Contract analysis

1. INTRODUCTION AND PURPOSE 1.1 Background Northgate Telecommunications PLC ("NTP" or the "Company") is a United Kingdom-headquartered public limited company incorporated under the Companies Act 2006 with registered number 04837291. NTP's registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office is situated at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN.

2. DEFINITIONS 2.1 Key Definitions For the purposes of this Procedure, the following terms shall have the meanings set out below, unless the context requires otherwise. Where terms are defined in the UK GDPR, the EU GDPR, or the DPA 2018, those statutory definitions shall apply and the definitions below are provided for convenience and operational clarity. "Personal Data Breach" means a breach of security leading to

3. BREACH IDENTIFICATION AND CLASSIFICATION 3.1 Sources of Breach Detection Personal data breaches may be detected through range internal and external channels. It is essential that all potential sources of breach intelligence are monitored and that mechanisms exist for the rapid escalation of suspected incidents. Internal Detection. The following internal channels may give rise to the detection of a personal data br

4. INTERNAL ESCALATION CHAIN 4.1 Breach Response Team (BRT) — Composition NTP has established a standing Breach Response Team with designated members drawn from key functions across the organisation. The BRT is convened by the DPO upon confirmation or reasonable suspicion of a personal data breach. The composition of the BRT is as follows: Chief Information Security Officer — Thomas Okoye (NTP PLC) Thomas Okoye repor

5. SUPERVISORY AUTHORITY NOTIFICATION 5.1 Notification Obligation Under Article 33(1) of the UK GDPR and Article 33(1) of the EU GDPR, the controller must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms

6. DATA SUBJECT NOTIFICATION 6.1 Threshold for Notification Under Article 34(1) of the UK GDPR and EU GDPR, where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The determination of whether a breach is likely to result in a high risk to rights and freedoms is mad

Article 34(3) of the UK GDPR and EU GDPR provides that the communication to the data subject referred to in Article 34(1) shall not be required if any of the following conditions is met: (a) Appropriate technical and organisational protection measures applied to the affected data. The controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the person