Contract analysis

1. Introduction and Purpose 1.1 Purpose of This Guidance Note This guidance note sets out the methodology, roles, responsibilities, and procedures for maintaining and updating the Records of Processing Activities ("ROPA") of Northgate Telecommunications PLC ("NTP" or the "Company") and its EU subsidiaries on an ongoing basis. It is intended to serve as the authoritative procedural reference for all NTP personnel invo

Article 30(1) GDPR / UK GDPR imposes an obligation on each controller to maintain a record of processing activities carried out under its responsibility. The record must contain the information specified in Article 30(1)(a) through (g), including the identity of the controller, the purposes of processing, the categories of data subjects and personal data, the categories of recipients, details of international transfe

Article 30(2) GDPR / UK GDPR imposes a corresponding obligation on each processor to maintain a record of all categories of processing activities carried out on behalf of a controller. While NTP primarily acts as a controller, certain NTP entities also act as processors in specific contexts (for example, where Northgate Ireland Ltd provides network management services to enterprise clients who retain controllership o

Article 30(5) GDPR / UK GDPR provides a limited exemption from the obligation to maintain records for organisations employing fewer than 250 persons. This exemption does not apply to NTP. With approximately 11,400 employees globally and approximately 8,200 employees in the United Kingdom and the European Union, NTP substantially exceeds the 250-employee threshold. Moreover, even if NTP were below that threshold, the

2. ROPA Structure and Content Requirements 2.1 Mandatory Fields Under Article 30(1) Each entry in the ROPA must contain, as a minimum, the information prescribed by Article 30(1)(a) through (g) of the UK GDPR and the EU GDPR. The following paragraphs describe each mandatory field and the standard to which it must be completed for NTP's purposes. (a) Controller identity and contact details. Each ROPA entry must record

3. Roles and Responsibilities The effective maintenance of the ROPA depends on clear allocation of roles and responsibilities across the NTP organisation. This section defines the key roles and their respective responsibilities in relation to ROPA governance. 3.1 Data Protection Officer (DPO) Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC. Mr. Mehta holds the Certified Information Privacy Pro

4. Update Triggers — When to Update the ROPA The ROPA is a living document and must be updated whenever there is a change to NTP's processing landscape that affects the accuracy or completeness of any ROPA entry. This section identifies the events that trigger a mandatory or recommended update to the ROPA. 4.1 Mandatory Update Events The ROPA must be updated promptly, and in any event within thirty (30) calendar days

5. ROPA Update Procedure This section describes the procedure to be followed when a trigger event identified in Section 4 occurs and a ROPA update is required. The procedure applies to both new ROPA entries and amendments to existing entries. 5.1 Identification and Notification The data steward for the relevant business unit or subsidiary identifies that a trigger event (as described in Section 4) has occurred or is

6. Annual ROPA Review Cycle 6.1 Timing and Scheduling In addition to the ad hoc updates triggered by the events described in Section 4, a comprehensive review of all ROPA entries must be conducted at least once every twelve (12) months. The annual review cycle is designed to ensure that the ROPA remains a complete and accurate reflection of NTP's processing landscape, even where no specific trigger event has been ide

7. Integration with Sundial Solutions Platform 7.1 Platform Configuration The Sundial Solutions privacy management platform has been configured by Ashdown Consulting Group Ltd to serve as the primary tool for ROPA management across the NTP group. The platform configuration has been designed to align with the ROPA structure and content requirements described in Section 2 of this guidance note, and to support the updat

8. Interaction with Other Compliance Workstreams The ROPA does not exist in isolation. It is a foundational element of NTP's broader data protection compliance framework and intersects with several other compliance workstreams. This section describes the key interactions and dependencies. 8.1 Data Protection Impact Assessments (DPIAs) ROPA entries serve as the foundational input for DPIA scoping. When the DPO determi