1022-00007 · Northgate Telecommunications PLC · Assessment & Gap Analysis

gdpr-gap-analysis-report.docx DOCUMENT Finance & Banking

2 / 39 ← → ✕

Contract analysis Extract to table

GDPR / UK GDPR COMPLIANCE GAP ANALYSIS REPORT

Prepared for Northgate Telecommunications PLC

Document Reference: SC/NTP/2023-0213/PDS — Phase 1 Deliverable

PRIVILEGED & CONFIDENTIAL Attorney-Client Privilege / Litigation Privilege

Date of Delivery: 31 March 2023

Prepared by:

Sara Hendricks Lead Associate, Privacy & Data Security Calderwood & Harkness LLP

Priscilla Wynn Associate, Privacy & Data Security Calderwood & Harkness LLP

Supervised by:

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP

With contributions from:

Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP (International transfers sections)

Technical Data Mapping Support Provided by:

Ashdown Consulting Group Ltd Robert Fairclough, Managing Director Anita Chakravarti, Lead Privacy Engineer

Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN United Kingdom

This report has been prepared by Calderwood & Harkness LLP for the sole use of Northgate Telecommunications PLC and its Board of Directors, Audit & Risk Committee, and authorised internal recipients. This document is subject to attorney-client privilege and litigation privilege. It must not be disclosed, copied, or distributed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC. Disclosure to any third party may constitute a waiver of privilege.

1. Executive Summary

1.1 Purpose and Scope of this Report

This report presents the findings of a comprehensive gap analysis of Northgate Telecommunications PLC's ("NTP" or the "Company") compliance posture against the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR") and the UK General Data Protection Regulation (as retained under the European Union (Withdrawal) Act 2018 and supplemented by the Data Protection Act 2018) (the "UK GDPR", and together with the EU GDPR, the "GDPR").

This engagement was commissioned under engagement reference SC/NTP/2023-0213/PDS, pursuant to the engagement letter dated 13 February 2023, executed between Northgate Telecommunications PLC (acting by Fiona Gallagher, General Counsel) and Calderwood & Harkness LLP (acting by Kevin Ostrowski, Partner, Privacy & Data Security). The engagement letter establishes this report as the Phase 1 deliverable under a five-phase GDPR compliance programme build, the overall scope and objectives of which are described in the engagement letter and summarised in Section 7 (Remediation Roadmap) of this report.

The scope of this assessment encompasses all UK and EU operations of NTP and its subsidiaries, specifically:

(a) Northgate Telecommunications PLC (United Kingdom);

(b) Northgate Ireland Ltd (Ireland);

(d) Northgate B.V. (Netherlands);

(e) Northgate France SAS (France); and

(f) Northgate Iberia S.L. (Spain).

The assessment period covered 20 February 2023 to 31 March 2023. During this period, Calderwood & Harkness LLP, with technical support from Ashdown Consulting Group Ltd, conducted an extensive review of NTP's data processing activities, policies, procedures, technical infrastructure, contractual arrangements, and governance structures. The findings presented in this report are based upon the information gathered during this assessment period and are current as of the date of delivery.

This report is intended to provide NTP's Board of Directors, Audit & Risk Committee, General Counsel, and DPO with a clear and actionable assessment of the Company's current GDPR compliance posture, the nature and severity of identified gaps, and a prioritised roadmap for remediation. It should be read in conjunction with the engagement letter and the detailed appendices attached hereto.

1.2 Overall Compliance Assessment

Calderwood & Harkness LLP has assessed NTP's compliance posture across thirteen core GDPR compliance domains, utilising a five-level maturity scale as follows:

• Non-existent: No controls, processes, or documentation in place.

• Ad Hoc: Some controls or processes exist but are informal, reactive, and inconsistent.

• Developing: Controls and processes are being developed or partially implemented but are not yet comprehensive or consistently applied.

• Defined: Controls and processes are documented, approved, and consistently applied across the organisation.

• Optimised: Controls and processes are fully embedded, continuously monitored, regularly reviewed, and improved based on lessons learned and best practices.

Overall Assessment: NTP has foundational elements of a GDPR compliance programme in place. The Company has appointed a qualified Data Protection Officer, maintains a basic cybersecurity framework with ISO 27001 certification for key data centres, has some data processing agreements with major processors, and has implemented general data protection awareness training. These elements provide a baseline upon which a comprehensive compliance programme can be built.

However, significant gaps exist in six core areas that present material compliance risk and require urgent remediation:

1. Records of Processing Activities (ROPA): The existing ROPA is incomplete, covering only approximately 40 of 147 identified processing activities, and lacks mandatory fields required by Article 30.

2. Data Protection Impact Assessments (DPIAs): At least 11 processing activities require full DPIAs that have not been conducted, including activities involving automated decision-making, biometric processing, and large-scale profiling.

3. International Data Transfer Mechanisms: All transfers to the United States are currently without a valid transfer mechanism following the expiry of the old-format Standard Contractual Clauses on 27 December 2022. No Transfer Impact Assessments have been conducted. This is the subject of an active regulatory inquiry by the Irish Data Protection Commission.

4. Data Subject Rights Procedures: No formalised procedure exists for handling data subject rights requests. Approximately 15% of DSARs in 2022 were not responded to within the statutory deadline.

5. Breach Notification Processes: The existing incident response procedure does not adequately address GDPR-specific breach notification obligations. Two of three personal data breaches in 2022 were reported to the ICO outside the 72-hour window.

6. Governance and Accountability Structures: The DPO function is under-resourced, legitimate interest assessments have not been documented, and privacy-by-design processes are not formalised.

The urgency of these findings is heightened by two active regulatory proceedings. The ICO Enforcement Notice ENF/2021/0934, issued in September 2021, resulted in a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal. While remediation was completed in March 2022, any future enforcement action will be assessed by the ICO in the context of this prior non-compliance, with a heightened expectation for a robust compliance framework. More critically, the DPC (Ireland) preliminary inquiry IN-22-11-3, opened in November 2022, concerns cross-border data transfers from Northgate Ireland Ltd to US-based processors in the post-Schrems II landscape, and is directly targeted at the most serious compliance gap identified in this report.

The Board Audit & Risk Committee resolution of 8 December 2022 mandated a comprehensive GDPR compliance programme build by Q3 2023. This engagement is designed to fulfil that mandate, and the five-phase remediation roadmap set out in Section 7 of this report is structured to achieve substantial compliance by September 2023.

1.3 Key Findings at a Glance

The following table summarises the key findings across each compliance domain assessed:

Table 1: Key Findings at a Glance — Summary by Compliance Domain

The two CRITICAL gaps — international data transfer mechanisms and DPIA coverage for certain high-risk processing activities — demand the most urgent attention and carry the greatest regulatory risk exposure. The international transfers gap is of particular concern given the active DPC inquiry and the potential for administrative fines under Article 83 of the EU GDPR of up to €20 million or 4% of annual global turnover (whichever is higher). For NTP, 4% of the FY 2022 revenue of £2.47 billion would amount to approximately £98.8 million, representing a material financial risk to the Company.

1.4 Recommendations Summary

Calderwood & Harkness LLP recommends that NTP proceed with the following remediation programme, structured across Phases 2 through 5 of the engagement:

Phase 2 — ROPA & Data Mapping (April–May 2023): Build a comprehensive ROPA covering all 147 identified processing activities across UK and EU operations. Complete Legitimate Interest Assessment templates and conduct balancing tests for all 64 legitimate-interest-basis activities. Integrate the ROPA into the Sundial Solutions platform with Ashdown Consulting's support. Target delivery of ROPA v1.0 by 19 May 2023.

Phase 3 — DPIAs (May–July 2023): Conduct full DPIAs for all 11 identified high-risk processing activities (DPIA-001 through DPIA-011). Establish an ongoing DPIA screening process and privacy-by-design review framework. Present DPIA outcomes and high-risk findings to the Board Audit & Risk Committee. Target completion of all DPIAs by early July 2023.

Phase 4 — Transfer Mechanisms (July–August 2023): Implement compliant international data transfer mechanisms for all identified third-country transfers, including execution of new EU SCCs and UK IDTAs, completion of Transfer Impact Assessments, amendment of processor agreements, and implementation of supplementary technical, contractual, and organisational measures. Develop an Internal International Transfers Policy. Target completion of all TIAs by early August 2023. Work on transfer mechanisms should commence in parallel with earlier phases where possible, given the urgency of the DPC inquiry.

Phase 5 — Policies, Governance & Training (August–September 2023): Develop and implement a comprehensive policy suite, including Group Data Protection Policy, Data Subject Rights Procedure, Data Breach Notification Procedure, updated Data Retention Schedule, and revised privacy notices. Deliver Board-level GDPR training. Target delivery of the final policy suite by 1 September 2023.

Immediate Priority: The remediation of international data transfer mechanisms should be treated as the highest priority, given the active DPC inquiry IN-22-11-3. Calderwood & Harkness LLP recommends that preliminary work on transfer mechanisms — including the negotiation of new SCCs with Caldwell Analytics and the amendment of the Pinnacle DPA — should commence during Phase 2 and be advanced in parallel with ROPA development, to ensure that a comprehensive response to the DPC inquiry can be submitted upon completion of the transfer mechanism work.

2. Methodology

2.1 Approach and Framework

The gap analysis was conducted by measuring NTP's current compliance posture against the full requirements of the EU GDPR and UK GDPR. The assessment framework was structured around the core obligations imposed by the GDPR, with particular attention to the following provisions:

• Article 5 — Principles relating to processing of personal data (lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability);

• Article 6 — Lawfulness of processing, including the identification and documentation of lawful bases;

• Article 9 — Processing of special categories of personal data, including the identification of Article 9(2) conditions;

• Articles 12–22 — Data subject rights, including transparent communication (Art. 12), information to be provided (Arts. 13–14), right of access (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction (Art. 18), notification obligation regarding rectification, erasure, or restriction (Art. 19), right to data portability (Art. 20), right to object (Art. 21), and automated individual decision-making including profiling (Art. 22);

• Articles 24–25 — Responsibility of the controller (Art. 24) and data protection by design and by default (Art. 25);

• Article 28 — Processor obligations and contractual requirements;

• Article 30 — Records of processing activities;

• Article 32 — Security of processing;

• Articles 33–34 — Notification of personal data breaches to the supervisory authority (Art. 33) and communication to data subjects (Art. 34);

• Articles 35–36 — Data protection impact assessments (Art. 35) and prior consultation (Art. 36);

• Articles 44–49 — Transfers of personal data to third countries or international organisations, including adequacy decisions (Art. 45), appropriate safeguards (Art. 46), standard contractual clauses (Art. 46(2)(c)), and derogations (Art. 49); and

• Articles 37–39 — Data Protection Officer designation, position, and tasks.

In addition to the core GDPR provisions, the assessment incorporated guidance and regulatory expectations from the following sources:

• Information Commissioner's Office (ICO) published guidance, enforcement approach, and codes of practice, including the ICO's Age Appropriate Design Code, Direct Marketing Code, and guidance on international transfers;

• European Data Protection Board (EDPB) guidelines, including Guidelines 2/2018 on derogations of Article 49, Recommendations 01/2020 on supplementary measures for international transfers, Guidelines 03/2022 on deceptive design patterns, and Guidelines on Data Protection Impact Assessments (wp248rev.01);

• Sector-specific requirements relevant to telecommunications operators, including obligations arising from the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) in the UK and the ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) in the EU, to the extent that they intersect with GDPR obligations (particularly with respect to electronic marketing, cookies, and communications metadata);

• The Investigatory Powers Act 2016 and associated data retention obligations imposed on telecommunications operators in the UK; and

• The UK Data Protection and Digital Information Bill (as introduced in the House of Commons on 8 March 2023), which was assessed for potential future impacts on NTP's compliance framework in the event of UK-EU regulatory divergence.

The maturity assessment was conducted using the five-level scale described in Section 1.2 (Non-existent, Ad Hoc, Developing, Defined, Optimised), applied consistently across all thirteen compliance domains. Gap severity was assessed on a four-level scale (Critical, High, Medium, Low) based on the likelihood and potential impact of regulatory enforcement, the nature of the non-compliance, the volume and sensitivity of personal data affected, and the vulnerability of the data subjects concerned.

2.2 Information Gathering

Information was gathered through four principal workstreams during the assessment period (20 February 2023 to 31 March 2023):

Data Mapping Questionnaires. Standardised data mapping questionnaires were designed by Priscilla Wynn and distributed to all NTP business units on 1 March 2023. The questionnaires were structured to capture comprehensive information about each processing activity, including: processing activity name and description; business unit; data controller entity; categories of data subjects; categories of personal data; special category data flags; purpose(s) of processing; lawful basis (with sub-basis for special category data); source of personal data; recipients of personal data (internal and external); international transfers (destination country, transfer mechanism, safeguards); retention period; deletion or anonymisation method; and technical and organisational security measures applied. Completed questionnaires were received from 23 business units across all six NTP entities between 8 March and 22 March 2023. A template of the questionnaire is included at Appendix A.

Stakeholder Interviews. Structured interviews were conducted with the following key NTP personnel during the period 6–17 March 2023:

• Fiona Gallagher, General Counsel — governance structure, Board mandate, regulatory history, legal risk assessment, privilege considerations (interviewed 6 March 2023);

• Sanjay Mehta, Data Protection Officer — ROPA status, DSAR handling processes, DPO resourcing and independence, DPC inquiry correspondence and timeline, training programme, overall compliance posture (interviewed 7 March 2023);

• Thomas Okoye, Chief Information Security Officer — security measures, incident response procedures, breach history and notification experience, encryption and pseudonymisation practices, ISO 27001 certification, network architecture (interviewed 9 March 2023);

• Laura Dearden, VP Product & Engineering (NorthCloud) — NorthCloud platform processing activities, AI-driven models (churn prediction, fraud detection), product development lifecycle, privacy-by-design practices, IoT platform operations (interviewed 10 March 2023);

• Philippa Crane, Head of People & HR — employee data processing activities, NorthPulse wellbeing monitoring platform, HR analytics, biometric access controls, expatriate payroll, trade union data, recruitment processing (interviewed 14 March 2023); and

• Marcus Engström, Head of EU Operations — EU subsidiary operations, local compliance practices, Frankfurt and Amsterdam data centre operations, Dublin operational headquarters, cross-border data flows within NTP group, local regulatory requirements (interviewed 17 March 2023).

A detailed log of the interviews, including dates, topics covered, and key findings, is included at Appendix B.

Documentation Review. Calderwood & Harkness LLP conducted a comprehensive review of existing NTP documentation, including but not limited to: customer-facing and employee privacy notices; the NorthCloud platform Terms of Service and Privacy Policy; data processing agreements with Caldwell Analytics Inc., Pinnacle Cloud Services Ltd, Sunderland-Hayes Payroll Services Inc., and Moritaka Systems K.K.; contract templates used for processor engagements; existing ROPA fragments maintained by Sanjay Mehta; information security policies (including ISO 27001 documentation); HR policies relating to employee monitoring, health data, and biometric access; marketing consent records and consent management platform configurations; and internal policy documentation relating to data retention.

Technical Data Flow Analysis. Ashdown Consulting Group Ltd, under the direction of Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer), performed a technical data flow analysis using the Sundial Solutions platform. This analysis was supplemented by system inventories provided by Thomas Okoye's cybersecurity team, network architecture reviews, and data centre infrastructure mapping across the London, Frankfurt, Amsterdam, and Dublin facilities. The technical analysis identified data flows between NTP entities, processors, and sub-processors, and confirmed the jurisdictions in which personal data is stored and processed. The outputs of this technical analysis form the basis of the Processing Activities Inventory Summary at Appendix C.

Review of Regulatory Correspondence. Calderwood & Harkness LLP reviewed all correspondence relating to the ICO Enforcement Notice ENF/2021/0934, including the original notice, the decision letter, NTP's representations, the penalty notice, and the remediation confirmation. Calderwood & Harkness LLP also reviewed all correspondence relating to the DPC preliminary inquiry IN-22-11-3, including the initial inquiry letter, NTP's preliminary acknowledgement, and subsequent correspondence. A summary of this regulatory correspondence is included at Appendix E.

2.3 Scope Boundaries

In Scope. The assessment covered all personal data processing activities conducted by or on behalf of the following entities:

(a) Northgate Telecommunications PLC (United Kingdom);

(b) Northgate Ireland Ltd (Ireland);

(d) Northgate B.V. (Netherlands);

(e) Northgate France SAS (France); and

(f) Northgate Iberia S.L. (Spain).

The data processing activities assessed encompass all categories of data subjects whose personal data is processed by the above entities. The approximate scale of data subjects affected is as follows:

• Consumer subscribers: approximately 6.3 million individuals;

• Enterprise clients (business contacts): approximately 42,000 individuals;

• Employees: approximately 11,400 globally, of whom approximately 8,200 are based in the UK and EU;

• Contractors, temporary workers, job applicants, and website visitors: approximately 28,000 individuals; and

• Total: approximately 6.38 million data subjects.

The assessment also covered NTP's relationships with its key data processors, to the extent necessary to assess NTP's compliance with its controller obligations under Article 28 and Articles 44–49. The processors assessed include:

• Caldwell Analytics Inc. (San Jose, California, USA) — AI-driven network analytics and predictive maintenance;

• Pinnacle Cloud Services Ltd (London, UK) — cloud infrastructure (IaaS/PaaS) hosting for NorthCloud and internal systems, including sub-processors Pinnacle India Pvt Ltd (Gurugram, India) and Pinnacle APAC Pte Ltd (Singapore);

• Sunderland-Hayes Payroll Services Inc. (New York, USA) — expatriate payroll processing; and

• Moritaka Systems K.K. (Tokyo, Japan) — IoT analytics for connected-vehicle telemetry.

Out of Scope. The following matters are outside the scope of this assessment:

• Non-EU/EEA operations of NTP or any affiliate outside the territorial scope of the EU GDPR (Article 3) and UK GDPR;

• Compliance with telecommunications-specific regulation (e.g., Ofcom regulatory requirements, electronic communications licensing conditions) except where such regulation intersects with data protection obligations (e.g., PECR/ePrivacy obligations regarding cookies and electronic marketing, and IPA 2016 data retention obligations);

• Compliance with competition law, consumer protection law, or employment law, except where directly relevant to data protection compliance; and

• Detailed technical security audit or penetration testing — technical security was assessed at a compliance level in relation to Article 32 and supplementary measures for international transfers, relying on the outputs provided by Thomas Okoye's team and Ashdown Consulting Group Ltd.

2.4 Limitations

The findings and recommendations in this report are subject to the following limitations, which should be borne in mind when considering the conclusions reached:

The findings are based on information provided by NTP and its personnel during the assessment period. Calderwood & Harkness LLP has not independently verified all factual representations made by NTP personnel or contained in NTP documentation. Where discrepancies or ambiguities were identified, these have been noted in the relevant findings sections, and further investigation may be required during subsequent phases of the engagement.

Technical assessments, including data mapping, data flow analysis, system inventories, and network architecture reviews, were performed by Ashdown Consulting Group Ltd under the direction of Robert Fairclough and Anita Chakravarti. Calderwood & Harkness LLP has relied on the technical outputs and conclusions provided by Ashdown Consulting and has not independently audited or verified the technical analysis. The scope and limitations of Ashdown Consulting's work are set out in their separate letter of engagement with NTP dated 20 February 2023.

This report does not constitute a formal legal audit. It is a compliance gap assessment designed to identify areas of non-compliance or risk and to inform the development of a prioritised remediation plan. The findings represent Calderwood & Harkness LLP's professional assessment based on the information available as of the date of delivery, and should not be treated as a guarantee or certification of compliance or non-compliance with any particular provision of the GDPR or UK GDPR.

The regulatory landscape is subject to change. In particular, the UK Data Protection and Digital Information Bill, if enacted in its current or amended form, may alter certain UK GDPR requirements. The EU-US Data Privacy Framework, announced in principle but not yet formally adopted by EU Commission adequacy decision as of the date of this report, may affect the analysis of transfers to the United States. NTP should monitor these developments and seek updated advice as they progress.

3. Client Overview

3.1 Corporate Structure

Northgate Telecommunications PLC is a public limited company incorporated in England and Wales under Company Number 04837291. The Company's registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office is at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom.

NTP reported consolidated group revenue of £2.47 billion for the financial year ending 31 December 2022. The Company's shares are listed on the London Stock Exchange (LSE: NTP).

NTP's business operations encompass the following principal lines of business:

• Fixed-line and mobile telecommunications services: NTP provides residential and business fixed-line broadband, mobile telephony, and bundled telecommunications services across the United Kingdom. NTP holds an Ofcom general authorisation for the provision of electronic communications networks and services.

• NorthCloud unified communications SaaS platform: NTP operates NorthCloud, a cloud-based unified communications-as-a-service (UCaaS) platform offering voice, video conferencing, messaging, file sharing, and collaboration tools. NorthCloud is marketed on a B2B basis to enterprise clients across 14 EU/EEA member states. The platform is hosted across NTP's data centres in London, Frankfurt, Amsterdam, and Dublin.

• Managed network services: NTP provides managed wide-area network (WAN), software-defined networking (SD-WAN), and network security services to enterprise clients in the UK and selected EU markets.

• IoT connectivity platform: NTP operates an Internet of Things (IoT) connectivity platform providing SIM-based and eSIM-based cellular connectivity for IoT devices across sectors including automotive (connected-vehicle telemetry), logistics, smart cities, and industrial automation.

NTP operates data centres in four locations: London (UK), Frankfurt (Germany), Amsterdam (Netherlands), and Dublin (Ireland). These data centres are operated by NTP directly (London and Dublin) or in partnership with Pinnacle Cloud Services Ltd (Frankfurt, Amsterdam, and Stockholm — the latter used only for network redundancy and does not currently host personal data).

NTP's ICO Registration Number is ZA482917, with registration maintained and reviewed annually by the DPO.

3.2 EU Subsidiary Structure

NTP conducts its EU operations through five wholly-owned subsidiaries, each of which constitutes a data controller in its own right for certain locally managed processing activities, and acts as a joint or co-controller with NTP PLC for certain group-wide processing activities. The subsidiaries are structured as follows:

Northgate Ireland Ltd is a private limited company registered in Ireland at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland (CRO Number 587214). Northgate Ireland has approximately 340 staff and serves as NTP's EU operational headquarters. Critically, Northgate Ireland hosts the NorthCloud EU customer data within the Dublin data centre and is the entity through which NTP's EU customer-facing operations are conducted. As the entity with decision-making authority over the means and purposes of NTP's EU data processing, Northgate Ireland is NTP's main establishment in the EU for the purposes of Article 56 of the EU GDPR. The lead EU supervisory authority is therefore the Data Protection Commission (DPC) of Ireland. Northgate Ireland is the entity subject to the active DPC preliminary inquiry IN-22-11-3.

Northgate GmbH is a private limited company registered in Germany at Friedrichstraße 91, 10117 Berlin (HRB 214503 B, Amtsgericht Charlottenburg). Northgate GmbH has approximately 185 staff and is responsible for sales operations in the DACH region, engineering support, and the operation of the Frankfurt data centre. Germany's robust data protection enforcement environment, including the active oversight of both the federal Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the relevant state-level supervisory authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit), means that compliance for this entity requires particular attention to German-specific requirements.

Northgate B.V. is a private limited company registered in the Netherlands at Herikerbergweg 44, 1101 CM Amsterdam (KvK 72841936). Northgate B.V. has approximately 120 staff and is responsible for the Amsterdam data centre and network operations centre (NOC). The NOC monitors network performance across all NTP EU data centres and is a significant nexus for cross-border data flows within the NTP group.

Northgate France SAS is a simplified joint-stock company registered in France at 27 Rue de Berri, 75008 Paris (SIREN 891 247 503). Northgate France has approximately 95 staff and is responsible for sales operations and French-language customer support for NorthCloud and managed services clients in France and francophone markets.

Northgate Iberia S.L. is a private limited company registered in Spain at Calle de Serrano 41, 28001 Madrid (CIF B-91847263). Northgate Iberia has approximately 70 staff and is responsible for sales and managed services delivery in Spain and Portugal.

3.3 Data Processing Landscape

The data mapping exercise conducted during the assessment period identified a total of 147 processing activities across the NTP group. These activities are distributed by jurisdiction as follows:

Table 2: Processing Activities by Jurisdiction

The processing activities affect the following categories of data subjects:

• Consumer subscribers: Approximately 6.3 million individuals using NTP's residential broadband, mobile, and bundled telecommunications services. Personal data processed includes name, address, contact details, date of birth, account information, billing data, payment card data, subscriber metadata (call detail records, session data, location data), device identifiers (IMSI, IMEI, MAC address), and service usage data.

• Enterprise clients: Approximately 42,000 individuals representing business contacts associated with NTP's enterprise clients. Personal data processed includes name, job title, business contact details, company information, contractual and billing data, and NorthCloud platform usage data.

• Employees: Approximately 11,400 employees globally, of whom approximately 8,200 are based in the UK and EU. Personal data processed includes HR records, payroll data, performance reviews, health and absence data, trade union membership, biometric access control data, wellbeing platform data (NorthPulse), and cross-border workforce analytics data.

• Contractors, temporary workers, job applicants, and website visitors: Approximately 28,000 individuals. Personal data processed includes recruitment data, contractor engagement records, website analytics data, and cookie/tracking data.

Special category data processing was identified in 14 processing activities, involving the following categories of special category personal data:

• Employee health data (occupational health records, sickness absence records, disability accommodation data);

• Trade union membership data (payroll deductions, staff representative records); and

• Biometric data (fingerprint and facial recognition data used for physical access control at data centres and the London headquarters).

The key data flows identified include subscriber metadata and communications data, location data and device identifiers, call detail records, network performance and telemetry data, employee HR and payroll data, customer billing and account data, and marketing and profiling data used for targeted advertising and customer retention activities on the NorthCloud platform.

A detailed summary of all 147 processing activities, grouped by business unit and jurisdiction, is set out at Appendix C.

3.4 Key Third-Party Processors

The assessment identified four key third-party processors whose relationships with NTP present the most significant data protection compliance considerations. Each is described below, together with a summary of the current contractual and compliance position:

Caldwell Analytics Inc. (2700 Technology Drive, Suite 400, San Jose, CA 95134, USA). Caldwell provides AI-driven network analytics and predictive maintenance services to NTP, processing pseudonymised subscriber analytics data, network performance data, and device telemetry to generate network optimisation recommendations and predictive maintenance alerts. The relationship is governed by a Master Services Agreement dated 1 June 2021, which incorporates a data processing addendum. Caldwell is a US-based processor without the benefit of an EU or UK adequacy decision. As discussed in detail in Section 5.3, the data processing addendum references the old-format (2010) EU Standard Contractual Clauses, which expired on 27 December 2022. The Caldwell relationship is at the centre of the DPC inquiry IN-22-11-3.

Pinnacle Cloud Services Ltd (Apex House, 24 Victoria Embankment, London EC4Y 0DZ, UK; Company Number 09142837). Pinnacle provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the NorthCloud platform and NTP's internal IT systems. Pinnacle operates data centres in London, Frankfurt, Amsterdam, Dublin, and Stockholm, and is NTP's primary cloud infrastructure provider. The relationship is governed by a data processing agreement incorporated into the services agreement. Critically, Pinnacle engages two sub-processors located in third countries without adequacy decisions: Pinnacle India Pvt Ltd (Plot No. 42, Cyber City, Sector 24, Gurugram, Haryana 122002, India; CIN U72200HR2016PTC065412), which provides Tier 2 and Tier 3 technical support with potential access to personal data in production environments; and Pinnacle APAC Pte Ltd (1 Raffles Place, #44-02 One Raffles Place Tower 2, Singapore 048616; UEN 201824567K), which provides network monitoring and incident response services covering the APAC time zone. Neither sub-processor is subject to a direct DPA with NTP, and no processor-to-sub-processor Standard Contractual Clauses (Module 3) are in place.

Sunderland-Hayes Payroll Services Inc. (1400 Broadway, Suite 2200, New York, NY 10018, USA). Sunderland-Hayes provides cross-border payroll processing services for approximately 45 NTP expatriate employees based in the United States. The relationship is governed by a payroll services agreement that contains embedded data protection terms, but does not include a standalone data processing agreement that meets the requirements of Article 28(3). As a US-based processor, the same transfer mechanism deficiencies identified for Caldwell Analytics apply to the Sunderland-Hayes relationship.

Moritaka Systems K.K. (Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan). Moritaka provides IoT analytics services for NTP's connected-vehicle telemetry platform, processing data from approximately 12,000 device endpoints. The relationship is governed by an analytics services agreement that characterises Moritaka as a data processor. However, as discussed in Section 5.7, the nature of the processing arrangement — which involves joint development of analytics algorithms, joint determination of the purposes and means of certain analyses, and Moritaka's independent use of aggregated outputs — raises significant questions about whether the relationship is more properly characterised as a joint controllership under Article 26 of the GDPR. Japan benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2019/419 of 23 January 2019), but this does not address potential gaps that may arise depending on the precise characterisation of the controller-processor relationship and the scope of supplementary measures required.

A comprehensive register of all identified processors and sub-processors, including their current DPA status, jurisdiction, and identified gaps, is included at Appendix D.

4. Regulatory Risk Context

4.1 ICO Enforcement History

On 15 September 2021, the Information Commissioner's Office issued Enforcement Notice reference ENF/2021/0934 against Northgate Telecommunications PLC.

The subject matter of the enforcement action concerned NTP's use of direct marketing cookies on the NorthCloud customer portal. The ICO's investigation found that NTP had deployed analytics and advertising cookies on the NorthCloud portal without obtaining valid, freely given, specific, informed, and unambiguous consent from users, in contravention of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the related transparency requirements of Articles 5(1)(a), 13, and 14 of the UK GDPR. Specifically, the ICO found that:

(a) The NorthCloud cookie consent mechanism used pre-ticked checkboxes for non-essential cookies, which do not constitute valid consent under PECR or the UK GDPR (consistent with the CJEU's ruling in Planet49, Case C-673/17);

(b) The cookie notice did not provide adequate information about the purposes of each category of cookie, the recipients of data collected through cookies, or the retention periods for cookies;

(c) Certain analytics cookies were set prior to the user interacting with the consent mechanism, constituting processing without a lawful basis; and

(d) The consent mechanism did not provide a genuinely free choice to refuse non-essential cookies, as the "Reject All" option was less prominently displayed than the "Accept All" option.

The ICO imposed a monetary penalty of £320,000, which was paid by NTP. The Enforcement Notice required NTP to implement a PECR-compliant cookie consent mechanism on the NorthCloud portal by a specified deadline.

NTP completed the required remediation in March 2022, implementing a new cookie consent mechanism using the Bramwell SystemsokiePro platform. Calderwood & Harkness LLP has reviewed the remediated cookie consent mechanism and notes that it appears to comply with the ICO's requirements, though ongoing monitoring is recommended to ensure continued compliance (see Section 5.9).

The significance of this enforcement history for the present assessment is threefold. First, it demonstrates that NTP is subject to active regulatory scrutiny by the ICO and that the ICO is aware of NTP as an organisation with data protection compliance issues. Second, any future enforcement action by the ICO will be assessed in the context of this prior non-compliance; the ICO's Regulatory Action Policy provides that enforcement history is a relevant factor in determining the nature and level of any regulatory response. Third, the underlying issues identified in the enforcement action — inadequate consent mechanisms and insufficient transparency — are symptomatic of the broader compliance gaps identified in this report, including the absence of systematic privacy-by-design processes and the informal nature of compliance governance.

4.2 DPC (Ireland) Preliminary Inquiry

The Data Protection Commission of Ireland (DPC) opened a preliminary inquiry under reference IN-22-11-3 in November 2022, directed at Northgate Ireland Ltd.

The inquiry concerns cross-border data transfers from Northgate Ireland Ltd to US-based processors, with particular focus on the adequacy of transfer mechanisms in the aftermath of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II"). The Schrems II judgment invalidated the EU-US Privacy Shield framework and, while confirming the validity of Standard Contractual Clauses as a transfer mechanism in principle, established that data exporters must assess on a case-by-case basis whether the laws and practices of the destination country ensure an adequate level of protection, and must implement supplementary measures where necessary to bring the level of protection up to the EU standard.

The DPC inquiry is understood to have been triggered by a complaint from a Northgate Ireland customer who exercised their right of access under Article 15 and discovered that their data was being transferred to Caldwell Analytics Inc. in the United States. The complainant raised concerns about the absence of adequate transfer safeguards in light of the Schrems II judgment.

At the time of this report, the inquiry is active. NTP has acknowledged receipt of the DPC's inquiry letter and provided a preliminary response, but has not yet submitted a comprehensive response addressing the adequacy of its transfer mechanisms, transfer impact assessments, or supplementary measures. The DPC has indicated that it expects a substantive response within a reasonable timeframe, and failure to provide such a response may result in the initiation of formal enforcement proceedings.

The regulatory risk associated with this inquiry is severe. Under Article 83(5)(c) of the EU GDPR, infringements of the provisions on transfers of personal data to third countries (Articles 44–49) are subject to administrative fines of up to €20 million or 4% of annual global turnover, whichever is higher. For NTP, with FY 2022 group revenue of £2.47 billion, 4% of turnover would amount to approximately £98.8 million. While it is not possible to predict the level of any fine that might ultimately be imposed, the potential exposure is significant and represents a material financial risk to the Company. Moreover, the DPC has the power under Article 58(2)(j) to order the suspension of data flows to third countries, which could disrupt NTP's operational relationship with Caldwell Analytics and its ability to provide AI-driven network analytics services.

The remediation of NTP's international data transfer mechanisms is therefore the highest priority recommendation of this report. Calderwood & Harkness LLP strongly recommends that work on transfer mechanism remediation commence in parallel with earlier phases of the engagement, and that a comprehensive response to the DPC inquiry be prepared for submission upon completion of the transfer mechanism work (targeted for early September 2023).

4.3 Board Mandate

On 8 December 2022, NTP's Board Audit & Risk Committee passed a resolution mandating a comprehensive GDPR compliance programme build, to be completed with the assistance of external counsel, by Q3 2023 (30 September 2023). The resolution was adopted following a presentation by Fiona Gallagher (General Counsel) and Sanjay Mehta (DPO) to the Committee on the compliance risks arising from the DPC inquiry, the prior ICO enforcement action, and the overall state of NTP's data protection compliance framework.

The Board resolution specifically directed that the compliance programme should address, at a minimum, the following matters:

(a) a comprehensive assessment of NTP's compliance posture against the EU GDPR and UK GDPR;

(b) remediation of all identified compliance gaps;

(d) development of a comprehensive data protection policy suite; and

(e) Board-level reporting on compliance status and residual risks.

This engagement, and this report as its Phase 1 deliverable, directly fulfils the Board mandate. The remediation roadmap set out in Section 7 is designed to achieve substantial compliance by September 2023, in accordance with the Board's timeline. Calderwood & Harkness LLP will provide periodic progress reports to the Audit & Risk Committee through Fiona Gallagher, and will deliver a Board-level GDPR training session as part of Phase 5 of the engagement.

5. Gap Analysis Findings

This section presents the detailed findings of the gap analysis across thirteen GDPR compliance domains. For each domain, the current state of NTP's compliance is described, the nature and severity of identified gaps are assessed, and specific remediation recommendations are provided.

5.1 Records of Processing Activities (Article 30)

5.1.1 Current State

Article 30 of the GDPR requires controllers to maintain a record of processing activities under their responsibility, containing specified information including the purposes of processing, categories of data subjects and personal data, categories of recipients, international transfers, envisaged retention periods, and a general description of technical and organisational security measures.

NTP currently maintains a partial ROPA, managed by the DPO (Sanjay Mehta) in a spreadsheet format. This ROPA covers approximately 40 processing activities, predominantly within UK operations. The documented activities are concentrated in the areas of customer billing, HR and payroll, and NorthCloud platform operations. While these entries provide a useful starting point, the existing ROPA is significantly deficient in both coverage and content.

No centralised ROPA exists for the EU subsidiaries. Northgate GmbH maintains some local documentation in German, covering approximately 8 processing activities, which was prepared in 2019 in response to a request from the Berlin state data protection authority. Northgate Ireland Ltd has a partial processing register covering 5 activities, prepared in connection with the DPC inquiry. The remaining EU subsidiaries (Netherlands, France, Spain) have no documented processing records of any kind.

The existing ROPA entries, including those for UK operations, lack several mandatory fields required by Article 30(1). Specifically:

• Categories of recipients to whom personal data has been or will be disclosed are not consistently identified;

• Planned retention periods or criteria used to determine retention are absent for the majority of entries;

• The general description of technical and organisational security measures (Article 30(1)(g)) is entirely absent from all entries;

GDPR / UK GDPR COMPLIANCE GAP ANALYSIS REPORT
Prepared for Northgate Telecommunications PLC
Document Reference: SC/NTP/2023-0213/PDS — Phase 1 Deliverable
PRIVILEGED & CONFIDENTIAL Attorney-Client Privilege / Litigation Privilege
Date of Delivery: 31 March 2023
Prepared by:
Sara Hendricks Lead Associate, Privacy & Data Security Calderwood & Harkness LLP
Priscilla Wynn Associate, Privacy & Data Security Calderwood & Harkness LLP
Supervised by:
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP
With contributions from:
Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP (International transfers sections)
Technical Data Mapping Support Provided by:
Ashdown Consulting Group Ltd Robert Fairclough, Managing Director Anita Chakravarti, Lead Privacy Engineer
Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN United Kingdom
This report has been prepared by Calderwood & Harkness LLP for the sole use of Northgate Telecommunications PLC and its Board of Directors, Audit & Risk Committee, and authorised internal recipients. This document is subject to attorney-client privilege and litigation privilege. It must not be disclosed, copied, or distributed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC. Disclosure to any third party may constitute a waiver of privilege.
1. Executive Summary
1.1 Purpose and Scope of this Report
This report presents the findings of a comprehensive gap analysis of Northgate Telecommunications PLC's ("NTP" or the "Company") compliance posture against the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR") and the UK General Data Protection Regulation (as retained under the European Union (Withdrawal) Act 2018 and supplemented by the Data Protection Act 2018) (the "UK GDPR", and together with the EU GDPR, the "GDPR").
This engagement was commissioned under engagement reference SC/NTP/2023-0213/PDS, pursuant to the engagement letter dated 13 February 2023, executed between Northgate Telecommunications PLC (acting by Fiona Gallagher, General Counsel) and Calderwood & Harkness LLP (acting by Kevin Ostrowski, Partner, Privacy & Data Security). The engagement letter establishes this report as the Phase 1 deliverable under a five-phase GDPR compliance programme build, the overall scope and objectives of which are described in the engagement letter and summarised in Section 7 (Remediation Roadmap) of this report.
The scope of this assessment encompasses all UK and EU operations of NTP and its subsidiaries, specifically:
(a) Northgate Telecommunications PLC (United Kingdom);
(b) Northgate Ireland Ltd (Ireland);
(c) Northgate GmbH (Germany);
(d) Northgate B.V. (Netherlands);
(e) Northgate France SAS (France); and
(f) Northgate Iberia S.L. (Spain).
The assessment period covered 20 February 2023 to 31 March 2023. During this period, Calderwood & Harkness LLP, with technical support from Ashdown Consulting Group Ltd, conducted an extensive review of NTP's data processing activities, policies, procedures, technical infrastructure, contractual arrangements, and governance structures. The findings presented in this report are based upon the information gathered during this assessment period and are current as of the date of delivery.
This report is intended to provide NTP's Board of Directors, Audit & Risk Committee, General Counsel, and DPO with a clear and actionable assessment of the Company's current GDPR compliance posture, the nature and severity of identified gaps, and a prioritised roadmap for remediation. It should be read in conjunction with the engagement letter and the detailed appendices attached hereto.
1.2 Overall Compliance Assessment
Calderwood & Harkness LLP has assessed NTP's compliance posture across thirteen core GDPR compliance domains, utilising a five-level maturity scale as follows:
• Non-existent: No controls, processes, or documentation in place.
• Ad Hoc: Some controls or processes exist but are informal, reactive, and inconsistent.
• Developing: Controls and processes are being developed or partially implemented but are not yet comprehensive or consistently applied.
• Defined: Controls and processes are documented, approved, and consistently applied across the organisation.
• Optimised: Controls and processes are fully embedded, continuously monitored, regularly reviewed, and improved based on lessons learned and best practices.
Overall Assessment: NTP has foundational elements of a GDPR compliance programme in place. The Company has appointed a qualified Data Protection Officer, maintains a basic cybersecurity framework with ISO 27001 certification for key data centres, has some data processing agreements with major processors, and has implemented general data protection awareness training. These elements provide a baseline upon which a comprehensive compliance programme can be built.
However, significant gaps exist in six core areas that present material compliance risk and require urgent remediation:
1. Records of Processing Activities (ROPA): The existing ROPA is incomplete, covering only approximately 40 of 147 identified processing activities, and lacks mandatory fields required by Article 30.
2. Data Protection Impact Assessments (DPIAs): At least 11 processing activities require full DPIAs that have not been conducted, including activities involving automated decision-making, biometric processing, and large-scale profiling.
3. International Data Transfer Mechanisms: All transfers to the United States are currently without a valid transfer mechanism following the expiry of the old-format Standard Contractual Clauses on 27 December 2022. No Transfer Impact Assessments have been conducted. This is the subject of an active regulatory inquiry by the Irish Data Protection Commission.
4. Data Subject Rights Procedures: No formalised procedure exists for handling data subject rights requests. Approximately 15% of DSARs in 2022 were not responded to within the statutory deadline.
5. Breach Notification Processes: The existing incident response procedure does not adequately address GDPR-specific breach notification obligations. Two of three personal data breaches in 2022 were reported to the ICO outside the 72-hour window.
6. Governance and Accountability Structures: The DPO function is under-resourced, legitimate interest assessments have not been documented, and privacy-by-design processes are not formalised.
The urgency of these findings is heightened by two active regulatory proceedings. The ICO Enforcement Notice ENF/2021/0934, issued in September 2021, resulted in a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal. While remediation was completed in March 2022, any future enforcement action will be assessed by the ICO in the context of this prior non-compliance, with a heightened expectation for a robust compliance framework. More critically, the DPC (Ireland) preliminary inquiry IN-22-11-3, opened in November 2022, concerns cross-border data transfers from Northgate Ireland Ltd to US-based processors in the post-Schrems II landscape, and is directly targeted at the most serious compliance gap identified in this report.
The Board Audit & Risk Committee resolution of 8 December 2022 mandated a comprehensive GDPR compliance programme build by Q3 2023. This engagement is designed to fulfil that mandate, and the five-phase remediation roadmap set out in Section 7 of this report is structured to achieve substantial compliance by September 2023.
1.3 Key Findings at a Glance
The following table summarises the key findings across each compliance domain assessed:
Table 1: Key Findings at a Glance — Summary by Compliance Domain
The two CRITICAL gaps — international data transfer mechanisms and DPIA coverage for certain high-risk processing activities — demand the most urgent attention and carry the greatest regulatory risk exposure. The international transfers gap is of particular concern given the active DPC inquiry and the potential for administrative fines under Article 83 of the EU GDPR of up to €20 million or 4% of annual global turnover (whichever is higher). For NTP, 4% of the FY 2022 revenue of £2.47 billion would amount to approximately £98.8 million, representing a material financial risk to the Company.
1.4 Recommendations Summary
Calderwood & Harkness LLP recommends that NTP proceed with the following remediation programme, structured across Phases 2 through 5 of the engagement:
Phase 2 — ROPA & Data Mapping (April–May 2023): Build a comprehensive ROPA covering all 147 identified processing activities across UK and EU operations. Complete Legitimate Interest Assessment templates and conduct balancing tests for all 64 legitimate-interest-basis activities. Integrate the ROPA into the Sundial Solutions platform with Ashdown Consulting's support. Target delivery of ROPA v1.0 by 19 May 2023.
Phase 3 — DPIAs (May–July 2023): Conduct full DPIAs for all 11 identified high-risk processing activities (DPIA-001 through DPIA-011). Establish an ongoing DPIA screening process and privacy-by-design review framework. Present DPIA outcomes and high-risk findings to the Board Audit & Risk Committee. Target completion of all DPIAs by early July 2023.
Phase 4 — Transfer Mechanisms (July–August 2023): Implement compliant international data transfer mechanisms for all identified third-country transfers, including execution of new EU SCCs and UK IDTAs, completion of Transfer Impact Assessments, amendment of processor agreements, and implementation of supplementary technical, contractual, and organisational measures. Develop an Internal International Transfers Policy. Target completion of all TIAs by early August 2023. Work on transfer mechanisms should commence in parallel with earlier phases where possible, given the urgency of the DPC inquiry.
Phase 5 — Policies, Governance & Training (August–September 2023): Develop and implement a comprehensive policy suite, including Group Data Protection Policy, Data Subject Rights Procedure, Data Breach Notification Procedure, updated Data Retention Schedule, and revised privacy notices. Deliver Board-level GDPR training. Target delivery of the final policy suite by 1 September 2023.
Immediate Priority: The remediation of international data transfer mechanisms should be treated as the highest priority, given the active DPC inquiry IN-22-11-3. Calderwood & Harkness LLP recommends that preliminary work on transfer mechanisms — including the negotiation of new SCCs with Caldwell Analytics and the amendment of the Pinnacle DPA — should commence during Phase 2 and be advanced in parallel with ROPA development, to ensure that a comprehensive response to the DPC inquiry can be submitted upon completion of the transfer mechanism work.
2. Methodology
2.1 Approach and Framework
The gap analysis was conducted by measuring NTP's current compliance posture against the full requirements of the EU GDPR and UK GDPR. The assessment framework was structured around the core obligations imposed by the GDPR, with particular attention to the following provisions:
• Article 5 — Principles relating to processing of personal data (lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability);
• Article 6 — Lawfulness of processing, including the identification and documentation of lawful bases;
• Article 9 — Processing of special categories of personal data, including the identification of Article 9(2) conditions;
• Articles 12–22 — Data subject rights, including transparent communication (Art. 12), information to be provided (Arts. 13–14), right of access (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction (Art. 18), notification obligation regarding rectification, erasure, or restriction (Art. 19), right to data portability (Art. 20), right to object (Art. 21), and automated individual decision-making including profiling (Art. 22);
• Articles 24–25 — Responsibility of the controller (Art. 24) and data protection by design and by default (Art. 25);
• Article 28 — Processor obligations and contractual requirements;
• Article 30 — Records of processing activities;
• Article 32 — Security of processing;
• Articles 33–34 — Notification of personal data breaches to the supervisory authority (Art. 33) and communication to data subjects (Art. 34);
• Articles 35–36 — Data protection impact assessments (Art. 35) and prior consultation (Art. 36);
• Articles 44–49 — Transfers of personal data to third countries or international organisations, including adequacy decisions (Art. 45), appropriate safeguards (Art. 46), standard contractual clauses (Art. 46(2)(c)), and derogations (Art. 49); and
• Articles 37–39 — Data Protection Officer designation, position, and tasks.
In addition to the core GDPR provisions, the assessment incorporated guidance and regulatory expectations from the following sources:
• Information Commissioner's Office (ICO) published guidance, enforcement approach, and codes of practice, including the ICO's Age Appropriate Design Code, Direct Marketing Code, and guidance on international transfers;
• European Data Protection Board (EDPB) guidelines, including Guidelines 2/2018 on derogations of Article 49, Recommendations 01/2020 on supplementary measures for international transfers, Guidelines 03/2022 on deceptive design patterns, and Guidelines on Data Protection Impact Assessments (wp248rev.01);
• Sector-specific requirements relevant to telecommunications operators, including obligations arising from the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) in the UK and the ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) in the EU, to the extent that they intersect with GDPR obligations (particularly with respect to electronic marketing, cookies, and communications metadata);
• The Investigatory Powers Act 2016 and associated data retention obligations imposed on telecommunications operators in the UK; and
• The UK Data Protection and Digital Information Bill (as introduced in the House of Commons on 8 March 2023), which was assessed for potential future impacts on NTP's compliance framework in the event of UK-EU regulatory divergence.
The maturity assessment was conducted using the five-level scale described in Section 1.2 (Non-existent, Ad Hoc, Developing, Defined, Optimised), applied consistently across all thirteen compliance domains. Gap severity was assessed on a four-level scale (Critical, High, Medium, Low) based on the likelihood and potential impact of regulatory enforcement, the nature of the non-compliance, the volume and sensitivity of personal data affected, and the vulnerability of the data subjects concerned.
2.2 Information Gathering
Information was gathered through four principal workstreams during the assessment period (20 February 2023 to 31 March 2023):
Data Mapping Questionnaires. Standardised data mapping questionnaires were designed by Priscilla Wynn and distributed to all NTP business units on 1 March 2023. The questionnaires were structured to capture comprehensive information about each processing activity, including: processing activity name and description; business unit; data controller entity; categories of data subjects; categories of personal data; special category data flags; purpose(s) of processing; lawful basis (with sub-basis for special category data); source of personal data; recipients of personal data (internal and external); international transfers (destination country, transfer mechanism, safeguards); retention period; deletion or anonymisation method; and technical and organisational security measures applied. Completed questionnaires were received from 23 business units across all six NTP entities between 8 March and 22 March 2023. A template of the questionnaire is included at Appendix A.
Stakeholder Interviews. Structured interviews were conducted with the following key NTP personnel during the period 6–17 March 2023:
• Fiona Gallagher, General Counsel — governance structure, Board mandate, regulatory history, legal risk assessment, privilege considerations (interviewed 6 March 2023);
• Sanjay Mehta, Data Protection Officer — ROPA status, DSAR handling processes, DPO resourcing and independence, DPC inquiry correspondence and timeline, training programme, overall compliance posture (interviewed 7 March 2023);
• Thomas Okoye, Chief Information Security Officer — security measures, incident response procedures, breach history and notification experience, encryption and pseudonymisation practices, ISO 27001 certification, network architecture (interviewed 9 March 2023);
• Laura Dearden, VP Product & Engineering (NorthCloud) — NorthCloud platform processing activities, AI-driven models (churn prediction, fraud detection), product development lifecycle, privacy-by-design practices, IoT platform operations (interviewed 10 March 2023);
• Philippa Crane, Head of People & HR — employee data processing activities, NorthPulse wellbeing monitoring platform, HR analytics, biometric access controls, expatriate payroll, trade union data, recruitment processing (interviewed 14 March 2023); and
• Marcus Engström, Head of EU Operations — EU subsidiary operations, local compliance practices, Frankfurt and Amsterdam data centre operations, Dublin operational headquarters, cross-border data flows within NTP group, local regulatory requirements (interviewed 17 March 2023).
A detailed log of the interviews, including dates, topics covered, and key findings, is included at Appendix B.
Documentation Review. Calderwood & Harkness LLP conducted a comprehensive review of existing NTP documentation, including but not limited to: customer-facing and employee privacy notices; the NorthCloud platform Terms of Service and Privacy Policy; data processing agreements with Caldwell Analytics Inc., Pinnacle Cloud Services Ltd, Sunderland-Hayes Payroll Services Inc., and Moritaka Systems K.K.; contract templates used for processor engagements; existing ROPA fragments maintained by Sanjay Mehta; information security policies (including ISO 27001 documentation); HR policies relating to employee monitoring, health data, and biometric access; marketing consent records and consent management platform configurations; and internal policy documentation relating to data retention.
Technical Data Flow Analysis. Ashdown Consulting Group Ltd, under the direction of Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer), performed a technical data flow analysis using the Sundial Solutions platform. This analysis was supplemented by system inventories provided by Thomas Okoye's cybersecurity team, network architecture reviews, and data centre infrastructure mapping across the London, Frankfurt, Amsterdam, and Dublin facilities. The technical analysis identified data flows between NTP entities, processors, and sub-processors, and confirmed the jurisdictions in which personal data is stored and processed. The outputs of this technical analysis form the basis of the Processing Activities Inventory Summary at Appendix C.
Review of Regulatory Correspondence. Calderwood & Harkness LLP reviewed all correspondence relating to the ICO Enforcement Notice ENF/2021/0934, including the original notice, the decision letter, NTP's representations, the penalty notice, and the remediation confirmation. Calderwood & Harkness LLP also reviewed all correspondence relating to the DPC preliminary inquiry IN-22-11-3, including the initial inquiry letter, NTP's preliminary acknowledgement, and subsequent correspondence. A summary of this regulatory correspondence is included at Appendix E.
2.3 Scope Boundaries
In Scope. The assessment covered all personal data processing activities conducted by or on behalf of the following entities:
(a) Northgate Telecommunications PLC (United Kingdom);
(b) Northgate Ireland Ltd (Ireland);
(c) Northgate GmbH (Germany);
(d) Northgate B.V. (Netherlands);
(e) Northgate France SAS (France); and
(f) Northgate Iberia S.L. (Spain).
The data processing activities assessed encompass all categories of data subjects whose personal data is processed by the above entities. The approximate scale of data subjects affected is as follows:
• Consumer subscribers: approximately 6.3 million individuals;
• Enterprise clients (business contacts): approximately 42,000 individuals;
• Employees: approximately 11,400 globally, of whom approximately 8,200 are based in the UK and EU;
• Contractors, temporary workers, job applicants, and website visitors: approximately 28,000 individuals; and
• Total: approximately 6.38 million data subjects.
The assessment also covered NTP's relationships with its key data processors, to the extent necessary to assess NTP's compliance with its controller obligations under Article 28 and Articles 44–49. The processors assessed include:
• Caldwell Analytics Inc. (San Jose, California, USA) — AI-driven network analytics and predictive maintenance;
• Pinnacle Cloud Services Ltd (London, UK) — cloud infrastructure (IaaS/PaaS) hosting for NorthCloud and internal systems, including sub-processors Pinnacle India Pvt Ltd (Gurugram, India) and Pinnacle APAC Pte Ltd (Singapore);
• Sunderland-Hayes Payroll Services Inc. (New York, USA) — expatriate payroll processing; and
• Moritaka Systems K.K. (Tokyo, Japan) — IoT analytics for connected-vehicle telemetry.
Out of Scope. The following matters are outside the scope of this assessment:
• Non-EU/EEA operations of NTP or any affiliate outside the territorial scope of the EU GDPR (Article 3) and UK GDPR;
• Compliance with telecommunications-specific regulation (e.g., Ofcom regulatory requirements, electronic communications licensing conditions) except where such regulation intersects with data protection obligations (e.g., PECR/ePrivacy obligations regarding cookies and electronic marketing, and IPA 2016 data retention obligations);
• Compliance with competition law, consumer protection law, or employment law, except where directly relevant to data protection compliance; and
• Detailed technical security audit or penetration testing — technical security was assessed at a compliance level in relation to Article 32 and supplementary measures for international transfers, relying on the outputs provided by Thomas Okoye's team and Ashdown Consulting Group Ltd.
2.4 Limitations
The findings and recommendations in this report are subject to the following limitations, which should be borne in mind when considering the conclusions reached:
The findings are based on information provided by NTP and its personnel during the assessment period. Calderwood & Harkness LLP has not independently verified all factual representations made by NTP personnel or contained in NTP documentation. Where discrepancies or ambiguities were identified, these have been noted in the relevant findings sections, and further investigation may be required during subsequent phases of the engagement.
Technical assessments, including data mapping, data flow analysis, system inventories, and network architecture reviews, were performed by Ashdown Consulting Group Ltd under the direction of Robert Fairclough and Anita Chakravarti. Calderwood & Harkness LLP has relied on the technical outputs and conclusions provided by Ashdown Consulting and has not independently audited or verified the technical analysis. The scope and limitations of Ashdown Consulting's work are set out in their separate letter of engagement with NTP dated 20 February 2023.
This report does not constitute a formal legal audit. It is a compliance gap assessment designed to identify areas of non-compliance or risk and to inform the development of a prioritised remediation plan. The findings represent Calderwood & Harkness LLP's professional assessment based on the information available as of the date of delivery, and should not be treated as a guarantee or certification of compliance or non-compliance with any particular provision of the GDPR or UK GDPR.
The regulatory landscape is subject to change. In particular, the UK Data Protection and Digital Information Bill, if enacted in its current or amended form, may alter certain UK GDPR requirements. The EU-US Data Privacy Framework, announced in principle but not yet formally adopted by EU Commission adequacy decision as of the date of this report, may affect the analysis of transfers to the United States. NTP should monitor these developments and seek updated advice as they progress.
3. Client Overview
3.1 Corporate Structure
Northgate Telecommunications PLC is a public limited company incorporated in England and Wales under Company Number 04837291. The Company's registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office is at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom.
NTP reported consolidated group revenue of £2.47 billion for the financial year ending 31 December 2022. The Company's shares are listed on the London Stock Exchange (LSE: NTP).
NTP's business operations encompass the following principal lines of business:
• Fixed-line and mobile telecommunications services: NTP provides residential and business fixed-line broadband, mobile telephony, and bundled telecommunications services across the United Kingdom. NTP holds an Ofcom general authorisation for the provision of electronic communications networks and services.
• NorthCloud unified communications SaaS platform: NTP operates NorthCloud, a cloud-based unified communications-as-a-service (UCaaS) platform offering voice, video conferencing, messaging, file sharing, and collaboration tools. NorthCloud is marketed on a B2B basis to enterprise clients across 14 EU/EEA member states. The platform is hosted across NTP's data centres in London, Frankfurt, Amsterdam, and Dublin.
• Managed network services: NTP provides managed wide-area network (WAN), software-defined networking (SD-WAN), and network security services to enterprise clients in the UK and selected EU markets.
• IoT connectivity platform: NTP operates an Internet of Things (IoT) connectivity platform providing SIM-based and eSIM-based cellular connectivity for IoT devices across sectors including automotive (connected-vehicle telemetry), logistics, smart cities, and industrial automation.
NTP operates data centres in four locations: London (UK), Frankfurt (Germany), Amsterdam (Netherlands), and Dublin (Ireland). These data centres are operated by NTP directly (London and Dublin) or in partnership with Pinnacle Cloud Services Ltd (Frankfurt, Amsterdam, and Stockholm — the latter used only for network redundancy and does not currently host personal data).
NTP's ICO Registration Number is ZA482917, with registration maintained and reviewed annually by the DPO.
3.2 EU Subsidiary Structure
NTP conducts its EU operations through five wholly-owned subsidiaries, each of which constitutes a data controller in its own right for certain locally managed processing activities, and acts as a joint or co-controller with NTP PLC for certain group-wide processing activities. The subsidiaries are structured as follows:
Northgate Ireland Ltd is a private limited company registered in Ireland at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland (CRO Number 587214). Northgate Ireland has approximately 340 staff and serves as NTP's EU operational headquarters. Critically, Northgate Ireland hosts the NorthCloud EU customer data within the Dublin data centre and is the entity through which NTP's EU customer-facing operations are conducted. As the entity with decision-making authority over the means and purposes of NTP's EU data processing, Northgate Ireland is NTP's main establishment in the EU for the purposes of Article 56 of the EU GDPR. The lead EU supervisory authority is therefore the Data Protection Commission (DPC) of Ireland. Northgate Ireland is the entity subject to the active DPC preliminary inquiry IN-22-11-3.
Northgate GmbH is a private limited company registered in Germany at Friedrichstraße 91, 10117 Berlin (HRB 214503 B, Amtsgericht Charlottenburg). Northgate GmbH has approximately 185 staff and is responsible for sales operations in the DACH region, engineering support, and the operation of the Frankfurt data centre. Germany's robust data protection enforcement environment, including the active oversight of both the federal Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the relevant state-level supervisory authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit), means that compliance for this entity requires particular attention to German-specific requirements.
Northgate B.V. is a private limited company registered in the Netherlands at Herikerbergweg 44, 1101 CM Amsterdam (KvK 72841936). Northgate B.V. has approximately 120 staff and is responsible for the Amsterdam data centre and network operations centre (NOC). The NOC monitors network performance across all NTP EU data centres and is a significant nexus for cross-border data flows within the NTP group.
Northgate France SAS is a simplified joint-stock company registered in France at 27 Rue de Berri, 75008 Paris (SIREN 891 247 503). Northgate France has approximately 95 staff and is responsible for sales operations and French-language customer support for NorthCloud and managed services clients in France and francophone markets.
Northgate Iberia S.L. is a private limited company registered in Spain at Calle de Serrano 41, 28001 Madrid (CIF B-91847263). Northgate Iberia has approximately 70 staff and is responsible for sales and managed services delivery in Spain and Portugal.
3.3 Data Processing Landscape
The data mapping exercise conducted during the assessment period identified a total of 147 processing activities across the NTP group. These activities are distributed by jurisdiction as follows:
Table 2: Processing Activities by Jurisdiction
The processing activities affect the following categories of data subjects:
• Consumer subscribers: Approximately 6.3 million individuals using NTP's residential broadband, mobile, and bundled telecommunications services. Personal data processed includes name, address, contact details, date of birth, account information, billing data, payment card data, subscriber metadata (call detail records, session data, location data), device identifiers (IMSI, IMEI, MAC address), and service usage data.
• Enterprise clients: Approximately 42,000 individuals representing business contacts associated with NTP's enterprise clients. Personal data processed includes name, job title, business contact details, company information, contractual and billing data, and NorthCloud platform usage data.
• Employees: Approximately 11,400 employees globally, of whom approximately 8,200 are based in the UK and EU. Personal data processed includes HR records, payroll data, performance reviews, health and absence data, trade union membership, biometric access control data, wellbeing platform data (NorthPulse), and cross-border workforce analytics data.
• Contractors, temporary workers, job applicants, and website visitors: Approximately 28,000 individuals. Personal data processed includes recruitment data, contractor engagement records, website analytics data, and cookie/tracking data.
Special category data processing was identified in 14 processing activities, involving the following categories of special category personal data:
• Employee health data (occupational health records, sickness absence records, disability accommodation data);
• Trade union membership data (payroll deductions, staff representative records); and
• Biometric data (fingerprint and facial recognition data used for physical access control at data centres and the London headquarters).
The key data flows identified include subscriber metadata and communications data, location data and device identifiers, call detail records, network performance and telemetry data, employee HR and payroll data, customer billing and account data, and marketing and profiling data used for targeted advertising and customer retention activities on the NorthCloud platform.
A detailed summary of all 147 processing activities, grouped by business unit and jurisdiction, is set out at Appendix C.
3.4 Key Third-Party Processors
The assessment identified four key third-party processors whose relationships with NTP present the most significant data protection compliance considerations. Each is described below, together with a summary of the current contractual and compliance position:
Caldwell Analytics Inc. (2700 Technology Drive, Suite 400, San Jose, CA 95134, USA). Caldwell provides AI-driven network analytics and predictive maintenance services to NTP, processing pseudonymised subscriber analytics data, network performance data, and device telemetry to generate network optimisation recommendations and predictive maintenance alerts. The relationship is governed by a Master Services Agreement dated 1 June 2021, which incorporates a data processing addendum. Caldwell is a US-based processor without the benefit of an EU or UK adequacy decision. As discussed in detail in Section 5.3, the data processing addendum references the old-format (2010) EU Standard Contractual Clauses, which expired on 27 December 2022. The Caldwell relationship is at the centre of the DPC inquiry IN-22-11-3.
Pinnacle Cloud Services Ltd (Apex House, 24 Victoria Embankment, London EC4Y 0DZ, UK; Company Number 09142837). Pinnacle provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the NorthCloud platform and NTP's internal IT systems. Pinnacle operates data centres in London, Frankfurt, Amsterdam, Dublin, and Stockholm, and is NTP's primary cloud infrastructure provider. The relationship is governed by a data processing agreement incorporated into the services agreement. Critically, Pinnacle engages two sub-processors located in third countries without adequacy decisions: Pinnacle India Pvt Ltd (Plot No. 42, Cyber City, Sector 24, Gurugram, Haryana 122002, India; CIN U72200HR2016PTC065412), which provides Tier 2 and Tier 3 technical support with potential access to personal data in production environments; and Pinnacle APAC Pte Ltd (1 Raffles Place, #44-02 One Raffles Place Tower 2, Singapore 048616; UEN 201824567K), which provides network monitoring and incident response services covering the APAC time zone. Neither sub-processor is subject to a direct DPA with NTP, and no processor-to-sub-processor Standard Contractual Clauses (Module 3) are in place.
Sunderland-Hayes Payroll Services Inc. (1400 Broadway, Suite 2200, New York, NY 10018, USA). Sunderland-Hayes provides cross-border payroll processing services for approximately 45 NTP expatriate employees based in the United States. The relationship is governed by a payroll services agreement that contains embedded data protection terms, but does not include a standalone data processing agreement that meets the requirements of Article 28(3). As a US-based processor, the same transfer mechanism deficiencies identified for Caldwell Analytics apply to the Sunderland-Hayes relationship.
Moritaka Systems K.K. (Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan). Moritaka provides IoT analytics services for NTP's connected-vehicle telemetry platform, processing data from approximately 12,000 device endpoints. The relationship is governed by an analytics services agreement that characterises Moritaka as a data processor. However, as discussed in Section 5.7, the nature of the processing arrangement — which involves joint development of analytics algorithms, joint determination of the purposes and means of certain analyses, and Moritaka's independent use of aggregated outputs — raises significant questions about whether the relationship is more properly characterised as a joint controllership under Article 26 of the GDPR. Japan benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2019/419 of 23 January 2019), but this does not address potential gaps that may arise depending on the precise characterisation of the controller-processor relationship and the scope of supplementary measures required.
A comprehensive register of all identified processors and sub-processors, including their current DPA status, jurisdiction, and identified gaps, is included at Appendix D.
4. Regulatory Risk Context
4.1 ICO Enforcement History
On 15 September 2021, the Information Commissioner's Office issued Enforcement Notice reference ENF/2021/0934 against Northgate Telecommunications PLC.
The subject matter of the enforcement action concerned NTP's use of direct marketing cookies on the NorthCloud customer portal. The ICO's investigation found that NTP had deployed analytics and advertising cookies on the NorthCloud portal without obtaining valid, freely given, specific, informed, and unambiguous consent from users, in contravention of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the related transparency requirements of Articles 5(1)(a), 13, and 14 of the UK GDPR. Specifically, the ICO found that:
(a) The NorthCloud cookie consent mechanism used pre-ticked checkboxes for non-essential cookies, which do not constitute valid consent under PECR or the UK GDPR (consistent with the CJEU's ruling in Planet49, Case C-673/17);
(b) The cookie notice did not provide adequate information about the purposes of each category of cookie, the recipients of data collected through cookies, or the retention periods for cookies;
(c) Certain analytics cookies were set prior to the user interacting with the consent mechanism, constituting processing without a lawful basis; and
(d) The consent mechanism did not provide a genuinely free choice to refuse non-essential cookies, as the "Reject All" option was less prominently displayed than the "Accept All" option.
The ICO imposed a monetary penalty of £320,000, which was paid by NTP. The Enforcement Notice required NTP to implement a PECR-compliant cookie consent mechanism on the NorthCloud portal by a specified deadline.
NTP completed the required remediation in March 2022, implementing a new cookie consent mechanism using the Bramwell SystemsokiePro platform. Calderwood & Harkness LLP has reviewed the remediated cookie consent mechanism and notes that it appears to comply with the ICO's requirements, though ongoing monitoring is recommended to ensure continued compliance (see Section 5.9).
The significance of this enforcement history for the present assessment is threefold. First, it demonstrates that NTP is subject to active regulatory scrutiny by the ICO and that the ICO is aware of NTP as an organisation with data protection compliance issues. Second, any future enforcement action by the ICO will be assessed in the context of this prior non-compliance; the ICO's Regulatory Action Policy provides that enforcement history is a relevant factor in determining the nature and level of any regulatory response. Third, the underlying issues identified in the enforcement action — inadequate consent mechanisms and insufficient transparency — are symptomatic of the broader compliance gaps identified in this report, including the absence of systematic privacy-by-design processes and the informal nature of compliance governance.
4.2 DPC (Ireland) Preliminary Inquiry
The Data Protection Commission of Ireland (DPC) opened a preliminary inquiry under reference IN-22-11-3 in November 2022, directed at Northgate Ireland Ltd.
The inquiry concerns cross-border data transfers from Northgate Ireland Ltd to US-based processors, with particular focus on the adequacy of transfer mechanisms in the aftermath of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II"). The Schrems II judgment invalidated the EU-US Privacy Shield framework and, while confirming the validity of Standard Contractual Clauses as a transfer mechanism in principle, established that data exporters must assess on a case-by-case basis whether the laws and practices of the destination country ensure an adequate level of protection, and must implement supplementary measures where necessary to bring the level of protection up to the EU standard.
The DPC inquiry is understood to have been triggered by a complaint from a Northgate Ireland customer who exercised their right of access under Article 15 and discovered that their data was being transferred to Caldwell Analytics Inc. in the United States. The complainant raised concerns about the absence of adequate transfer safeguards in light of the Schrems II judgment.
At the time of this report, the inquiry is active. NTP has acknowledged receipt of the DPC's inquiry letter and provided a preliminary response, but has not yet submitted a comprehensive response addressing the adequacy of its transfer mechanisms, transfer impact assessments, or supplementary measures. The DPC has indicated that it expects a substantive response within a reasonable timeframe, and failure to provide such a response may result in the initiation of formal enforcement proceedings.
The regulatory risk associated with this inquiry is severe. Under Article 83(5)(c) of the EU GDPR, infringements of the provisions on transfers of personal data to third countries (Articles 44–49) are subject to administrative fines of up to €20 million or 4% of annual global turnover, whichever is higher. For NTP, with FY 2022 group revenue of £2.47 billion, 4% of turnover would amount to approximately £98.8 million. While it is not possible to predict the level of any fine that might ultimately be imposed, the potential exposure is significant and represents a material financial risk to the Company. Moreover, the DPC has the power under Article 58(2)(j) to order the suspension of data flows to third countries, which could disrupt NTP's operational relationship with Caldwell Analytics and its ability to provide AI-driven network analytics services.
The remediation of NTP's international data transfer mechanisms is therefore the highest priority recommendation of this report. Calderwood & Harkness LLP strongly recommends that work on transfer mechanism remediation commence in parallel with earlier phases of the engagement, and that a comprehensive response to the DPC inquiry be prepared for submission upon completion of the transfer mechanism work (targeted for early September 2023).
4.3 Board Mandate
On 8 December 2022, NTP's Board Audit & Risk Committee passed a resolution mandating a comprehensive GDPR compliance programme build, to be completed with the assistance of external counsel, by Q3 2023 (30 September 2023). The resolution was adopted following a presentation by Fiona Gallagher (General Counsel) and Sanjay Mehta (DPO) to the Committee on the compliance risks arising from the DPC inquiry, the prior ICO enforcement action, and the overall state of NTP's data protection compliance framework.
The Board resolution specifically directed that the compliance programme should address, at a minimum, the following matters:
(a) a comprehensive assessment of NTP's compliance posture against the EU GDPR and UK GDPR;
(b) remediation of all identified compliance gaps;
(c) implementation of robust international data transfer mechanisms;
(d) development of a comprehensive data protection policy suite; and
(e) Board-level reporting on compliance status and residual risks.
This engagement, and this report as its Phase 1 deliverable, directly fulfils the Board mandate. The remediation roadmap set out in Section 7 is designed to achieve substantial compliance by September 2023, in accordance with the Board's timeline. Calderwood & Harkness LLP will provide periodic progress reports to the Audit & Risk Committee through Fiona Gallagher, and will deliver a Board-level GDPR training session as part of Phase 5 of the engagement.
5. Gap Analysis Findings
This section presents the detailed findings of the gap analysis across thirteen GDPR compliance domains. For each domain, the current state of NTP's compliance is described, the nature and severity of identified gaps are assessed, and specific remediation recommendations are provided.
5.1 Records of Processing Activities (Article 30)
5.1.1 Current State
Article 30 of the GDPR requires controllers to maintain a record of processing activities under their responsibility, containing specified information including the purposes of processing, categories of data subjects and personal data, categories of recipients, international transfers, envisaged retention periods, and a general description of technical and organisational security measures.
NTP currently maintains a partial ROPA, managed by the DPO (Sanjay Mehta) in a spreadsheet format. This ROPA covers approximately 40 processing activities, predominantly within UK operations. The documented activities are concentrated in the areas of customer billing, HR and payroll, and NorthCloud platform operations. While these entries provide a useful starting point, the existing ROPA is significantly deficient in both coverage and content.
No centralised ROPA exists for the EU subsidiaries. Northgate GmbH maintains some local documentation in German, covering approximately 8 processing activities, which was prepared in 2019 in response to a request from the Berlin state data protection authority. Northgate Ireland Ltd has a partial processing register covering 5 activities, prepared in connection with the DPC inquiry. The remaining EU subsidiaries (Netherlands, France, Spain) have no documented processing records of any kind.
The existing ROPA entries, including those for UK operations, lack several mandatory fields required by Article 30(1). Specifically:
• Categories of recipients to whom personal data has been or will be disclosed are not consistently identified;
• Planned retention periods or criteria used to determine retention are absent for the majority of entries;
• The general description of technical and organisational security measures (Article 30(1)(g)) is entirely absent from all entries;
• Details of international transfers, including the identification of third countries and the transfer mechanisms relied upon (Article 30(1)(e)), are not recorded; and
• Where processing is carried out on behalf of a controller (processor ROPA under Article 30(2)), no separate record has been maintained.
There is no systematic process for updating the ROPA when new processing activities are commenced, existing activities are materially modified, or activities are discontinued. During his interview on 7 March 2023, Sanjay Mehta acknowledged that business units do not routinely notify him of new processing activities, and that the ROPA has not been substantively updated since its initial creation in 2019. The DPO described the ROPA as a "snapshot in time that has become increasingly outdated." New product launches, such as the NorthPulse employee wellbeing platform (launched Q2 2022) and the Birmingham smart city IoT pilot (commenced Q4 2022), are not reflected in the current ROPA.
5.1.2 Gap Assessment
Severity: HIGH
The data mapping exercise conducted during this assessment identified 147 processing activities across the NTP group. The existing ROPA documents approximately 40 of these activities. This means that over 100 processing activities — representing approximately 73% of NTP's total processing landscape — are currently undocumented and outside the scope of the ROPA.
This constitutes non-compliance with Article 30(1) of the GDPR, which requires controllers to maintain records covering all processing activities under their responsibility. It is also non-compliant with Article 30(2), which requires that where processing is carried out on behalf of another controller, a separate processor ROPA is maintained. NTP acts as a processor for certain enterprise clients (NorthCloud managed services), and no processor ROPA has been prepared.
The specific deficiencies are as follows:
• Coverage gap: 107 of 147 processing activities (73%) are not documented in the ROPA.
• Content gap: Even for the 40 documented activities, mandatory fields including categories of recipients, retention periods, security measures, and international transfer details are absent or incomplete.
• EU subsidiary gap: The EU subsidiaries' ROPAs do not reflect local-language requirements or local regulatory expectations. The German ROPA, while partially compliant, has not been updated since 2019 and does not cover processing activities commenced since that date. The Irish ROPA is incomplete and was prepared reactively in response to the DPC inquiry rather than as part of a systematic compliance effort.
• Legitimate interest documentation gap: Of the 147 processing activities, 64 (43.5%) rely on legitimate interest as the lawful basis for processing. Article 6(1)(f) requires that the controller has identified its legitimate interest, demonstrated that the processing is necessary for that interest, and conducted a balancing test against the rights and freedoms of the data subject. No formal Legitimate Interest Assessments (LIAs) have been documented for any of these 64 activities. While a balancing test is not explicitly required as a separate document by Article 30, the EDPB and ICO guidance is clear that the controller must be able to demonstrate the basis for its reliance on legitimate interest, and the absence of documented LIAs represents a significant accountability gap under Article 5(2).
• Maintenance gap: The absence of a systematic process for maintaining the ROPA means that compliance will inevitably deteriorate over time, even once a complete ROPA is established.
5.1.3 Recommendations. Calderwood & Harkness LLP recommends the following remediation actions, to be delivered as Phase 2 of the engagement:
1. Build a comprehensive, Article 30-compliant ROPA covering all 147 identified processing activities (89 UK, 58 EU), including all mandatory fields required by Article 30(1) and Article 30(2) as applicable.
2. Implement a systematic ROPA maintenance process with designated business unit data stewards responsible for notifying the DPO of new processing activities, material changes to existing activities, and discontinued activities. Develop a ROPA methodology and guidance note for ongoing maintenance, including triggers for ROPA updates (e.g., new product launch, new processor engagement, change in lawful basis, new international transfer).
3. Integrate the ROPA into the Sundial Solutions platform, with Ashdown Consulting Group Ltd responsible for platform configuration. Sundial Solutions will serve as the centralised ROPA repository, enabling real-time access, version control, and reporting capabilities.
4. Prepare LIA templates and complete balancing tests for all 64 legitimate-interest-basis activities. The LIA template will follow the three-part test recommended by the ICO: (i) identify the legitimate interest; (ii) show that the processing is necessary; and (iii) balance the interest against the individual's rights and freedoms.
5. Target delivery: ROPA v1.0, including all 147 processing activities and all completed LIAs, by 19 May 2023.
5.2 Data Protection Impact Assessments (Articles 35–36)
5.2.1 Current State
Article 35(1) of the GDPR requires that, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons — particularly where it involves the use of new technologies, and taking into account the nature, scope, context, and purposes of the processing — the controller must carry out a data protection impact assessment prior to the processing. Article 35(3) provides a non-exhaustive list of processing types that require a DPIA, including systematic and extensive profiling with significant effects, large-scale processing of special category data, and systematic monitoring of a publicly accessible area on a large scale.
NTP has conducted two DPIAs historically:
(a) A DPIA for the NorthCloud platform launch in 2020, prepared by Sanjay Mehta. This document runs to approximately 8 pages and addresses the NorthCloud platform in general terms. It does not follow the structured format required by Article 35(7), which mandates that a DPIA contain at minimum: (i) a systematic description of the envisaged processing operations and purposes, including legitimate interest where applicable; (ii) an assessment of the necessity and proportionality of the processing; (iii) an assessment of the risks to the rights and freedoms of data subjects; and (iv) the measures envisaged to address those risks, including safeguards, security measures, and mechanisms to ensure protection and demonstrate compliance. The 2020 NorthCloud DPIA does not contain a meaningful risk assessment or mitigation plan.
(b) A DPIA for employee monitoring CCTV at the London headquarters, prepared in 2019. This document is similarly brief and does not meet the Article 35(7) requirements.
No systematic DPIA screening or threshold assessment process exists within NTP. There is no established mechanism for identifying when a new or changed processing activity triggers the requirement for a DPIA. Laura Dearden (VP Product & Engineering) confirmed during her interview on 10 March 2023 that the NorthCloud product development lifecycle does not include any privacy impact or DPIA screening stage. New features, analytics capabilities, and AI-driven models are developed and deployed without formal assessment of whether they constitute high-risk processing requiring a DPIA.
Several processing activities identified during the data mapping exercise clearly meet one or more of the DPIA trigger criteria set out in Article 35(3), the EDPB Guidelines on Data Protection Impact Assessments (wp248rev.01), and the ICO's published list of processing operations requiring a DPIA. Despite this, none of these activities has been subject to any formal DPIA.
5.2.2 Gap Assessment
Severity: CRITICAL (for certain high-risk activities) / HIGH (generally)
Calderwood & Harkness LLP has identified at least 11 processing activities that require full DPIAs under Article 35. These are listed in the table below, together with the applicable DPIA trigger criteria:
Table 4: DPIA-Required Processing Activities
At least five of these activities are likely to be classified as presenting a genuinely high risk to the rights and freedoms of data subjects, requiring detailed risk assessments and mitigation plans with residual risk evaluation. These are:
• DPIA-001 (AI churn prediction): This model uses machine learning to predict which customers are likely to cancel their subscriptions, generating automated scores that directly influence retention marketing decisions and, in some cases, the pricing and service offers presented to individual customers. This constitutes automated decision-making and profiling that may produce significant effects on individuals (Article 22(1)).
• DPIA-003 (NorthPulse): This platform collects employee wellbeing data, including self-reported stress levels, sleep patterns, and mental health indicators. Processing of special category health data in an employment context, where there is an inherent power imbalance between employer and employee, presents particular risks. The voluntary nature of the platform must be carefully assessed given the workplace context.
• DPIA-007 (Marketing profiling on NorthCloud freemium tier): Profiling of freemium-tier users to serve targeted advertising based on usage patterns, industry vertical, company size, and inferred business needs. The scale (freemium tier has approximately 180,000 registered users) and the potential for discriminatory targeting based on inferred characteristics present significant risks.
• DPIA-008 (Facial recognition pilot): This presents particular concern. NTP deployed a facial recognition pilot at the London headquarters in Q3 2022 for building access control, supplementing (but not replacing) existing card-based access. The pilot processes biometric data — a special category under Article 9 — in a workplace setting. No proportionality assessment has been conducted to determine whether facial recognition is necessary and proportionate for building access given the availability of less intrusive alternatives (card access, PIN codes). The ICO has published detailed guidance on the use of biometric technologies in the workplace and has emphasised that the threshold for justifying such processing is high, particularly where less privacy-intrusive alternatives are available. Additionally, no Article 9(2) condition has been formally identified for this processing. NTP should consider suspending the facial recognition pilot pending completion of the DPIA.
• DPIA-011 (Caldwell transfer): The transfer of large-scale subscriber analytics data to a processor in the United States, in the context of the Schrems II judgment and the active DPC inquiry, requires a comprehensive DPIA addressing the risks to data subjects arising from the third-country transfer.
The absence of any systematic DPIA screening process means that new high-risk processing activities can be — and have been — deployed without any formal privacy risk assessment. This represents a structural compliance gap that will continue to generate risk even after the 11 identified DPIAs are completed.
5.2.3 Recommendations. Calderwood & Harkness LLP recommends the following remediation actions, to be delivered as Phase 3 of the engagement:
1. Conduct 11 full DPIAs (DPIA-001 through DPIA-011), each following the structured format required by Article 35(7) and incorporating the EDPB and ICO guidance. Each DPIA will include: (i) a systematic description of the processing, including purpose, scope, context, data categories, data subjects, and technology used; (ii) an assessment of necessity and proportionality; (iii) an assessment of the risks to the rights and freedoms of data subjects, including likelihood and severity; and (iv) the measures to address those risks, including safeguards, security measures, and mechanisms to demonstrate compliance.
2. Prioritise the following DPIAs based on risk severity and regulatory urgency: DPIA-011 (Caldwell transfer — linked to DPC inquiry), DPIA-008 (facial recognition pilot — consider interim suspension), DPIA-001 (AI churn prediction), DPIA-003 (NorthPulse), and DPIA-007 (marketing profiling).
3. Establish an ongoing DPIA screening process with Article 35(1) triggers integrated into NTP's project governance and product development lifecycle. Develop a DPIA threshold assessment form that must be completed for all new processing activities, product features, AI models, and processor engagements, with escalation to the DPO for full DPIA determination.
4. Implement a privacy-by-design review process integrated into NorthCloud product development (working with Laura Dearden) and NTP's broader IT project governance framework, ensuring that privacy considerations are addressed at the design stage of all new processing activities.
5. Present DPIA summary findings and high-risk outcomes to the Board Audit & Risk Committee, ensuring Board-level visibility of high-risk processing and residual risks.
6. Target completion: All 11 DPIAs completed by early July 2023.
5.3 International Data Transfers (Articles 44–49)
5.3.1 Current State
Chapter V of the GDPR (Art

GDPR / UK GDPR COMPLIANCE GAP ANALYSIS REPORT

Record

Parties

Dates

Amounts