Yes, if you’re going to use the personal data that some other company gathered for you and if the data owners are EU citizens. Remember that GDPR is not about gathering data or storing data only. It’s about processing data in general. According to the regulation: 

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; 

So, if at some point you will get the data to use them, e.g. send emails, you will process it as well. Remember that if you decide about the purpose of the data collection and use, you are the data administrator. And as the data administrator, you definitely should be concerned with GDPR. You should also make sure that the company you outsource list building to, should collect the data in a legal, fair, and transparent way.