Contract analysis

1. Executive Summary This memorandum has been prepared by Calderwood & Harkness LLP ("C&H") at the instruction of Northgate Telecommunications PLC ("NTP" or the "Company") to assess the Company's current regulatory risk exposure under the UK General Data Protection Regulation ("UK GDPR"), the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), and the Data Protection Act 2018 ("D

2. Background and Context 2.1 Corporate Structure and Data Processing Scale Northgate Telecommunications PLC is a public limited company incorporated in England and Wales under Company Number 04837291. Its registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office is located at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP's shares are admitted to the p

3. Analysis of ICO Enforcement Notice (ENF/2021/0934) 3.1 Summary of Enforcement Action On 15 September 2021, the Information Commissioner's Office issued Enforcement Notice reference ENF/2021/0934 to Northgate Telecommunications PLC. The enforcement action arose from an ICO investigation into NTP's consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal. The investigation identifie

4. Analysis of DPC Preliminary Inquiry (IN-22-11-3) 4.1 Summary of DPC Inquiry In November 2022, the Data Protection Commission (Ireland) opened a preliminary inquiry under reference IN-22-11-3 into the cross-border data transfer practices of Northgate Ireland Ltd. Northgate Ireland Ltd (CRO 587214) is NTP's Irish subsidiary, registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92,

5. GDPR Article 83 Administrative Fines Framework — Potential Exposure 5.1 Fining Framework Overview

Article 83 of the EU GDPR (and the corresponding provisions of the UK GDPR, read with sections 155 to 157 of the DPA 2018) establishes a two-tier administrative fines framework. The relevant tiers are set out below. Higher tier (Article 83(5)). The higher tier provides for administrative fines of up to €20 million, or up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Th

Article 83(2) of the EU GDPR sets out a non-exhaustive list of factors that supervisory authorities must take into account when determining the amount of any administrative fine. Our assessment of these factors as they apply to NTP is set out below. (a) Nature, gravity, and duration of the infringement. NTP's international data transfer mechanism deficiencies have persisted since at least the date of the Schrems II j

6. UK GDPR-Specific Regulatory Risk Considerations 6.1 ICO Fining Powers Under UK GDPR Following the United Kingdom's withdrawal from the European Union, the UK GDPR operates as a standalone data protection regime, with the Information Commissioner's Office serving as the independent supervisory authority. The ICO retains its own fining powers, independent of the DPC and other EU supervisory authorities. Under the UK

7. Sector-Specific Regulatory Considerations 7.1 Telecommunications Sector Scrutiny Telecommunications operators are subject to heightened regulatory scrutiny under data protection law by reason of the volume and sensitivity of the communications data they process. NTP's position as a provider of fixed-line and mobile telecommunications services, as well as a cloud-based unified communications platform, places it squ

8. Risk Matrix and Prioritisation 8.1 Risk Summary Table The following risk matrix summarises the principal regulatory risks identified in this assessment, together with our assessment of their likelihood, potential impact, and recommended priority for remediation. 8.2 Prioritised Remediation Recommendations Based on the risk assessment set out above, we recommend the following prioritised remediation programme:

1. CRITICAL — International Data Transfer Mechanisms This is the highest-priority remediation item and should be treated as urgent. The recommended actions are as follows: (a) Execute updated EU Standard Contractual Clauses (Module 2, Controller to Processor) with Caldwell Analytics Inc., incorporating the full text of the SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914; (b) Execute the UK Int

2. HIGH — DPIAs for High-Risk Processing Complete Data Protection Impact Assessments for all eleven identified high-risk processing activities. In particular: (a) DPIA-008 (facial recognition technology deployed for physical access control at Northgate Tower) should be treated as a priority, as it may require prior consultation with the ICO and/or DPC under Article 36, given the inherent high-risk nature of biometric

3. HIGH — ROPA Build-Out Complete a comprehensive Record of Processing Activities covering all 147 processing activities across UK and EU operations, in compliance with Article 30 of the EU GDPR and UK GDPR. The ROPA should be maintained as a living document, updated in real time as processing activities change. The ROPA is a foundational document that supports NTP's accountability obligations and will be essential i

4. HIGH — Governance Framework Establish a comprehensive data protection governance framework, including: (a) A group data protection policy setting out the principles, roles, responsibilities, and procedures governing the processing of personal data across all NTP entities; (b) Data subject rights procedures, including standardised workflows and response templates for data access requests, erasure requests, objectio

5. MEDIUM — Ongoing Monitoring Establish mechanisms for ongoing compliance monitoring, including: (a) Annual DPIA reviews to assess whether changes to processing activities or the risk environment necessitate updates to existing DPIAs; (b) Quarterly ROPA updates to reflect changes to processing activities, data flows, and third-party relationships; (c) Legislative and regulatory tracking, with particular attention to

9. Audit & Risk Committee Reporting Implications The NTP Board Audit & Risk Committee resolution of 8 December 2022 mandated a comprehensive GDPR compliance programme and requires regular progress reporting. We set out below our recommendations regarding reporting to the Audit & Risk Committee. Regular reporting. The findings of this Regulatory Risk Assessment should be reported to the Audit & Risk Committee at the e