A subject people prefer to ignore until a complaint arrives. The rules are simpler than they look and cheaper to follow than to argue about later.
What counts
Anything that identifies a specific person: name, username, phone number, and in combination less obvious details too. A Telegram username points at one person, so it is personal data even when it is public.
What needs consent
Processing for outreach, and passing data to anyone else. Simply holding usernames found in public chats is not the same as messaging them or selling the list.
Collecting consent properly
The person has to act: subscribe, submit a request, message first. Then contacting them is lawful, and that same consent protects you from complaints. A checkbox with clear wording is the working minimum.
Storage
- Do not keep a list longer than it is useful. A year-old list does not work and does create risk.
- Do not put it anywhere publicly reachable: cloud folders with open links are a classic leak.
- Be able to delete one person's data on request. Almost every jurisdiction requires it.
The one rule that covers most of it
If you would not be comfortable telling someone where you got their contact and why you are writing, do not write. That is both a legal standard and the best quality filter there is. What can be collected lawfully is in the scraping piece.