Contract analysis

1. Executive Summary 1.1 Purpose and Scope of this Report This report presents the findings of a comprehensive gap analysis of Northgate Telecommunications PLC's ("NTP" or the "Company") compliance posture against the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR") and the UK General Data Protection Regulation (as retained under the European Union (Withdrawal) Act

1. Records of Processing Activities (ROPA): The existing ROPA is incomplete, covering only approximately 40 of 147 identified processing activities, and lacks mandatory fields required by Article 30.

2. Data Protection Impact Assessments (DPIAs): At least 11 processing activities require full DPIAs that have not been conducted, including activities involving automated decision-making, biometric processing, and large-scale profiling.

3. International Data Transfer Mechanisms: All transfers to the United States are currently without a valid transfer mechanism following the expiry of the old-format Standard Contractual Clauses on 27 December 2022. No Transfer Impact Assessments have been conducted. This is the subject of an active regulatory inquiry by the Irish Data Protection Commission.

4. Data Subject Rights Procedures: No formalised procedure exists for handling data subject rights requests. Approximately 15% of DSARs in 2022 were not responded to within the statutory deadline.

5. Breach Notification Processes: The existing incident response procedure does not adequately address GDPR-specific breach notification obligations. Two of three personal data breaches in 2022 were reported to the ICO outside the 72-hour window.

6. Governance and Accountability Structures: The DPO function is under-resourced, legitimate interest assessments have not been documented, and privacy-by-design processes are not formalised. The urgency of these findings is heightened by two active regulatory proceedings. The ICO Enforcement Notice ENF/2021/0934, issued in September 2021, resulted in a monetary penalty of £320,000 for inadequate consent mechanisms f

2. Methodology 2.1 Approach and Framework The gap analysis was conducted by measuring NTP's current compliance posture against the full requirements of the EU GDPR and UK GDPR. The assessment framework was structured around the core obligations imposed by the GDPR, with particular attention to the following provisions: • Article 5 — Principles relating to processing of personal data (lawfulness, fairness, transparenc

3. Client Overview 3.1 Corporate Structure Northgate Telecommunications PLC is a public limited company incorporated in England and Wales under Company Number 04837291. The Company's registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office is at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom. NTP reported consolidated group r

4. Regulatory Risk Context 4.1 ICO Enforcement History On 15 September 2021, the Information Commissioner's Office issued Enforcement Notice reference ENF/2021/0934 against Northgate Telecommunications PLC. The subject matter of the enforcement action concerned NTP's use of direct marketing cookies on the NorthCloud customer portal. The ICO's investigation found that NTP had deployed analytics and advertising cookies

5. Gap Analysis Findings This section presents the detailed findings of the gap analysis across thirteen GDPR compliance domains. For each domain, the current state of NTP's compliance is described, the nature and severity of identified gaps are assessed, and specific remediation recommendations are provided. 5.1 Records of Processing Activities (Article 30) 5.1.1 Current State

Article 30 of the GDPR requires controllers to maintain a record of processing activities under their responsibility, containing specified information including the purposes of processing, categories of data subjects and personal data, categories of recipients, international transfers, envisaged retention periods, and a general description of technical and organisational security measures. NTP currently maintains a p

1. Build a comprehensive, Article 30-compliant ROPA covering all 147 identified processing activities (89 UK, 58 EU), including all mandatory fields required by Article 30(1) and Article 30(2) as applicable.

2. Implement a systematic ROPA maintenance process with designated business unit data stewards responsible for notifying the DPO of new processing activities, material changes to existing activities, and discontinued activities. Develop a ROPA methodology and guidance note for ongoing maintenance, including triggers for ROPA updates (e.g., new product launch, new processor engagement, change in lawful basis, new inte

3. Integrate the ROPA into the Sundial Solutions platform, with Ashdown Consulting Group Ltd responsible for platform configuration. Sundial Solutions will serve as the centralised ROPA repository, enabling real-time access, version control, and reporting capabilities.

4. Prepare LIA templates and complete balancing tests for all 64 legitimate-interest-basis activities. The LIA template will follow the three-part test recommended by the ICO: (i) identify the legitimate interest; (ii) show that the processing is necessary; and (iii) balance the interest against the individual's rights and freedoms.

5. Target delivery: ROPA v1.0, including all 147 processing activities and all completed LIAs, by 19 May 2023. 5.2 Data Protection Impact Assessments (Articles 35–36) 5.2.1 Current State

Article 35(1) of the GDPR requires that, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons — particularly where it involves the use of new technologies, and taking into account the nature, scope, context, and purposes of the processing — the controller must carry out a data protection impact assessment prior to the processing. Article 35(3) provides a non-exha

1. Conduct 11 full DPIAs (DPIA-001 through DPIA-011), each following the structured format required by Article 35(7) and incorporating the EDPB and ICO guidance. Each DPIA will include: (i) a systematic description of the processing, including purpose, scope, context, data categories, data subjects, and technology used; (ii) an assessment of necessity and proportionality; (iii) an assessment of the risks to the right

2. Prioritise the following DPIAs based on risk severity and regulatory urgency: DPIA-011 (Caldwell transfer — linked to DPC inquiry), DPIA-008 (facial recognition pilot — consider interim suspension), DPIA-001 (AI churn prediction), DPIA-003 (NorthPulse), and DPIA-007 (marketing profiling).

3. Establish an ongoing DPIA screening process with Article 35(1) triggers integrated into NTP's project governance and product development lifecycle. Develop a DPIA threshold assessment form that must be completed for all new processing activities, product features, AI models, and processor engagements, with escalation to the DPO for full DPIA determination.

4. Implement a privacy-by-design review process integrated into NorthCloud product development (working with Laura Dearden) and NTP's broader IT project governance framework, ensuring that privacy considerations are addressed at the design stage of all new processing activities.

5. Present DPIA summary findings and high-risk outcomes to the Board Audit & Risk Committee, ensuring Board-level visibility of high-risk processing and residual risks.

6. Target completion: All 11 DPIAs completed by early July 2023. 5.3 International Data Transfers (Articles 44–49) 5.3.1 Current State Chapter V of the GDPR (Art