Data Protection Act 1998

3The transfer is necessary—

(a)for the conclusion of a contract between the data controller and a person other than the data subject which—

(i)is entered into at the request of the data subject, or

(ii)is in the interests of the data subject, or

(b)for the performance of such a contract.