Also this isn’t really GDPR, unless they do not store the info securely or if they flog it to the highest bidder!
Holding your personal info does not break GDPR law.
If you are looking to join them to work, they need to keep copies of your ID and Nat ins.
Is a record of what they have seen not a copy!
As far as I am aware an employer should have proof that you are who you say you are.