if any of your uploaders or performers are in the eu you also need a lawful basis for holding their ids, and ideally a short agreement with the uploader covering what they collected and how. i know that is yet another form but it is the thing that lets you say the id reached you lawfully. an id you cannot explain the provenance of is just a liability sitting in your store waiting to be a problem.
newish here and i sit on the data side, one thing i would add is track your records completeness as an actual number. percent of live content with a complete record set, age of the oldest incomplete one, that kind of thing. if you cannot see the gap you assume it is fine until an inspection finds the one clip from months ago that slipped through. put the gap on a dashboard you actually look at.
last thing from me, log who opens the id store and alert on anything that looks off. the compliance win turns into the breach headline the day a disgruntled contractor or a popped admin account pulls the whole thing. you are holding the exact data that makes the news. treat read access to that store the way you treat the payout keys, few people, logged, reviewed, and nobody browsing it for fun.