if I am a company) do the obligations arising from the GDPR begin to apply to me?