But that a phone number exists in your collection is interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be considered to be a secret key.
If the information had been anonymized it wouldn't be personal information and the GDPR wouldn't apply. However, since the phone numbers are personal information (even hashed, they relate to an indirectly identifiable person), you should apply standard GDPR compliance processes to determine whether storing these phone numbers is legal:
- What is the purpose of processing?
- Some purposes like national security or purely personal and household purposes are exempt from the GDPR
- What is the legal basis for this purpose?
- E.g. consent, legitimate interest, legal obligations, …
- What is the minimum data necessary to fulfill the purpose?
- If pseudonymized data is sufficient, pseudonymization is mandatory.
- What safety measures do you think are appropriate?
- This could shift a legitimate interest balancing test in your favor.
- What compliance measures are you obliged to take?
- E.g. information per Art 13–14, preparation for data subject requests, engaging data processors, further safety measures.
While your purposes are probably benign, it can be useful to recall that the presence of identifiers in data sets can be a matter of life and death. When accounts were leaked in the Ashley Madison data breach, that drove some users to suicide. In some countries, the existence of a Grindr account can be a death sentence. Those are examples involving special categories of data per GDPR Art 9, so likely far more sensitive than the context of this question. However, in the AM breach it would not have helped much to hash identifiers like emails: third parties would still be able to check whether the email of someone they know was part of the breach.