Contractual basis too, is often the easiest way to collect and store PII. Eg if you have a contract with someone you can often store a lot of their data to fulfil the contract.

There is meant to be a sense of proportionality, but as many things with privacy laws it's subject to interpretation and intentionally left vague.