Data Protection Act 1998

3The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.