Re: Passport scans and driver's licenses?
"probably staff rather than customers?"
Doesn't matter. They still only need to keep a record that the data has been verified, eg passport could relate the Right To Work, drivers licence for any employ required to drive a vehicle on behalf of the company, but neither need to be kept in their entirety, especially as scans. Even a driving licence should only really need a record of what classes of vehicle are covered against the named employee.
Being a remote worker, my employer requires an annual driving licence check. I send them a scan, they confirm the details, they delete the file. (I actually send them the same scan each year, since nothing changes and no one ever notices or complains :-))
Although now I come to think of it, it's entirely likely that those scans might still be in some email archive. I must ask about that on Monday. Most of our emails default to auto-delete in 2027/8 or thereabouts (5 years autodelete??)so just deleting it Outlook obviously isn't enough.