Contract analysis

1. EXECUTIVE SUMMARY This Transfer Impact Assessment ("TIA" or "Assessment") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Northgate Telecommunications PLC ("NTP", Company Number 04837291) in connection with the transfer of personal data from Pinnacle Cloud Services Ltd ("Pinnacle" or "PCS", Company Number 09142837, registered at Apex House, 24 Victoria Embankment, London EC4Y 0DZ, United Kingdo

2. METHODOLOGY AND LEGAL FRAMEWORK FOR THE ASSESSMENT 2.1 Applicable Guidance This Assessment has been prepared in accordance with the following authoritative guidance and jurisprudence:

1. EDPB Recommendations 01/2020: European Data Protection Board Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, as adopted in their final version on 18 June 2021. These Recommendations establish a six-step process for assessing and, where necessary, supplementing transfer tools to ensure that transferred personal data is afforde

2. EDPB Recommendations 02/2020: European Data Protection Board Recommendations 02/2020 on the European Essential Guarantees for surveillance measures, adopted on 10 November 2020. These Recommendations set out four "European Essential Guarantees" against which third-country surveillance legislation should be assessed, derived from the jurisprudence of the Court of Justice of the European Union and the European Court

3. ICO Guidance on International Data Transfers: Guidance issued by the Information Commissioner's Office on the requirements for international data transfers under the UK GDPR, including the ICO's transfer risk assessment tool and guidance on the use of the UK Addendum to the EU SCCs.

4. Schrems II Judgment: Judgment of the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18), delivered on 16 July 2020 ("Schrems II"). The Schrems II judgment invalidated the EU-US Privacy Shield and confirmed that data exporters relying on Standard Contractual Clauses must assess, on a case-by-case basis, whether the law

5. K.S. Puttaswamy v. Union of India: Judgment of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1, recognising the right to privacy as a fundamental right under Article 21 of the Constitution of India, which provides relevant context for the assessment of the Indian legal framework. The Assessment follows the six-step process prescribed by EDPB Recommendations 01/2020,

3. STEP 1 — KNOW YOUR TRANSFER 3.1 Data Exporter Pinnacle Cloud Services Ltd acts as a data processor for NTP pursuant to the Amended DPA. In this capacity, Pinnacle processes personal data on behalf of NTP in accordance with NTP's documented instructions as set out in the Amended DPA and its schedules. For the purposes of the EU SCCs (Module 3), Pinnacle is the data exporter, transferring personal data to Pinnacle I

4. STEP 2 — IDENTIFY THE TRANSFER TOOL 4.1 Transfer Mechanism The transfer tool relied upon for the transfer of personal data from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd is as follows: For EU personal data: EU Standard Contractual Clauses — Module 3 (Processor to Sub-processor), as set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Module 3 is the appropriat

5. STEP 3 — ASSESS THE LAWS AND PRACTICES OF INDIA 5.1 Overview of India's Data Protection Legal Framework 5.1.1 Information Technology Act 2000 (IT Act). The Information Technology Act 2000 (the "IT Act") is the principal legislation governing electronic data and information technology in India. Originally enacted to provide legal recognition for transactions carried out by means of electronic data interchange and o

Section 43A imposes an obligation on bodies corporate that possess, deal with, or handle any sensitive personal data or information in a computer resource which they own, control, or operate to implement and maintain reasonable security practices and procedures. Where a body corporate is negligent in implementing and maintaining reasonable security practices and procedures, and such negligence causes wrongful loss or

Section 72A criminalises the disclosure of personal information in breach of a lawful contract. Any person, including an intermediary, who has secured access to any material containing personal information about another person, under the terms of a lawful contract, and discloses such material to any other person without the consent of the person concerned, or in breach of a lawful contract, shall be punished with imp

Section 69B is particularly relevant to this Assessment because the data accessible to Pinnacle India includes infrastructure monitoring data, system logs, and traffic data relating to NTP's cloud hosting environment. If the Indian Government were to exercise its powers under Section 69B in respect of Pinnacle India's computer resources, it could potentially access traffic data and metadata relating to NTP data subje

Section 5(2) of the Telegraph Act empowers the Central Government or a State Government, or any officer specially authorised by the Central Government or a State Government, to order that any message or class of messages, to or from any person or class of persons, shall not be transmitted or shall be intercepted or detained, on the occurrence of any public emergency or in the interest of public safety, provided that

Section 91 (Production of Documents): Any court or officer in charge of a police station may issue a summons or written order requiring any person in whose possession or power any document or thing is believed to be to produce such document or thing. This provision could potentially be used to compel Pinnacle India to produce documents or data in its possession relating to NTP data subjects, in the context of a crimi