Contract analysis

1. Executive Summary This memorandum sets out the internal project plan governing the execution of the comprehensive GDPR and UK GDPR compliance program build for Northgate Telecommunications PLC ("NTP" or the "Client"), a company incorporated in England and Wales under Company Number 04837291. The memorandum is prepared for the exclusive use of the Calderwood & Harkness LLP ("C&H") engagement team and is subject to

2. Client Overview and Scope Context 2.1 NTP Group Structure Northgate Telecommunications PLC is the parent company of the NTP Group. It is incorporated in England and Wales, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office and operational headquarters at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP holds a current registration with the UK Info

3. Engagement Team and Staffing Allocations 3.1 Calderwood & Harkness LLP Team The engagement will be staffed by a core team of four C&H lawyers from the Privacy & Data Security practice group. The team has been assembled to balance deep subject matter expertise with cost efficiency, ensuring that the engagement can be delivered within the agreed fee cap. The team composition, hourly rates, estimated allocations, and

4. Phase Structure, Deliverables, and Fee Caps This Section sets out the detailed structure, deliverables, key activities, dependencies, and milestones for each of the five principal phases of the engagement, together with the fee cap allocated to each phase. The engagement has been designed as a sequential phased structure, with each phase building upon the outputs of the preceding phase. However, certain activities

1. Data Mapping Questionnaire Template. A comprehensive questionnaire designed to capture the full range of personal data processing activities across all NTP business units in the UK and EU operations. The questionnaire will cover, for each processing activity: the description and purpose of the processing; the categories of data subjects; the categories of personal data (including any special category data); the la

2. GDPR Gap Analysis Report. A comprehensive assessment of NTP's current state of GDPR and UK GDPR compliance measured against the full requirements of both regulatory frameworks. The report will identify areas of compliance, areas of partial compliance, and material gaps, and will provide prioritised recommendations for remediation. The gap analysis will cover, at a minimum: data protection governance and accountabi

3. Regulatory Risk Assessment Memorandum. A focused analysis of NTP's regulatory risk exposure, with particular reference to: the ICO Enforcement Notice ENF/2021/0934 and its implications for heightened regulatory scrutiny; the DPC preliminary inquiry IN-22-11-3 and the specific risks associated with that inquiry, including potential enforcement outcomes; and a broader assessment of supervisory authority priorities a

4. Memorandum on UK GDPR vs. EU GDPR Divergence. A detailed analysis of the post-Brexit divergence between the UK GDPR (as amended by the Data Protection Act 2018 and retained EU law) and the EU GDPR, with particular focus on areas of practical significance for NTP's operations, including: differences in international transfer mechanisms (UK IDTA vs. EU SCCs); the supervisory authority split between the ICO and the D

1. ROPA — Controller Activities (NTP PLC, UK Operations). A comprehensive Article 30 register documenting all processing activities carried out by NTP PLC in its capacity as a data controller in respect of its UK operations. The ROPA is targeted to document 89 individual processing activities. For each activity, the register will record: the name and contact details of the controller and DPO; the purposes of the proc

2. ROPA — Controller Activities (EU Subsidiaries). An Article 30 register documenting all processing activities carried out by each of the five EU subsidiaries in their capacity as data controllers. The ROPA is targeted to document 58 individual processing activities across the five entities, distributed as follows: Northgate Ireland Ltd (18 activities); Northgate GmbH (16 activities); Northgate B.V. (11 activities);

3. ROPA Methodology & Guidance Note. An internal NTP guidance document setting out the methodology for maintaining and updating the ROPA on an ongoing basis. This document will provide practical guidance for NTP data stewards and the DPO function on: how to identify new processing activities that require ROPA registration; how to update existing ROPA entries when processing activities change; the frequency of schedul

4. Legitimate Interest Assessment (LIA) Template. A structured template for conducting legitimate interest assessments in respect of the 64 processing activities that rely on legitimate interest as the lawful basis for processing. The template will implement the three-part balancing test comprising: (i) identification of the legitimate interest pursued by the controller or a third party; (ii) assessment of whether th

1. DPIA-001: NorthCloud AI-Driven Customer Churn Prediction Model. This DPIA addresses NTP's deployment of an AI-driven predictive model that analyses subscriber behaviour data to identify customers at risk of churn. The processing is classified as high-risk on the basis that it involves automated decision-making, profiling, and processing of personal data at scale. The DPIA will assess the necessity and proportional

2. DPIA-002: Network Traffic Analysis and Anomaly Detection. This DPIA addresses the processing of subscriber metadata for network traffic analysis and anomaly detection purposes. The processing involves large-scale analysis of communications metadata, including traffic patterns, session data, and approximate location data, for the purpose of identifying network anomalies, detecting potential security threats, and op

3. DPIA-003: Employee Wellbeing Monitoring Platform "NorthPulse". This DPIA addresses the NorthPulse platform, an employee wellbeing monitoring tool that collects and processes employee health and wellbeing data. The processing is classified as high-risk on the basis that it involves special category data (health data), systematic monitoring of employees, and the inherent power imbalance in the employment relationshi

4. DPIA-004: IoT Device Telemetry Processing (Smart City Pilot, Birmingham). This DPIA addresses the processing of data from IoT device endpoints as part of NTP's smart city pilot in Birmingham. The processing involves the collection and analysis of telemetry data from approximately 12,000 IoT device endpoints, including connected-vehicle telemetry, environmental sensors, and traffic management systems.

5. DPIA-005: Biometric Access Control System (Data Centres). This DPIA addresses the biometric access control systems deployed at NTP's data centres in London, Frankfurt, Amsterdam, and Dublin. The processing involves the collection and processing of biometric data (fingerprint and/or palm geometry scans) for the purpose of access control and security.

6. DPIA-006: Customer Credit Scoring and Fraud Detection. This DPIA addresses NTP's customer credit scoring processes, which are used to assess the creditworthiness of new and existing subscribers, and its fraud detection systems, which analyse transaction and usage patterns to identify potentially fraudulent activity.

7. DPIA-007: Marketing Profiling and Targeted Advertising, NorthCloud Freemium Tier. This DPIA addresses the profiling and targeted advertising activities conducted in connection with the NorthCloud freemium tier offering. The processing is classified as high-risk on the basis that it involves profiling, large-scale processing of subscriber data, and the potential for discriminatory targeting based on inferred charac

8. DPIA-008: CCTV and Facial Recognition Pilot, London HQ. This DPIA addresses the pilot deployment of CCTV with facial recognition technology at NTP's London headquarters at Northgate Tower. The processing is classified as high-risk on the basis that it involves biometric data (which constitutes special category data when processed for the purpose of uniquely identifying a natural person), systematic monitoring of a

9. DPIA-009: Cross-Border HR Analytics and Workforce Planning. This DPIA addresses the processing of employee personal data for cross-border HR analytics and workforce planning purposes, including analysis of workforce demographics, performance data, attrition patterns, and succession planning across the NTP Group's UK and EU operations.

10. DPIA-010: Lawful Intercept and Communications Data Retention. This DPIA addresses NTP's obligations in respect of lawful interception of communications and communications data retention under the Regulation of Investigatory Powers Act 2000 ("RIPA") and the Investigatory Powers Act 2016 ("IPA"). This DPIA will assess the intersection of statutory obligations with data protection requirements, the proportionality o

11. DPIA-011: Caldwell Analytics Network Performance Data Transfer to US. This DPIA addresses the transfer of pseudonymised subscriber analytics data from NTP (and from Northgate Ireland Ltd and Northgate GmbH) to Caldwell Analytics Inc. in the United States for AI-driven network analytics and predictive maintenance. The processing is classified as high-risk on the basis that it involves large-scale third-country tra

12. DPIA Summary Register & Board Report. An executive summary document consolidating the findings, risk assessments, and recommendations from all 11 DPIAs, prepared for presentation to the NTP Board Audit & Risk Committee. The Board Report will provide a high-level overview of the identified risks, the mitigation measures recommended, and any residual risks requiring Board-level attention. 4.3.2 Key Activities (a) D

1. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. A set of EU Standard Contractual Clauses adopted pursuant to the European Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), governing the transfer of pseudonymised subscriber analytics data from NTP (and Northgate Ireland Ltd) to Caldwell Analytics Inc. in the United States. The SC

2. UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics Inc. A UK International Data Transfer Agreement in the form approved by the ICO, governing the transfer of personal data from NTP PLC (as a UK controller) to Caldwell Analytics Inc. in the United States. The IDTA will be executed alongside the EU SCCs to provide coverage for transfers subject to the UK GDPR. Target execution date: 17 July

3. Transfer Impact Assessment (TIA-001): NTP → Caldwell Analytics Inc. (US). A comprehensive Transfer Impact Assessment evaluating the laws and practices of the United States that may affect the protection of personal data transferred to Caldwell. The assessment will address: the Foreign intelligence Surveillance Act (FISA), including Section 702; Executive Order 12333; the Clarifying Lawful Overseas Use of Data (CLO

4. Transfer Impact Assessment (TIA-002): Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd. A Transfer Impact Assessment evaluating the laws and practices of India that may affect the protection of personal data transferred from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd. The assessment will address: the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Pr

5. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd. An amended and restated Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd, addressing: the sub-processor approval mechanism (prior specific authorisation or general written authorisation with objection right); breach notification obligations (within 36 hours of becoming aware); audit rights (including the right to conduct on

6. UK Addendum to EU SCCs — Template. A template UK Addendum to the EU Standard Contractual Clauses in the form approved by the ICO, for use in respect of the four transfers that are subject to both the UK GDPR and the EU GDPR. The template will be pre-populated with NTP-specific information and accompanied by drafting guidance notes.

7. International Transfers Policy & Mechanism Selection Guidance. An internal NTP policy document governing the identification, assessment, and management of international data transfers. The policy will include: a decision tree for mechanism selection (adequacy decision, EU SCCs, UK IDTA, UK Addendum to EU SCCs, binding corporate rules, or derogations); TIA requirements and methodology; supplementary measures guidan