Contract analysis

1. Introduction and Purpose 1.1 Background to this DPIA This Data Protection Impact Assessment ("DPIA") is prepared pursuant to Article 35 of the United Kingdom General Data Protection Regulation (the "UK GDPR") and Article 35 of Regulation (EU) 2016/679 (the "EU GDPR") as part of a comprehensive GDPR compliance programme build commissioned by Northgate Telecommunications PLC ("NTP" or the "Controller") and undertake

1. Assess the data protection risks associated with NTP's transfer of pseudonymised subscriber analytics data to Caldwell Analytics Inc. ("Caldwell") in the United States for the purpose of AI-driven network analytics and predictive maintenance services.

2. Evaluate the necessity and proportionality of the processing, including consideration of alternative approaches and the application of data minimisation principles.

3. Identify risks to the rights and freedoms of data subjects and assess the likelihood and severity of those risks, including but not limited to risks arising from the international transfer of personal data to a jurisdiction that does not benefit from an adequacy decision.

4. Assess mitigation measures, including technical, contractual, and organisational supplementary measures designed to reduce identified risks to an acceptable level.

5. Analyse the legal framework of the destination country (United States) as it pertains to government access to, and surveillance of, personal data held by entities such as Caldwell. This analysis cross-references the companion Transfer Impact Assessment prepared under reference TIA-001 (Transfer Impact Assessment: NTP → Caldwell Analytics Inc. (US)), which provides a detailed assessment of US surveillance law and i

6. Assess supplementary measures required under the framework established by the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II") and the subsequent guidance issued by the European Data Protection Board ("EDPB"). The scope of this DPIA encompasses the entire end-to-end data processing li

2. Description of the Processing 2.1 Nature of the Processing NTP transfers pseudonymised subscriber analytics data to Caldwell pursuant to a Master Services Agreement dated 1 June 2021 (the "MSA"). Under the MSA, Caldwell provides AI-driven network analytics and predictive maintenance services to NTP. These services are designed to enable NTP to optimise its telecommunications network infrastructure, predict and pre

1. Subscriber metadata — call detail records ("CDRs"): CDRs include timestamps of subscriber communications, duration of calls and data sessions, and communication endpoints (i.e., the originating and terminating identifiers for each communication). All CDRs are pseudonymised prior to transfer; direct subscriber identifiers are replaced with pseudonymous keys generated by NTP's pseudonymisation engine.

2. Location data: Cell-tower level geolocation data associated with subscriber connections. This data indicates the cell tower to which a subscriber's device was connected at a given point in time, providing geolocation information at a resolution determined by cell tower density (typically within a radius of several hundred metres in urban areas and several kilometres in rural areas). Location data is pseudonymised

3. Device identifiers: International Mobile Equipment Identity ("IMEI") numbers, Media Access Control ("MAC") addresses, and Subscriber Identity Module ("SIM") identifiers associated with subscriber devices. These identifiers are hashed using salted hashing algorithms prior to transfer; the original device identifiers are not transferred in cleartext. The salt values are rotated on a quarterly basis.

4. Network performance metrics associated with individual connections: Metrics including latency, throughput (upload and download speeds), signal strength (RSSI/RSRP), packet loss rates, and handover events. These metrics are associated with individual pseudonymised subscriber sessions and are used by Caldwell's ML models to assess network quality at the per-connection level.

5. IP addresses: Internet Protocol addresses associated with subscriber data sessions. IP addresses are truncated and pseudonymised prior to transfer; the final octet (IPv4) or the final 80 bits (IPv6) are removed, and a pseudonymous key is appended. Critically, direct identifiers — including subscriber name, postal address, email address, telephone number, account number, and billing information — are NOT transferre

1. Network optimisation: Identifying underperforming network segments, bottlenecks, and areas of suboptimal coverage through analysis of granular, per-connection performance data. The analytics outputs enable NTP's network engineering teams to prioritise remedial interventions and infrastructure upgrades.

2. Predictive maintenance: Reducing unplanned network outages through machine learning-driven anomaly detection. Caldwell's predictive models analyse historical and real-time performance data to forecast network element failures (e.g., base station hardware degradation, backhaul congestion) before they result in service disruptions.

3. Capacity planning: Informing NTP's network investment decisions by providing data-driven insights into usage patterns, demand trends, and projected capacity requirements across different network segments and geographic regions.

4. Quality of service improvement: Enhancing the overall subscriber experience through data-driven network management, including identification of recurring service quality issues affecting specific geographic areas or subscriber segments. The processing does not involve any direct decision-making about individual data subjects. No individual subscriber is subject to any action, decision, or outcome based on the anal

1. Master Services Agreement ("MSA"): Dated 1 June 2021, between NTP and Caldwell, establishing the commercial terms for Caldwell's provision of network analytics and predictive maintenance services.

2. EU Standard Contractual Clauses (Module 2: Controller to Processor): Executed on 17 July 2023 between NTP (as data exporter and controller) and Caldwell (as data importer and processor), pursuant to the European Commission's Implementing Decision (EU) 2021/914. Module 2 (Controller to Processor) has been selected to reflect the parties' respective roles.

3. UK International Data Transfer Agreement ("IDTA"): Executed on 17 July 2023 for the purposes of UK personal data transfers, pursuant to the ICO's approved IDTA template.

4. Data Processing Agreement ("DPA"): Incorporated into the MSA and updated in connection with the execution of the EU SCCs and UK IDTA to ensure alignment with GDPR requirements, including data subject rights assistance, breach notification obligations, sub-processor controls, and audit rights.

5. Caldwell's external legal counsel: Hargrove Lister & Webb LLP, represented by Natalie Prescott (Partner, Data Privacy & Cybersecurity), with principal office at 555 Mission Street, Suite 3100, San Francisco, CA 94105, and London office at 30 Fenchurch Street, London EC3M 3BD. Hargrove Lister & Webb LLP participated in the negotiation of the EU SCCs, UK IDTA, and amended DPA. The negotiation and execution of the EU

3. Assessment of Necessity and Proportionality 3.1 Lawful Basis for Processing The lawful basis relied upon by NTP for the processing described in this DPIA is legitimate interest under Article 6(1)(f) of the UK GDPR and the EU GDPR. NTP does not rely on consent, contractual necessity, or any other lawful basis for this processing activity. NTP's legitimate interests in this processing are as follows: • Maintaining a

1. Specialist expertise and computational resources: The AI-driven analytics processing requires specialist machine learning expertise and significant computational resources that are not currently available within NTP's in-house capabilities. Caldwell has developed proprietary predictive maintenance algorithms specifically designed for telecommunications network data, and these algorithms have demonstrated measurabl

2. Assessment of alternatives: NTP and C&H conducted an assessment of alternative approaches prior to concluding that the transfer to Caldwell is necessary: (a) Building in-house capability: Assessed as requiring 18 to 24 months of development time, significant capital investment (estimated at £12–15 million for talent acquisition, infrastructure, and model development), and ongoing operational expenditure. This opti

3. Demonstrated value: Since the commencement of services under the MSA in September 2021, Caldwell's analytics have contributed to a measurable reduction in unplanned network outages (NTP internal reporting indicates a 23% reduction in mean time to detection of network faults since deployment) and have informed £48 million in targeted network infrastructure investments. 3.3 Proportionality The processing is proporti

4. Identification and Assessment of Risks 4.1 Risk Framework Risks have been assessed in this DPIA using a structured risk framework that evaluates each identified risk against two dimensions: • Likelihood: The probability that the risk will materialise, rated as Remote, Possible, or Probable. • Severity: The potential impact on the rights and freedoms of data subjects if the risk materialises, rated as Minimal, Sign

5. Measures to Mitigate Risks (Supplementary Measures and Safeguards) 5.1 Contractual Measures The following contractual measures have been implemented or are being implemented to mitigate the identified risks: EU Standard Contractual Clauses (Module 2: Controller to Processor). EU SCCs were executed on 17 July 2023 between NTP (as data exporter and controller) and Caldwell (as data importer and processor) in accorda