Data Protection Act 2018

Regulatory requirements relating to unlawful acts and dishonesty etc

12 (1) This condition is met if—

(a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has—

(i) committed an unlawful act, or

(ii) been involved in dishonesty, malpractice or other seriously improper conduct,

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing, and

(c) the processing is necessary for reasons of substantial public interest.

(2) In this paragraph—

• “act” includes a failure to act;

• “regulatory requirement” means—

  (a)

  a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, or

  (b)

  a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity.