Yes. Collecting data because it's required to process an order / provide a service would be legal.

You are then responsible for protecting that data too which is why you would prefer not to collect it if possible.