For processing of personal data to be lawful under Part 3 of the DPA, you must either have the consent of the data subject, or the processing must be necessary for the performance of a task carried out for a law enforcement purpose by a competent authority.
The DPA defines law enforcement purposes as ‘the prevention, investigation detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
If you are relying on consent, the same rules on consent apply as under the UK GDPR. It must be unambiguous, and involve a clear affirmative action. For example, a pre-ticked box would not demonstrate a positive action – the individual must proactively select that option themselves.