Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons.
What is the lawful GDPR basis for processing the investors' personal data, including their name, address, and photo IDs?
My guess would be either Contract or Legal Obligation (to comply with AML regulations).
A subscription agreement cannot be drafted without the investor's personal details. However, it can be drafted without a photo ID, but the photo ID is necessary to check the identity of the investor against an AML database.
Note: this question is about a UK company and so about the UK Data Protection Act, but since that is basically a copy-and-paste of GDPR, this question applies to EU companies as well.