Contract analysis

1. Executive Summary This Data Protection Impact Assessment ("DPIA") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Northgate Telecommunications PLC ("NTP" or the "Company") in respect of the NorthPulse Employee Wellbeing Monitoring Platform ("NorthPulse" or the "Platform"). This DPIA forms part of the comprehensive GDPR compliance programme being conducted by C&H under Engagement Reference SC/NT

2. Introduction and Scope 2.1 Purpose of this DPIA This Data Protection Impact Assessment has been conducted pursuant to Article 35 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and Article 35 of the UK GDPR (as incorporated into domestic law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018), which require data controllers to carry out an assessment of the i

3. Systematic Description of the Processing 3.1 Nature of the Processing The NorthPulse Platform processes employee wellbeing data through several distinct but interconnected data collection and analysis mechanisms. The nature of the processing can be described across the following activity categories: Self-reported surveys. The Platform administers two categories of survey instruments to participating employees. Fir

4. Assessment of Necessity and Proportionality 4.1 Necessity

Article 35(7)(b) of the GDPR requires that a DPIA include an assessment of the necessity of the processing operations in relation to the purposes. This section assesses whether the processing activities described in Section 3 are necessary to achieve the stated purposes identified in Section 3.4. The stated primary purpose of NorthPulse is supporting employee wellbeing and identifying organisational wellbeing trends.

5. Lawful Basis Analysis 5.1 Article 6 Lawful Basis — Processing of Personal Data The identification of an appropriate lawful basis under Article 6(1) of the GDPR is a prerequisite for all processing of personal data through the NorthPulse Platform. The following analysis considers the available lawful bases and identifies the basis most appropriate for the processing activities in question. Legitimate interest — Art

6. Risk Identification and Assessment 6.1 Risk Matrix The following risk matrix sets out the methodology applied to the identification and assessment of risks arising from the NorthPulse processing activities. Each risk has been assessed on two dimensions: likelihood of the risk materialising (rated as HIGH, MEDIUM, or LOW) and severity of impact on data subjects if the risk materialises (rated as HIGH, MEDIUM, or LO