The amount of data the NCA requests for a mandatory report to the Online Safety Act born CSEA-IRP is quite something.

Among the usual stuff (account ID, name, email etc) there is; Biometrics, ID verification documents, last 3 months of IP addresses, credit card PANs.

What's interesting is that Schedule 1 makes no mention of banking details or biometrics etc.