To process criminal offence data, in addition to having a lawful basis for processing, you need to show that you are processing the data under the control of official authority or authorised to process the data under UK law.
Processing under the control of official authority means that you have the authority to process criminal offence data under the law, and you must be able to point to a specific law that provides you with such authority. Generally, public bodies (and private bodies given public sector tasks) may have such authority to process. For example, the courts have specific official authority to process criminal offence data.
If you are not processing under the control of official authority, you can only process criminal offence data if you are authorised to do so by UK law.  This means that one of the 28 conditions set out in the Data Protection Act 2018 needs to be met. These 28 conditions include, but are not limited to, processing criminal offence data for reasons of fraud prevention, suspicion of terrorist financing or money laundering, and insurance.
For more information, read Compliance for DPIAs and Criminal offence data for DPIAs.