Data Protection Act 1998

2The transfer is necessary—

(a)for the performance of a contract between the data subject and the data controller, or

(b)for the taking of steps at the request of the data subject with a view to his entering into a contract with the data controller.