# Data Protection Act 2018, Paragraph 11


(1) This condition is met if the processing—
(a) is necessary for the exercise of a protective function,
(b) must be carried out without the consent of the data subject so as not to prejudice the exercise of that function, and
(c) is necessary for reasons of substantial public interest.
(2) In this paragraph, “protective function” means a function which is intended to protect members of the public against—
(a) dishonesty, malpractice or other seriously improper conduct,
(b) unfitness or incompetence,
(c) mismanagement in the administration of a body or association, or
(d) failures in services provided by a body or association.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/11 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/schedule-1/paragraph-11
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.