DATA MAPPING QUESTIONNAIRE
Standardised Template for Business Unit Data Processing Inventory
GDPR / UK GDPR Compliance Program Records of Processing Activities (ROPA) Data Collection
Prepared by: Priscilla Wynn Associate, Privacy & Data Security Calderwood & Harkness LLP One Moorgate Square, London EC2R 6AN
Prepared for: Northgate Telecommunications PLC All Business Units — UK and EU Operations
Date of Distribution: 1 March 2023
Reference: SC/NTP/2023-0213/PDS — Phase 2 Workstream
Classification: Confidential — Internal Use Only
Version: 1.0
© Calderwood & Harkness LLP 2023. This document is confidential and is prepared solely for the internal use of Northgate Telecommunications PLC and its group entities in connection with the GDPR compliance program. Not to be distributed externally without the prior written consent of the General Counsel.
Right-click to update Table of Contents
Section 1: Introduction and Purpose
1.1 Background
This questionnaire forms part of the comprehensive data protection compliance program currently being undertaken by Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries across the United Kingdom and the European Union. The compliance program has been established by the NTP Board of Directors and the Chief Legal Officer to ensure full compliance with the UK General Data Protection Regulation (the "UK GDPR"), as incorporated into UK domestic law by the Data Protection Act 2018 (the "DPA 2018"), and the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), as applicable to NTP's EU subsidiary operations.
Calderwood & Harkness LLP ("C&H") has been engaged as external legal counsel to NTP to design, implement, and oversee this compliance program. The program encompasses a number of workstreams, of which data mapping and the construction of comprehensive Records of Processing Activities ("ROPA") constitute a critical Phase 2 deliverable. The data mapping workstream is intended to produce a complete and accurate inventory of all personal data processing activities conducted across the NTP group, serving as the foundational layer upon which all other compliance obligations are built.
Under Article 30 of both the UK GDPR and the EU GDPR, controllers and processors are required to maintain records of their processing activities. These records must contain prescribed information regarding the nature, scope, purposes, and safeguards applicable to each processing activity. The Information Commissioner's Office ("ICO") in the United Kingdom and the relevant supervisory authorities in the EU Member States in which NTP operates (including the Data Protection Commission in Ireland, the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit in Germany, the Autoriteit Persoonsgegevens in the Netherlands, the Commission Nationale de l'Informatique et des Libertés in France, and the Agencia Española de Protección de Datos in Spain) have each emphasised the importance of maintaining comprehensive and up-to-date ROPA as a demonstration of accountability under Article 5(2) of the GDPR.
Ashdown Consulting Group Ltd ("Ashdown") has been retained by NTP to provide technical data mapping and data flow inventory support. Ashdown's team, led by Anita Chakravarti, Lead Privacy Engineer, and Robert Fairclough, Managing Director, will work alongside C&H and the NTP Data Protection Officer ("DPO"), Sanjay Mehta, to ensure that responses to this questionnaire are accurately captured, validated, and uploaded into the Sundial Solutions privacy management platform currently being configured for NTP's use. The Sundial Solutions platform will serve as the centralised repository for ROPA records, data flow maps, and related compliance documentation across all NTP group entities.
Respondents should approach this questionnaire with the understanding that their responses will be directly relied upon to build NTP's regulatory compliance records. Accuracy, completeness, and timeliness of responses are therefore of paramount importance.
1.2 Purpose of This Questionnaire
The purpose of this questionnaire is to systematically capture all personal data processing activities conducted by each business unit within the NTP group, in sufficient detail to satisfy the requirements of Article 30 of the UK GDPR and the EU GDPR.
The information collected through this questionnaire will be used for the following purposes:
1. ROPA Population. Responses will be used to populate the Records of Processing Activities for each NTP entity, covering both UK operations (subject to the UK GDPR and DPA 2018) and the operations of each EU subsidiary (subject to the EU GDPR and applicable national implementing legislation). Each completed questionnaire will correspond to a discrete ROPA entry within the Sundial Solutions platform.
2. DPIA Identification. The information provided will be analysed to identify processing activities that are likely to result in a high risk to the rights and freedoms of natural persons and that therefore require a Data Protection Impact Assessment ("DPIA") to be conducted under Article 35 of the GDPR. The DPIA screening questions contained within Section 13 of this questionnaire will assist the DPO in making this determination.
3. International Transfer Mapping. Responses will support the identification of all international data transfers — including restricted transfers from the United Kingdom and transfers outside the European Economic Area ("EEA") — that require appropriate transfer mechanisms (such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement, or other safeguards) to be put in place.
4. Lawful Basis Documentation. The questionnaire will enable a structured assessment of the lawful basis relied upon for each processing activity, including the identification of processing activities that require a documented Legitimate Interest Assessment or that rely on consent as the lawful basis.
5. Processor and Sub-Processor Inventory. Responses will contribute to a comprehensive inventory of all third-party processors and sub-processors engaged across the NTP group, enabling a gap analysis of existing data processing agreements and contractual safeguards.
6. Data Subject Rights Readiness. The information captured will support NTP's ability to respond to data subject access requests, erasure requests, and other rights requests by providing a clear map of where personal data is held and how it is processed.
1.3 Scope
This questionnaire is applicable to all business units of the following NTP group entities:
• Northgate Telecommunications PLC (England and Wales) — all UK operations;
• Northgate Ireland Ltd (Ireland);
• Northgate GmbH (Germany);
• Northgate B.V. (Netherlands);
• Northgate France SAS (France); and
• Northgate Iberia S.L. (Spain).
The questionnaire covers all processing of personal data, whether such processing is carried out by automated means (including processing by electronic systems, software platforms, databases, and cloud-hosted applications) or by non-automated means forming part of a structured filing system (including paper files, physical records, and manual filing systems that are structured by reference to individuals or criteria relating to individuals).
The scope of this questionnaire encompasses the personal data of all categories of data subjects whose data is processed by NTP group entities, including but not limited to:
• Consumer subscribers (individual customers of NTP's telecommunications, broadband, and related services);
• Enterprise clients (business contacts, authorised representatives, and employees of corporate customers);
• Employees of NTP group entities;
• Contractors, temporary workers, and agency staff engaged by NTP group entities;
• Job applicants and recruitment candidates;
• Former employees and former contractors;
• Website visitors and users of NTP's online platforms, apps, and digital services;
• Suppliers, vendor contacts, and professional advisers; and
• Any other individuals whose personal data is processed by NTP in the course of its business operations.
No processing activity should be excluded on the basis that it is considered low-risk or involves only small volumes of data. Every processing activity involving personal data must be captured, regardless of its scale, frequency, or perceived sensitivity.
1.4 Instructions for Completion
The following instructions must be carefully observed when completing this questionnaire:
One questionnaire per processing activity. This questionnaire is to be completed on a per-processing-activity basis, not on a per-system or per-department basis. A "processing activity" is a discrete set of processing operations performed on personal data for a defined purpose or set of closely related purposes. For example, "employee payroll processing" is a distinct processing activity, as is "customer account management," "network fraud detection," or "recruitment and applicant tracking." A single business unit may conduct multiple processing activities and should therefore complete a separate copy of this questionnaire for each one. Where uncertainty exists as to whether a particular process constitutes a single processing activity or multiple processing activities, respondents should err on the side of granularity and consult the DPO or C&H for guidance.
Delineating processing activities. As a general rule, consider whether two processes serve the same overall purpose and involve the same categories of data subjects, data categories, recipients, and retention periods. If they do, they may be treated as a single processing activity. If any of these elements differ materially, they should be treated as separate processing activities. For example, "marketing to existing consumer subscribers by email" and "marketing to prospective customers via third-party data" are likely to be separate processing activities, even though both fall under the general heading of "marketing."
Nominated Business Unit Data Steward. Each business unit must identify a nominated Data Steward who will be responsible for completing and returning this questionnaire, and who will be accountable on an ongoing basis for the accuracy and currency of the processing activity record. The Data Steward should be a senior individual within the business unit who has sufficient knowledge of the processing activity to provide complete and accurate responses. In many cases, the Data Steward will need to consult with colleagues in IT, information security, HR, legal, or other functions to complete certain sections of the questionnaire.
Completion deadline. All completed questionnaires must be returned by the deadline specified by the DPO, Sanjay Mehta. The deadline for each business unit will be communicated separately. Timely completion is essential to ensure that the ROPA is built and available for regulatory inspection within the project timeline agreed with the NTP Board and the Chief Legal Officer.
Submission. Completed questionnaires should be returned by email to:
• Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC — sanjay.mehta@northgatetelecom.co.uk
with a copy to:
• Priscilla Wynn, Associate, Calderwood & Harkness LLP — p.wynn@calderwoodharkness.com
All questionnaires should be transmitted in accordance with NTP's internal information classification and handling procedures. Given the confidential nature of the information contained within the responses, questionnaires should be password-protected if transmitted by email, with the password communicated separately.
Queries. General queries regarding the questionnaire, the compliance program, or the interpretation of data protection requirements should be directed to Sanjay Mehta (DPO). Technical queries relating to data mapping, data flow diagramming, system identification, or the Sundial Solutions platform should be directed to Anita Chakravarti, Lead Privacy Engineer, Ashdown Consulting Group Ltd — a.chakravarti@ashdownconsulting.co.uk.
1.5 Definitions
For the purposes of this questionnaire, the following terms shall have the meanings set out below. These definitions are consistent with the UK GDPR, the EU GDPR, and the DPA 2018. Respondents should familiarise themselves with these definitions before completing the questionnaire.
"Personal Data" means any information relating to an identified or identifiable natural person (a "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. In the telecommunications context, personal data includes (without limitation) subscriber information, call records, communications metadata, location data, device identifiers, and IP addresses where they relate to an identified or identifiable individual.
"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.
"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
"Data Subject" means an identified or identifiable natural person whose personal data is processed.
"Lawful Basis" means one of the six grounds for processing personal data set out in Article 6(1) of the GDPR (consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests).
"Data Protection Impact Assessment (DPIA)" means an assessment of the impact of the envisaged processing operations on the protection of personal data, carried out in accordance with Article 35 of the GDPR, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons.
"Records of Processing Activities (ROPA)" means the records maintained by a controller or processor in accordance with Article 30 of the GDPR, documenting the processing activities under their responsibility.
"International Transfer / Restricted Transfer" means a transfer of personal data to a country or territory outside the United Kingdom (in the case of the UK GDPR) or outside the European Economic Area (in the case of the EU GDPR), subject to the restrictions and safeguard requirements set out in Chapter V of the GDPR.
"Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
"Anonymisation" means the irreversible process of altering personal data such that a natural person can no longer be identified, directly or indirectly, by any means reasonably likely to be used. Truly anonymised data falls outside the scope of the GDPR.
"Technical and Organisational Measures (TOMs)" means the technical and organisational measures implemented by the controller or processor to ensure a level of security appropriate to the risk of the processing, as required by Article 32 of the GDPR.
Section 2: Respondent Information
2.1 Business Unit Details
Please provide the following information about the business unit completing this questionnaire.
2.2 Respondent Contact Details
Please provide the contact details of the person completing this questionnaire.
2.3 Data Steward
Please identify the nominated Data Steward for this business unit and processing activity.
Guidance Note: The Data Steward is the individual who will be accountable for the accuracy and completeness of this questionnaire and for maintaining the processing activity record on an ongoing basis. The Data Steward must be a senior individual within the business unit with sufficient authority to ensure that the record is updated promptly whenever there is a material change to the processing activity (for example, a change in the categories of data processed, the introduction of a new processor, or a change to the retention period). The Data Steward will be the primary point of contact for the DPO and for C&H in relation to this processing activity record.
Section 3: Processing Activity Identification
3.1 Processing Activity Name
Guidance Note: Please provide a short, descriptive title that clearly identifies the processing activity. The title should be sufficiently specific to distinguish this activity from other processing activities within the same business unit. Examples of appropriate titles include: "Customer account management — consumer broadband," "Employee payroll processing — UK operations," "Network fraud detection and prevention," "Website analytics and cookie tracking," "Employee background screening — recruitment," "Enterprise client contract administration," or "CCTV monitoring — London headquarters."
3.2 Processing Activity Reference Number
Guidance Note: This field will be completed by the DPO or by the Ashdown Consulting team upon entry of the processing activity into the Sundial Solutions platform. Respondents should leave this field blank at the time of initial completion.
3.3 Description of Processing Activity
Provide a detailed description of the processing activity, including what is done with the personal data, the business process it supports, and the overall objective of the processing.
(Insert free-text description here. Please be as detailed as possible. Describe the end-to-end lifecycle of the data within this processing activity, including how data is collected, what it is used for, who interacts with it, and how it flows through systems and teams. Where possible, reference specific business processes, workflows, or operational procedures that the processing activity supports.)
3.4 Date Processing Commenced
3.5 Ongoing or One-Off Processing
Guidance Note: "Ongoing" means the processing activity is continuous or occurs as a regular and integral part of the business unit's operations (e.g., customer account management, employee records maintenance). "Periodic" means the processing activity occurs at regular or irregular intervals (e.g., annual employee performance reviews, quarterly customer satisfaction surveys). "One-Off" means the processing activity is a discrete, time-limited exercise (e.g., a one-time data migration project, a specific research study).
Section 4: Categories of Data Subjects
4.1 Data Subject Categories
Identify all categories of individuals whose personal data is processed in this activity. Select all that apply by marking the relevant categories below:
If "Other" selected, please specify:
(Insert description of other categories of data subjects)
4.2 Approximate Number of Data Subjects
Guidance Note: Consider the total number of data subjects across all jurisdictions in which this processing activity operates. If the personal data of UK data subjects and EU data subjects is processed together within the same activity, please provide a combined figure and, where possible, a breakdown by jurisdiction. This information is relevant to the assessment of whether the processing constitutes "large-scale processing" for the purposes of DPIA screening (see Section 13). Where the exact number is not known, provide your best reasonable estimate, indicating that it is an estimate.
4.3 Vulnerable Data Subjects
Guidance Note: The processing of personal data of vulnerable individuals is considered a factor that increases the risk associated with a processing activity and may trigger the requirement for a DPIA. "Vulnerable data subjects" includes children, elderly persons, patients, individuals with mental health conditions, asylum seekers, and employees (who may be considered vulnerable by virtue of the inherent power imbalance in the employment relationship). If this processing activity routinely involves data of any such group, please indicate "Yes" and provide details.
Section 5: Categories of Personal Data
5.1 Categories of Personal Data Processed
Identify all categories of personal data processed in this activity. Select all that apply by marking the relevant categories below:
If "Other" selected, please specify:
(Insert description of other categories of personal data)
5.2 Special Category Data (Article 9 GDPR)
If Yes, select all categories of special category data that apply:
Guidance Note: Where special category data is processed, a lawful basis under Article 6(1) alone is insufficient. An additional condition under Article 9(2) must also be identified and documented. Please refer to Appendix A for further guidance. Where the condition relied upon is a matter of domestic legislation (for example, Schedule 1 of the DPA 2018 in the UK context), please identify the specific paragraph of the relevant schedule or provision.
5.3 Criminal Conviction and Offence Data (Article 10 GDPR)
Guidance Note: Article 10 of the GDPR provides that processing of personal data relating to criminal convictions and offences, or related security measures, shall be carried out only under the control of official authority or when the processing is authorised by applicable law providing for appropriate safeguards. In the UK, Schedule 1, Part 1 and Part 2 of the DPA 2018 set out the conditions for processing criminal conviction and offence data. Common examples in the telecommunications context include employee criminal background checks (Disclosure and Barring Service checks) and processing carried out in connection with fraud prevention obligations.
5.4 Data Source
How is the personal data collected or obtained? Select all that apply:
Section 6: Purposes of Processing
6.1 Primary Purpose(s)
Describe the primary purpose(s) for which personal data is processed in this activity:
(Insert detailed description of the primary purpose(s))
Guidance Note: Please be specific and avoid generic or vague descriptions such as "business purposes," "operational needs," or "as required." The purpose should clearly describe why the processing is being carried out and what business objective it serves. Examples of appropriately specific purpose statements include:
• "To manage and administer consumer broadband service subscriptions, including provisioning, activation, billing, and fault resolution."
• "To conduct pre-employment background screening and criminal record checks for candidates applying for roles involving access to customer financial data."
• "To detect network anomalies and identify potential instances of fraud or unauthorised network access, in order to protect the security and integrity of NTP's telecommunications infrastructure."
• "To process monthly payroll for all UK-based employees, including calculation of statutory deductions, pension contributions, and benefits."
Where there are multiple primary purposes, each should be described separately with sufficient clarity to enable the identification of the applicable lawful basis for each purpose.
6.2 Secondary or Ancillary Purpose(s)
Guidance Note: Consider whether the personal data collected for the primary purpose described above is also used for any additional or ancillary purpose, such as business analytics, management reporting, customer profiling, product development, service improvement, marketing, research (including market research and internal statistical analysis), regulatory reporting, or any other purpose that is not the primary reason for which the data was originally collected. Where the data is reused for a secondary purpose, it is important to identify the lawful basis for that secondary use and to assess whether it is compatible with the original purpose of collection under Article 6(4) of the GDPR. If there are multiple secondary purposes, describe each one separately.
Section 7: Lawful Basis for Processing
7.1 Lawful Basis (Article 6(1) GDPR)
Select the primary lawful basis relied upon for this processing activity:
Guidance Note: Only one primary lawful basis should be selected per purpose. If different purposes identified in Section 6 rely on different lawful bases, please complete separate entries or clearly distinguish within the response below which lawful basis applies to which purpose. Please refer to Appendix A for detailed guidance on selecting the appropriate lawful basis, with practical examples relevant to a telecommunications and SaaS business context. It is important that the lawful basis is identified correctly at the outset, as the applicable basis affects the rights available to data subjects and the transparency information that must be provided.
7.2 Legitimate Interest — Details (if Article 6(1)(f) Selected)
Complete this section only if legitimate interest has been selected as the lawful basis in Section 7.1.
Guidance Note: Where legitimate interest is relied upon as the lawful basis, a documented Legitimate Interest Assessment must be conducted and retained as evidence of compliance with the accountability principle. The LIA must demonstrate that (i) the processing is necessary for the legitimate interest pursued, (ii) the legitimate interest is not overridden by the interests, rights, or freedoms of the data subjects, and (iii) the data subjects would reasonably expect the processing. A separate LIA template is available from Calderwood & Harkness LLP. All processing activities relying on legitimate interest as the lawful basis must have a completed and approved LIA on file before the processing may proceed. Please contact Priscilla Wynn at C&H to obtain the LIA template.
7.3 Consent — Details (if Article 6(1)(a) Selected)
Complete this section only if consent has been selected as the lawful basis in Section 7.1.
Guidance Note: For consent to be valid under the GDPR, it must be a freely given, specific, informed, and unambiguous indication of the data subject's wishes, given by a statement or by a clear affirmative action. Pre-ticked boxes, silence, or inactivity do not constitute valid consent. Where consent is relied upon, NTP must be able to demonstrate that consent was obtained and must provide a straightforward mechanism for data subjects to withdraw their consent at any time. Withdrawal of consent must be as easy as giving consent. Consider carefully whether consent is the most appropriate lawful basis; in the employment context, for example, consent is rarely appropriate due to the power imbalance between employer and employee.
7.4 Legal Obligation — Details (if Article 6(1)(c) Selected)
Complete this section only if compliance with a legal obligation has been selected as the lawful basis in Section 7.1.
7.5 Article 9(2) Condition (if Special Category Data Processed)
Complete this section only if special category data is processed (as identified in Section 5.2).
Section 8: Data Recipients and Sharing
8.1 Internal Recipients
8.2 External Recipients — Processors
If Yes, complete the following table for each processor:
Guidance Note: A "processor" is any external organisation that processes personal data on behalf of NTP (as controller). Common examples include cloud hosting providers, payroll service providers, outsourced customer service centres, email marketing platforms, IT support contractors, and data analytics providers. Article 28 of the GDPR requires that processing by a processor is governed by a binding written contract (a "Data Processing Agreement" or "DPA") containing prescribed mandatory terms. If no DPA is currently in place with a processor, please mark "No" or "In Progress" — this will be flagged for remediation by the DPO and C&H. Please add additional rows to the table if necessary.
8.3 External Recipients — Controllers / Joint Controllers
If Yes, complete the following table for each recipient:
Guidance Note: This section relates to situations where personal data is shared with an external third party that determines its own purposes and means of processing (an independent controller) or where NTP and the third party jointly determine the purposes and means of processing (joint controllers). Examples include sharing customer data with a credit reference agency (which processes the data for its own purposes), sharing employee data with pension fund trustees, or sharing data with a joint venture partner. Where joint controllership exists, Article 26 of the GDPR requires that the respective responsibilities of the joint controllers are determined by a transparent arrangement.
8.4 Sub-Processors
If Yes, list known sub-processors:
Guidance Note: Under Article 28(2) and (4) of the GDPR, processors must not engage sub-processors without the prior specific or general written authorisation of the controller. If you are aware that any processor listed in Section 8.2 engages sub-processors (for example, a cloud hosting provider that uses third-party data centre operators, or a payroll provider that engages a third-party benefits platform), please list the known sub-processors here. If you are unsure whether sub-processors are engaged, please indicate "Unknown" — this will be flagged for investigation by the DPO.
8.5 Regulatory / Public Authority Disclosures
Section 9: International Data Transfers
9.1 Transfer Outside the United Kingdom
If Yes, complete the following table for each transfer:
Guidance Note: A "restricted transfer" under the UK GDPR is a transfer of personal data from the United Kingdom to a country or territory outside the UK that is not subject to UK adequacy regulations (currently, the EU/EEA Member States are covered by the UK's adequacy regulations in respect of the EU GDPR, but this should be verified against the current list maintained by the Secretary of State). Please also consider transfers that may not be obvious, such as remote access to UK-held data by personnel located outside the UK, or the use of cloud services with data centres or support teams located in third countries. For further guidance, please refer to Appendix B.
9.2 Transfer Outside the European Economic Area
If Yes, complete the following table for each transfer:
Guidance Note: This section applies to the processing activities of NTP's EU subsidiary entities (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.). A "transfer" outside the EEA includes any disclosure, transmission, or making available of personal data to a recipient in a third country (i.e., a country outside the EEA). This includes transfers to the United Kingdom (which, following Brexit, is a third country in relation to the EU GDPR, although the UK currently benefits from an EU adequacy decision adopted on 28 June 2021, subject to its sunset clause). For further guidance on identifying international transfers, please refer to Appendix B.
9.3 Supplementary Measures
Guidance Note: Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18) and the subsequent guidance from the European Data Protection Board (EDPB Recommendations 01/2020), data exporters relying on Standard Contractual Clauses or equivalent transfer tools are required to assess whether the legislation or practices of the destination country impinge on the effectiveness of the safeguards and, where necessary, to put in place supplementary measures. Please flag all international transfers for review by Calderwood & Harkness LLP and the DPO, who will provide specific guidance on supplementary measure requirements.
Section 10: Data Retention
10.1 Retention Period
Guidance Note: Under Article 5(1)(e) of the GDPR (the "storage limitation" principle), personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The retention period should be justified by reference to a specific legal, regulatory, or operational requirement. Generic retention periods without clear justification will be queried by the DPO. If different categories of data within the same processing activity have different retention periods, please specify each separately.
10.2 Deletion / Anonymisation
10.3 Retention Exceptions
Section 11: Technical and Organisational Security Measures
11.1 Access Controls
11.2 Encryption
If Yes or Partially:
11.3 Pseudonymisation / Anonymisation
11.4 System and Infrastructure
11.5 Data Backup and Recovery
If Yes:
11.6 Other Security Measures
Describe any additional technical or organisational security measures relevant to this processing activity:
(Insert, e.g., "Annual penetration testing conducted by independent third-party security firm," "Quarterly vulnerability scanning of all internet-facing systems," "Mandatory annual data protection and information security training for all staff with access to personal data," "Data loss prevention (DLP) tools deployed on email gateways and endpoints," "Centralised logging and monitoring via SIEM platform (Fenmore Technologies) with real-time alerting for anomalous access patterns," "Physical security controls at data centre locations including biometric access, CCTV surveillance, and 24/7 manned security," "Clean desk policy enforced in all offices where personal data is processed in hard copy")
Section 12: Automated Decision-Making and Profiling
12.1 Automated Decision-Making
If Yes:
Guidance Note: Article 22(1) of the GDPR provides that data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Where such automated decision-making takes place, it must fall within one of the exceptions in Article 22(2), and appropriate safeguards must be in place. Please consider carefully whether any automated systems used in this processing activity make decisions that have a significant impact on individuals without meaningful human involvement.
12.2 Profiling
If Yes:
Guidance Note: "Profiling" is defined in Article 4(4) of the GDPR as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements. Profiling that does not result in solely automated decision-making with legal or similarly significant effects does not fall within Article 22, but it must still be disclosed to data subjects in the privacy notice and must have a valid lawful basis.
Section 13: Data Protection Impact Assessment (DPIA) Screening
13.1 DPIA Trigger Assessment
Based on the information provided in this questionnaire, does this processing activity meet any of the following DPIA trigger criteria? Select all that apply:
Guidance Note: Article 35(1) of the GDPR requires that a DPIA be carried out where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. The trigger criteria listed above are derived from Article 35(3) of the GDPR, the ICO's list of processing operations requiring a DPIA, and the EDPB Guidelines on DPIAs (WP 248 rev.01). As a general rule, if two or more of the criteria listed above are met, a DPIA is very likely to be required. Even if only one criterion is met, a DPIA may still be necessary depending on the nature and context of the processing. The DPO will make the final determination as to whether a DPIA is required.
13.2 Existing DPIA
13.3 DPIA Required
This section is for DPO use only.
Section 14: Data Subject Rights
14.1 Rights Facilitation
How does the business unit facilitate the exercise of data subject rights in relation to this processing activity? Please describe the procedures, systems, and points of contact for handling each of the following rights:
Guidance Note: NTP is required under Articles 15–22 of the GDPR to facilitate the exercise of data subject rights without undue delay and in any event within one month of receipt of the request (subject to the possibility of a two-month extension in complex cases). Each business unit should be able to describe how it would locate, retrieve, rectify, erase, restrict, or export the personal data held within this processing activity in response to a valid data subject rights request. Where the processing activity involves automated decision-making, the business unit should describe how it provides for meaningful human review of decisions.
14.2 Exemptions
Section 15: Privacy Notices
15.1 Transparency Information
If Yes:
If No: