RESPONSE OF NORTHGATE IRELAND LTD TO THE DATA PROTECTION COMMISSION
PRELIMINARY INQUIRY REFERENCE IN-22-11-3
DRAFT — PRIVILEGED & CONFIDENTIAL — PREPARED BY OUTSIDE COUNSEL
Prepared by: Rachel Bernstein, Billing Partner, and Sara Hendricks, Lead Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP, One Moorgate Square, London EC2R 6AN, United Kingdom
Prepared on behalf of: Northgate Ireland Ltd (CRO Number: 587214), Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland — a wholly owned subsidiary of Northgate Telecommunications PLC (Company Number: 04837291), 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom
Date of submission: 4 September 2023
Data Protection Officer: Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC, CIPP/E certified
Inquiry reference: IN-22-11-3
Note: The formal cover letter accompanying this response is signed by Sanjay Mehta in his capacity as Data Protection Officer of Northgate Telecommunications PLC and its subsidiaries, including Northgate Ireland Ltd.
Right-click to update Table of Contents
1. Introduction and Purpose of This Response
Northgate Ireland Ltd ("Northgate Ireland" or the "Company") acknowledges receipt of the Data Protection Commission's (the "DPC" or the "Commission") preliminary inquiry opened in November 2022 under reference IN-22-11-3 (the "Inquiry"). The Inquiry concerns cross-border personal data transfers from Northgate Ireland Ltd to processors established in the United States of America, and the adequacy of the transfer mechanisms and safeguards relied upon in connection with those transfers, particularly in light of the judgment of the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II").
This response (the "Response") has been prepared with the assistance of outside counsel, Calderwood & Harkness LLP ("C&H"), engagement reference SC/NTP/2023-0213/PDS. C&H was retained by Northgate Telecommunications PLC ("NTP" or the "Group") on 13 February 2023 pursuant to a Board-level resolution to design and implement a comprehensive GDPR compliance programme across NTP's UK and EU operations. The engagement encompasses the full spectrum of data protection compliance, including records of processing activities, data protection impact assessments, international data transfer mechanisms, governance policies, and training. The details of this engagement and the programme of work completed are set out in Section 4 below.
The purpose of this Response is to provide the DPC with a complete and transparent account of the following matters:
(a) all international data transfers conducted by Northgate Ireland Ltd, including the identity of data importers, the categories of personal data transferred, and the purposes of each transfer;
(b) the transfer mechanisms now in place for each such transfer, including executed EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and reliance on adequacy decisions where applicable;
(c) the Transfer Impact Assessments completed in respect of each transfer, including the methodology applied and the conclusions reached;
(d) the supplementary measures implemented to ensure that the level of protection afforded to transferred personal data is not undermined by the laws or practices of the destination country; and
(e) the broader GDPR compliance programme undertaken by NTP and its subsidiaries, which provides the governance framework within which the transfer safeguards operate.
Northgate Ireland Ltd confirms that the DPC is its lead supervisory authority for the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), given Northgate Ireland's establishment in Dublin and the fact that decisions regarding the purposes and means of processing of personal data by NTP's EU operations are substantially taken at its Dublin headquarters. Northgate Ireland is registered with the DPC and has cooperated fully with the Commission throughout the course of this Inquiry.
For completeness, Northgate Telecommunications PLC is also registered with the UK Information Commissioner's Office ("ICO") under Registration Number ZA482917 and is subject to the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018") for its UK operations. Where relevant, this Response addresses the parallel UK compliance measures implemented as part of the same programme of work.
Northgate Ireland and NTP are committed to full transparency and cooperation with the DPC and respectfully submit this Response in the spirit of constructive engagement. The Company stands ready to provide any further information, documentation, or clarification that the Commission may require.
2. Background — Northgate Group and Northgate Ireland Ltd
2.1 Corporate Structure and Operations
Northgate Telecommunications PLC is a UK-headquartered public limited company incorporated under the laws of England and Wales (Company Number: 04837291), with its registered office and principal place of business at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom. NTP is a provider of telecommunications infrastructure services and enterprise software-as-a-service ("SaaS") solutions to businesses and consumers across the United Kingdom and the European Economic Area. For the financial year ended 31 December 2022, NTP reported consolidated revenue of approximately £2.47 billion and employed approximately 11,400 individuals globally, of whom approximately 8,200 are based in the United Kingdom and the European Union.
NTP operates through a network of wholly owned subsidiaries across the EU, as follows:
Northgate Ireland Ltd serves as the EU operational headquarters for the Group's activities within the European Economic Area. The Company is led by Marcus Engström, Head of EU Operations, who reports to the NTP Chief Operating Officer. Northgate Ireland hosts the Group's flagship product, NorthCloud — a cloud-based unified communications SaaS platform sold on a business-to-business basis — in co-located data centre facilities in Dublin. NorthCloud provides voice, video, messaging, and collaboration tools to enterprise customers and is currently deployed across 14 EU/EEA member states. EU customer data processed through NorthCloud is primarily hosted in the Dublin data centre, with failover and redundancy capacity at the Group's Frankfurt and Amsterdam facilities.
The Group operates data centres in four locations: London (United Kingdom), Frankfurt (Germany), Amsterdam (Netherlands), and Dublin (Ireland). The London data centre serves the Group's UK operations and UK GDPR-regulated processing activities, while the Dublin, Frankfurt, and Amsterdam data centres serve the Group's EU GDPR-regulated processing activities. All four data centres are operated to ISO 27001:2022 and SOC 2 Type II standards, and are subject to annual external audit by Kraft Renwick CPAs LLP.
2.2 Data Processing Scale
Across its UK and EU operations, NTP processes the personal data of a substantial number of data subjects. As of the date of this Response, the estimated data subject populations are as follows:
• Consumer subscribers: Approximately 6.3 million individuals across the UK and EU who hold NorthCloud consumer subscriptions or use NTP consumer telecommunications services.
• Enterprise clients: Approximately 42,000 enterprise organisations, the relevant contact persons of which constitute data subjects for the purposes of account management, billing, and service delivery.
• Employees: Approximately 11,400 employees across the Group, encompassing full-time, part-time, and fixed-term contract employees.
• Other data subjects: Approximately 28,000 individuals comprising contractors, temporary workers, job applicants, and visitors to NTP's websites and premises, whose personal data is processed in connection with recruitment, procurement, facility access, and web analytics.
In aggregate, NTP processes the personal data of approximately 6.38 million data subjects across its UK and EU operations. The total number of processing activities catalogued in the Group's Records of Processing Activities ("ROPA") stands at 147, broken down as follows: 89 processing activities in respect of UK operations and 58 processing activities in respect of EU operations. Of the 58 EU processing activities, Northgate Ireland Ltd accounts for 18 processing activities as the relevant establishment and controller or joint controller.
The Group has identified 14 processing activities involving special category data within the meaning of Article 9 of the EU GDPR. These relate principally to the processing of employee health data (occupational health assessments, sickness absence records, and disability accommodation requests), trade union membership data (for the purposes of payroll deduction and collective bargaining administration), and biometric data processed in connection with biometric access controls at certain NTP data centre and office facilities. Each of these processing activities has been assessed through the DPIA process described in Section 8 below.
2.3 Regulatory History
The Company considers it appropriate to provide the DPC with full transparency regarding NTP's prior regulatory engagement with data protection supervisory authorities.
On 15 September 2021, the ICO issued an Enforcement Notice to Northgate Telecommunications PLC under reference ENF/2021/0934 in respect of inadequate consent mechanisms for the deployment of direct marketing cookies on the NorthCloud customer portal. The Enforcement Notice was accompanied by a monetary penalty of £320,000. NTP accepted the findings of the ICO and paid the penalty in full. Remediation measures — including the deployment of a Consent Management Platform compliant with the Privacy and Electronic Communications Regulations 2003 ("PECR") and the ePrivacy Directive (Directive 2002/58/EC as amended) — were implemented and verified as complete by 31 March 2022. Confirmation of remediation was provided to the ICO and acknowledged by the Commissioner's office on 14 April 2022.
The ICO enforcement action, combined with the opening of the present DPC Inquiry in November 2022, prompted the NTP Board's Audit & Risk Committee to undertake a comprehensive review of the Group's data protection posture. On 8 December 2022, the Audit & Risk Committee passed a formal resolution mandating the engagement of external specialist counsel to design and implement a comprehensive GDPR compliance programme across NTP's UK and EU operations, with a target completion date of Q3 2023. The opening of this Inquiry was a key driver in the commissioning of the programme build, and the Board resolution specifically referenced the DPC's concerns regarding international data transfers as a priority area for remediation.
The engagement of Calderwood & Harkness LLP followed in February 2023, as described in Section 4 below.
3. Scope of the DPC Inquiry — Cross-Border Data Transfers from Northgate Ireland Ltd
3.1 Nature of the Inquiry
The DPC's preliminary inquiry, opened in November 2022 under reference IN-22-11-3, focuses on cross-border personal data transfers from Northgate Ireland Ltd to US-based data processors. The Inquiry was initiated in the period following the CJEU's landmark judgment in Schrems II, which invalidated the EU-US Privacy Shield framework and imposed enhanced obligations on data exporters to assess the adequacy of protection afforded to personal data in destination countries, even where Standard Contractual Clauses are relied upon as the transfer mechanism.
The specific concern raised by the DPC relates to the adequacy of the transfer mechanisms and supplementary measures implemented by Northgate Ireland Ltd for transfers of personal data from its Dublin operations to US-based data processors. The DPC's inquiry letter sought detailed information regarding the identity of the US-based recipients, the categories of personal data transferred, the transfer mechanisms relied upon, the assessments conducted of the laws and practices in the United States that may impinge upon the level of data protection, and the supplementary measures adopted to address any identified deficiencies.
Northgate Ireland acknowledges that, at the time the Inquiry was opened in November 2022, certain of its international data transfers were continuing to be made on the basis of legacy Standard Contractual Clauses (Commission Decision 2010/87/EU) that had not been updated to the new EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and that formal Transfer Impact Assessments had not yet been completed for all transfers. The Company further acknowledges that this represented a compliance gap that required urgent remediation, and the comprehensive programme described in this Response was designed to address these deficiencies in their entirety.
3.2 Transfers in Scope
In the course of preparing this Response, Northgate Ireland Ltd and its advisers have undertaken a comprehensive data mapping exercise to identify all transfers of personal data originating from Northgate Ireland Ltd to recipients in third countries (i.e., countries outside the European Economic Area that are not the subject of an adequacy decision by the European Commission, or — in respect of UK GDPR-regulated transfers — countries not designated as adequate by the Secretary of State under the DPA 2018). The following transfers have been identified and fall within the scope of the DPC's Inquiry:
Transfer 1: Northgate Ireland Ltd / NTP → Caldwell Analytics Inc. (United States)
Caldwell Analytics Inc. ("Caldwell") is a C-Corporation incorporated in the State of Delaware, United States of America, with its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134. Caldwell provides AI-driven network analytics and predictive maintenance services to telecommunications operators and enterprise technology companies. Caldwell processes pseudonymised subscriber analytics data on behalf of NTP under a Master Services Agreement dated 1 June 2021 (the "Caldwell MSA"). The categories of personal data transferred to Caldwell include pseudonymised subscriber metadata, location data (cell tower-level, not precise geolocation), and device identifiers (IMEI numbers, device model information). Direct subscriber identifiers (names, email addresses, telephone numbers) are pseudonymised prior to transfer through a tokenisation process, with the pseudonymisation keys retained within NTP's EEA data centres. This transfer is the subject of TIA-001 (described in Section 6.2 below) and DPIA-011 (described in Section 8.1 below).
Transfer 2: Northgate Ireland Ltd / NTP → Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd (India)
Pinnacle Cloud Services Ltd ("Pinnacle UK") is a UK-incorporated company (Company Number: 09142837) with its registered office at Apex House, 24 Victoria Embankment, London EC4Y 0DZ. Pinnacle UK provides managed infrastructure support services to NTP under a services agreement and acts as a data processor on behalf of NTP. Pinnacle UK engages its affiliated entity, Pinnacle India Pvt Ltd ("Pinnacle India") (CIN: U72200HR2016PTC065412, Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India), as a sub-processor to provide infrastructure support services. The data transferred to Pinnacle India includes infrastructure support data relating to NTP's network operations, which may include limited personal data elements such as IP addresses, system usernames, and device configuration data. This transfer is the subject of TIA-002 (described in Section 6.3 below).
Transfer 3: Northgate Ireland Ltd / NTP → Pinnacle Cloud Services Ltd → Pinnacle APAC Pte Ltd (Singapore)
Pinnacle UK also engages a further affiliated entity, Pinnacle APAC Pte Ltd ("Pinnacle Singapore") (UEN: 201824567K, 8 Marina View, #32-01 Asia Square Tower 1, Singapore 018960), as a sub-processor to provide infrastructure monitoring services. The categories of personal data and the nature of the processing are materially similar to those described in respect of Pinnacle India above. This transfer is the subject of TIA-003 (described in Section 6.4 below).
Transfer 4: Northgate Ireland Ltd / NTP → Sunderland-Hayes Payroll Services Inc. (United States)
Sunderland-Hayes Payroll Services Inc. ("Sunderland-Hayes") is a corporation incorporated in the State of Delaware, with its principal office at 1400 Broadway, Suite 2200, New York, New York 10018. Sunderland-Hayes provides expatriate payroll processing services for approximately 45 NTP employees who are seconded to or employed by NTP entities outside the United Kingdom and the EU. The categories of personal data transferred include employee names, addresses, national insurance numbers or equivalent tax identifiers, salary and benefits data, and bank account details. This transfer is the subject of TIA-004 (described in Section 6.5 below).
Transfer 5: Northgate Ireland Ltd / NTP → Moritaka Systems K.K. (Japan)
Moritaka Systems K.K. ("Moritaka") is a Japanese corporation with its principal office at Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan. Moritaka provides IoT analytics services in connection with NTP's connected-device platform, processing data from approximately 12,000 device endpoints (principally connected-vehicle telemetry devices). The transfer to Japan is covered by the European Commission's adequacy decision in respect of Japan (Commission Implementing Decision (EU) 2019/419 of 23 January 2019) and is therefore not subject to the requirement to implement transfer mechanisms under Article 46 of the EU GDPR. Nevertheless, NTP has conducted TIA-006 (described in Section 6.7 below) and has implemented supplementary measures as a belt-and-braces approach consistent with best practice.
For completeness, NTP notes that the transfer described as Transfer 5 from Northgate GmbH (Berlin) to Caldwell Analytics Inc. is not a transfer originating from Northgate Ireland Ltd. However, because it involves the same data importer and raises materially the same transfer mechanism and TIA considerations, it has been included in the scope of the compliance programme and is described at Section 6.6 below (TIA-005). NTP is prepared to address this transfer with the relevant supervisory authority (the Berlin Commissioner for Data Protection and Freedom of Information, Berliner Beauftragte für Datenschutz und Informationsfreiheit) should that authority initiate a corresponding inquiry.
4. Comprehensive GDPR Compliance Program Undertaken
4.1 Overview of the Program
As noted in Section 1 above, Calderwood & Harkness LLP was retained by Northgate Telecommunications PLC on 13 February 2023 under engagement reference SC/NTP/2023-0213/PDS. The engagement was scoped to deliver a comprehensive GDPR compliance programme covering the entirety of NTP's UK and EU operations, with a particular emphasis on the remediation of international data transfer mechanisms identified as a priority area following the DPC's Inquiry and the NTP Board Audit & Risk Committee's resolution of 8 December 2022.
The programme was completed on 8 September 2023, a total duration of 207 calendar days from the opening of the engagement to the delivery of the final work product. The programme was structured in five sequential phases, each with defined deliverables and milestone dates, as follows:
Phase 1 — Assessment & Gap Analysis: Comprehensive assessment of NTP's existing data protection posture against the requirements of the EU GDPR, UK GDPR, and applicable national implementing legislation, including identification of compliance gaps and prioritised remediation recommendations.
Phase 2 — ROPA & Data Mapping: Construction of a complete Record of Processing Activities in compliance with Article 30 of the EU GDPR, supported by detailed data mapping across all business units, systems, and data flows.
Phase 3 — Data Protection Impact Assessments: Completion of DPIAs for all processing activities identified as likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 35 of the EU GDPR.
Phase 4 — Transfer Mechanisms: Implementation of appropriate transfer mechanisms for all identified international data transfers, including execution of EU Standard Contractual Clauses, UK IDTAs, and UK Addenda, and completion of Transfer Impact Assessments with supplementary measures.
Phase 5 — Policies, Training & Governance: Development and implementation of a comprehensive suite of data protection policies, procedures, and governance documentation, together with training for the NTP Board, senior management, and operational staff.
The C&H engagement team comprised the following members:
• Kevin Ostrowski — Responsible Partner, Privacy & Data Security Practice Group
• Rachel Bernstein — Billing Partner, Privacy & Data Security Practice Group
• Sara Hendricks — Lead Associate, Privacy & Data Security Practice Group
• Priscilla Wynn — Working Associate, Privacy & Data Security Practice Group
Technical data mapping and the configuration of NTP's Sundial Solutions privacy management platform were supported by Ashdown Consulting Group Ltd ("Ashdown") (Company Number: 11293847, 15 Bedford Row, London WC1R 4BU), a specialist privacy engineering consultancy. The Ashdown engagement was led by Robert Fairclough, Managing Director, and Anita Chakravarti, Lead Privacy Engineer. Ashdown was responsible for distributing and processing data mapping questionnaires to NTP business units, configuring the Sundial Solutions platform to host the ROPA and DPIA registers, and providing ongoing technical support for the maintenance of these records.
4.2 Key Milestones Relevant to the Inquiry
The following table sets out the key milestones achieved during the programme that are directly relevant to the matters raised in the DPC's Inquiry:
The gap analysis report delivered on 31 March 2023 identified a total of 74 remediation items across NTP's UK and EU operations, classified by severity as follows: 12 critical items, 28 high-priority items, 22 medium-priority items, and 12 low-priority items. The absence of updated international data transfer mechanisms (EU SCCs in the form adopted under Commission Implementing Decision (EU) 2021/914) and formal Transfer Impact Assessments was classified as a critical remediation item, reflecting both the regulatory risk arising from the DPC Inquiry and the inherent compliance exposure associated with continued reliance on legacy Standard Contractual Clauses beyond the transition deadline of 27 December 2022.
All 12 critical remediation items and 28 high-priority remediation items have been fully addressed as of the date of this Response. The remaining medium- and low-priority items are subject to an ongoing implementation plan with target completion dates in Q4 2023 and Q1 2024 respectively.
5. Transfer Mechanisms Now in Place
5.1 EU Standard Contractual Clauses — NTP to Caldwell Analytics Inc.
EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "EU SCCs"), Module 2 (Controller to Processor), were executed between Northgate Telecommunications PLC (as data exporter and controller) and Caldwell Analytics Inc. (as data importer and processor) on 17 July 2023. A fully executed copy of the EU SCCs is attached at Annexure A.
The EU SCCs were negotiated between C&H (on behalf of NTP) and Caldwell's external counsel, Hargrove Lister & Webb LLP ("HLW"), a US law firm with offices at 555 Mission Street, Suite 3100, San Francisco, California 94105, and 30 Fenchurch Street, London EC3M 3BD. The principal contact at HLW was Natalie Prescott, Partner, Data Privacy & Cybersecurity Practice Group. Caldwell's internal stakeholders included Jennifer Huang (Vice President, Legal & Privacy) and Derek Rawlings (Chief Technology Officer).
The Annexes to the EU SCCs have been completed with the following NTP-specific details:
Annex I — Description of the Transfer:
Part A — List of Parties: Identifies Northgate Telecommunications PLC as the data exporter and controller, and Caldwell Analytics Inc. as the data importer and processor. Contact details, DPO information, and data protection registration details are provided for both parties.
Part B — Description of Transfer: The categories of data subjects are NorthCloud consumer subscribers located in the EEA. The categories of personal data transferred include pseudonymised subscriber metadata (tokenised subscriber identifiers), cell tower-level location data, device identifiers (IMEI numbers, device model and operating system information), and network performance metrics associated with individual subscriber sessions. Direct identifiers (subscriber names, email addresses, telephone numbers, postal addresses) are pseudonymised through a tokenisation process prior to transfer, with the pseudonymisation keys retained exclusively within NTP's EEA data centres. The purpose of the transfer is to enable Caldwell to perform AI-driven network analytics and predictive maintenance services under the Caldwell MSA. The frequency of the transfer is continuous, via automated API feeds. The period of retention is 18 months from the date of ingestion, after which data is irreversibly deleted.
Part C — Competent Supervisory Authority: The Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland, is identified as the competent supervisory authority.
Annex II — Technical and Organisational Measures:
The following technical and organisational measures are specified in Annex II and have been implemented by Caldwell:
• Encryption at rest using AES-256 encryption for all personal data stored in Caldwell's infrastructure
• Encryption in transit using TLS 1.3 for all data flows between NTP and Caldwell
• Pseudonymisation of direct identifiers prior to transfer, as described above
• Logical access controls implementing the principle of least privilege, with multi-factor authentication required for all access to environments containing NTP personal data
• Role-based access control with quarterly access reviews
• Comprehensive audit logging of all access to, and operations on, NTP personal data, with logs retained for a minimum of 24 months
• Physical security controls at Caldwell's data centre facilities (SOC 2 Type II certified)
• Incident response procedures with defined escalation pathways and notification timelines aligned with the breach notification provisions of the EU SCCs and the DPA
• Annual penetration testing conducted by a qualified independent third party
• Employee background checks and confidentiality agreements for all Caldwell personnel with access to NTP personal data
Annex III — List of Sub-processors:
Annex III identifies Caldwell's approved sub-processors, including the identity, registered address, and description of processing for each sub-processor. Caldwell's obligation to notify NTP of any intended changes to the list of sub-processors, with a minimum notification period of 14 days, is set out in Clause 9 of the EU SCCs and the corresponding provisions of the Caldwell DPA.
5.2 UK International Data Transfer Agreement — NTP to Caldwell Analytics Inc.
Simultaneously with the execution of the EU SCCs described in Section 5.1, a UK International Data Transfer Agreement (the "UK IDTA") was executed between Northgate Telecommunications PLC (as data exporter and controller) and Caldwell Analytics Inc. (as data importer and processor) on 17 July 2023. The UK IDTA was adopted in the form approved by the ICO and laid before Parliament on 2 February 2022, and entered into pursuant to Section 119A of the Data Protection Act 2018. A fully executed copy of the UK IDTA is attached at Annexure B.
The UK IDTA complements the EU SCCs and provides the transfer mechanism for transfers of personal data that are subject to the UK GDPR rather than (or in addition to) the EU GDPR. The mandatory tables at Parts 1 through 4 of the UK IDTA have been completed with NTP-specific details, mirroring the information provided in the Annexes to the EU SCCs where applicable and adapting the supervisory authority references, legal bases, and other jurisdiction-specific details for the UK GDPR context.
5.3 Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd
An amended and restated Data Processing Agreement (the "Pinnacle DPA") was executed on 28 June 2023 between Northgate Telecommunications PLC (as controller) and Pinnacle Cloud Services Ltd (as processor). The Pinnacle DPA supersedes and replaces all prior data processing terms between the parties, including the legacy data processing provisions incorporated in the original managed services agreement dated 14 March 2018.
The Pinnacle DPA has been updated to fully incorporate the requirements of Article 28 of the EU GDPR and the corresponding provisions of the UK GDPR, including the following key provisions:
(a) Subject matter, duration, nature and purpose of processing: The Pinnacle DPA specifies the subject matter, duration, nature and purpose of the processing, the types of personal data processed, and the categories of data subjects, in compliance with Article 28(3) of the EU GDPR.
(b) Sub-processor approval mechanism: Pinnacle UK is required to obtain NTP's prior specific written authorisation before engaging any sub-processor. The Pinnacle DPA incorporates a sub-processor approval mechanism that requires Pinnacle UK to notify NTP of any intended addition of or change to sub-processors with a minimum notification period of 14 calendar days, providing NTP with the opportunity to object. The approved sub-processor list includes Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd.
(c) International transfer provisions: The Pinnacle DPA incorporates EU SCCs Module 3 (Processor to Sub-processor) to govern transfers from Pinnacle UK to its sub-processors in India and Singapore. The UK Addendum (described in Section 5.4 below) is appended to the EU SCCs to cover transfers of UK personal data.
(d) Audit rights: NTP retains the contractual right to conduct audits of Pinnacle UK and its sub-processors, including on-site inspections with reasonable notice (not less than 30 calendar days), to verify compliance with the Pinnacle DPA and applicable data protection laws.
(e) Breach notification: Pinnacle UK is required to notify NTP of any personal data breach without undue delay and in any event within 36 hours of becoming aware of the breach, providing sufficient information to enable NTP to comply with its own notification obligations under Articles 33 and 34 of the EU GDPR.
(f) Data deletion and return: Upon termination or expiry of the services agreement, Pinnacle UK is required to return or irreversibly delete all personal data processed on behalf of NTP, at NTP's election, within 30 calendar days, and to provide written certification of deletion.
The Pinnacle DPA was negotiated with Graham Alderton, Head of Legal, Cloud Services Division, Pinnacle Cloud Services Ltd. A fully executed copy of the amended and restated Pinnacle DPA is attached at Annexure E.
5.4 UK Addendum to EU SCCs
For four transfers where both the UK GDPR and the EU GDPR regimes apply to the personal data in scope, NTP has adopted the ICO-approved UK Addendum to the EU Standard Contractual Clauses under Section 119A of the Data Protection Act 2018 (the "UK Addendum"). The UK Addendum supplements the EU SCCs by incorporating the modifications necessary to ensure that the SCCs provide appropriate safeguards for the purposes of UK GDPR Article 46(2)(c). The UK Addendum has been executed in conjunction with the relevant EU SCCs for each of the four transfers concerned.
5.5 Adequacy Decisions Relied Upon
Two of the international data transfers identified in Section 3.2 are to countries in respect of which the European Commission has adopted an adequacy decision under Article 45 of the EU GDPR:
(a) Japan — Moritaka Systems K.K.: The European Commission adopted an adequacy decision in respect of Japan on 23 January 2019 (Commission Implementing Decision (EU) 2019/419). NTP relies on this adequacy decision as the legal basis for the transfer of IoT analytics data to Moritaka Systems K.K. in Tokyo. Notwithstanding the adequacy decision, NTP has conducted TIA-006 and has implemented supplementary measures as an additional safeguard, consistent with the belt-and-braces approach recommended by C&H and described further in Section 6.7 below.
(b) Canada — PIPEDA-covered organisations: NTP has identified one minor transfer to a Canadian service provider covered by the Personal Information Protection and Electronic Documents Act ("PIPEDA"), which is the subject of a European Commission adequacy decision (Commission Decision 2002/2/EC of 20 December 2001, as maintained). This transfer is of de minimis volume and is not directly relevant to the DPC's Inquiry, which focuses on US-based processors. It is mentioned here for completeness.
5.6 Summary Table of Transfer Mechanisms
The following table summarises all international data transfers originating from Northgate Ireland Ltd and other NTP entities within scope, together with the transfer mechanisms in place for each:
6. Transfer Impact Assessments
6.1 Overview of TIA Methodology
NTP, with the assistance of C&H, completed six Transfer Impact Assessments ("TIAs") between 10 July 2023 and 4 August 2023. The TIAs were conducted in respect of all international data transfers identified in Section 3.2 and summarised in Section 5.6 above.
The methodology applied for the TIAs is based on the European Data Protection Board's Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, as adopted in their final version on 18 June 2021 ("EDPB Recommendations 01/2020"), and the ICO's international transfer risk assessment and tool guidance published in connection with the UK GDPR transfer provisions. The TIA methodology involves the following sequential steps:
Step 1 — Know your transfer: Identify and document the transfer, including the data exporter and data importer, the categories of personal data transferred, the purposes of the transfer, the transfer mechanism relied upon, and the onward transfer chain (if applicable).
Step 2 — Identify the transfer tool relied upon: Confirm the specific Article 46 GDPR transfer mechanism (or Article 45 adequacy decision) that provides the legal basis for the transfer.
Step 3 — Assess the laws and practices of the destination country: Conduct a detailed assessment of the laws and practices in the destination country that may impinge upon the effectiveness of the appropriate safeguards provided by the transfer tool. This assessment considers, inter alia, the scope and application of government surveillance and access powers, the existence of independent oversight mechanisms, the availability of effective legal remedies for data subjects, and any relevant international commitments of the destination country.
Step 4 — Identify and adopt supplementary measures: Where the assessment in Step 3 identifies that the laws or practices of the destination country may undermine the level of protection afforded to the transferred personal data, identify and implement supplementary technical, organisational, and contractual measures to bring the level of protection up to the EU standard.
Step 5 — Procedural steps: Ensure that any procedural steps required by the applicable transfer mechanism or by the competent supervisory authority have been taken (e.g., notification to or authorisation by the supervisory authority, where required).
Step 6 — Re-evaluate at appropriate intervals: Establish mechanisms for ongoing monitoring and periodic reassessment of the TIA, including triggers for reassessment upon material changes in the laws or practices of the destination country.
Each TIA was prepared by C&H and reviewed by Sanjay Mehta (DPO), Thomas Okoye (CISO), and the relevant business unit stakeholders. The TIAs are maintained in NTP's Sundial Solutions privacy management platform and are subject to annual review, with additional reassessment triggered by material changes in the legal framework of the destination country (e.g., legislative amendments, court judgments, or supervisory authority guidance).
6.2 TIA-001: NTP → Caldwell Analytics Inc. (United States)
TIA-001 assesses the transfer of pseudonymised subscriber analytics data from NTP (on behalf of Northgate Ireland Ltd) to Caldwell Analytics Inc. in the United States. A copy of TIA-001 is attached at Annexure C.
The TIA includes a detailed assessment of the US legal framework relevant to government access to personal data held by private sector entities, with particular focus on the following legislative and executive instruments:
(a) Section 702 of the Foreign intelligence Surveillance Act ("FISA"): Section 702 authorises the US government to compel electronic communication service providers to provide access to the communications of non-US persons located outside the United States for foreign intelligence purposes. The TIA assesses whether Caldwell falls within the definition of "electronic communication service provider" under 50 U.S.C. § 1881(b)(4) and, if so, the scope and nature of potential government access to NTP personal data.
(b) Executive Order 12333: The TIA considers the scope of signals intelligence collection activities conducted by US intelligence agencies under the authority of Executive Order 12333, which governs intelligence activities conducted outside the framework of FISA and may not be subject to the same judicial oversight mechanisms.
(c) The Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"): The TIA assesses the implications of the CLOUD Act (enacted 23 March 2018), which amends the Stored Communications Act to clarify that US law enforcement authorities may compel US-based service providers to disclose data within their possession, custody, or control, regardless of whether the data is stored within or outside the United States.
(d) The EU-US Data Privacy Framework: The TIA notes the European Commission's adoption of an adequacy decision in respect of the EU-US Data Privacy Framework ("DPF") on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795). The TIA assesses the relevance of the DPF to the NTP-Caldwell transfer, noting that Caldwell is not currently certified under the DPF. The TIA nevertheless considers the broader safeguards introduced pursuant to Executive Order 14086 of 7 October 2022 on Enhancing Safeguards for United States signals intelligence Activities, which apply to all transfers of personal data to the United States, regardless of whether the data importer is DPF-certified.
The TIA evaluates Caldwell's specific exposure to US government access requests based on the nature of the data processed (pseudonymised subscriber analytics data rather than communications content), Caldwell's business profile (a network analytics company with FY 2022 revenue of approximately $312 million and approximately 1,800 employees, operating primarily in the commercial telecommunications sector), and the absence of any known prior government access requests received by Caldwell in respect of NTP data.
Conclusion of TIA-001: The assessment concludes that, while the US legal framework identified above presents a theoretical risk to the level of protection afforded to transferred personal data, the combination of the following supplementary measures reduces the residual risk to an acceptable level:
• AES-256 encryption at rest for all NTP personal data held in Caldwell's infrastructure
• TLS 1.3 encryption in transit for all data flows between NTP and Caldwell
• Pseudonymisation of direct identifiers (subscriber names, contact details) prior to transfer, with pseudonymisation keys retained exclusively within NTP's EEA data centres, rendering the data unintelligible to any party (including a government authority) without access to the keys
• Contractual audit rights enabling NTP to verify Caldwell's compliance with the technical and organisational measures
• Contractual obligation on Caldwell to notify NTP of any government access request (unless legally prohibited from doing so), to challenge disproportionate or unlawful requests, and to provide the minimum necessary disclosure
• Data localisation for certain categories of sensitive data and raw subscriber identity data, which are retained within EEA data centres and not transferred
TIA-001 has a direct nexus with DPIA-011 (Caldwell Analytics Network Performance Data Transfer), which is classified as high-risk and is described in Section 8.1 below.
6.3 TIA-002: Pinnacle → Pinnacle India Pvt Ltd (India)
TIA-002 assesses the transfer of infrastructure support data from Pinnacle Cloud Services Ltd (as NTP's processor) to Pinnacle India Pvt Ltd in India. A copy of TIA-002 is attached at Annexure F.
The TIA includes an assessment of the Indian legal framework relevant to government access to personal data, with particular focus on the following:
(a) The Information Technology Act 2000 ("IT Act"): The IT Act provides the overarching framework for the regulation of electronic data and digital communications in India. The TIA considers the government access powers conferred by the IT Act, particularly Section 69 (power to issue directions for interception, monitoring, or decryption of any information through any computer resource) and Section 69B (power to authorise government agencies to monitor and collect traffic data or information through any computer resource for cyber security purposes).
(b) The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"): The TIA assesses the security standards imposed on entities processing sensitive personal data or information in India, including the requirement to implement reasonable security practices and procedures.
(c) The Indian Telegraph Act 1885: The TIA considers the interception powers available to the Indian government under Section 5(2) of the Indian Telegraph Act, which authorises the interception of messages in the interests of the sovereignty and integrity of India, the security of the State, public order, or the prevention of incitement to the commission of an offence.
(d) The Digital Personal Data Protection Act 2023: The TIA notes that the Digital Personal Data Protection Act 2023 was enacted on 11 August 2023 but is not yet in force as of the date of this TIA. The TIA will be reassessed upon the commencement of the Act and the promulgation of subordinate rules.
Conclusion of TIA-002: The assessment concludes that supplementary measures are required to ensure that the level of protection afforded to NTP personal data transferred to India is not undermined by Indian government access powers. The supplementary measures implemented include encryption at rest and in transit, contractual restrictions on Pinnacle India's use of the data, access controls limiting Pinnacle India personnel's access to NTP data to the minimum necessary for the provision of the services, and government access request notification and challenge protocols.
6.4 TIA-003: Pinnacle → Pinnacle APAC Pte Ltd (Singapore)
TIA-003 assesses the transfer of infrastructure monitoring data from Pinnacle Cloud Services Ltd to Pinnacle APAC Pte Ltd in Singapore. A copy of TIA-003 is attached at Annexure G.
The TIA includes an assessment of the Singapore legal framework under the Personal Data Protection Act 2012 ("PDPA"), as amended, and the government access powers available under Singapore law, including powers under the Computer Misuse Act and the Telecommunications Act. The TIA notes that Singapore maintains a generally high level of data protection and has established the Personal Data Protection Commission as an independent supervisory body.
Conclusion of TIA-003: The assessment concludes that, while the Singapore legal framework presents a lower risk profile compared to some other jurisdictions, supplementary measures have been implemented for consistency and in compliance with the EDPB Recommendations 01/2020. These include encryption, access controls, and the contractual provisions incorporated in the Pinnacle DPA and EU SCCs Module 3.
6.5 TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (United States)
TIA-004 assesses the transfer of expatriate payroll data from NTP to Sunderland-Hayes Payroll Services Inc. in the United States. A copy of TIA-004 is attached at Annexure H.
The US legal framework analysis is consistent with that conducted in TIA-001. However, the TIA notes the following distinguishing factors: the volume of personal data transferred is limited (approximately 45 data subjects), the categories of personal data — while including financial and tax information — do not include the types of communications metadata or subscriber data that are the primary targets of the US government surveillance powers identified in TIA-001, and the payroll processing relationship is a routine commercial arrangement that does not, in NTP's assessment, elevate Sunderland-Hayes' exposure to government access requests.
Conclusion of TIA-004: The assessment concludes that the supplementary measures implemented — including encryption, access controls, and contractual provisions — are proportionate to the limited volume and sensitivity of the data transferred.
6.6 TIA-005: NTP GmbH → Caldwell Analytics Inc. (United States)
TIA-005 assesses the transfer of German subscriber analytics data from Northgate GmbH (Friedrichstraße 91, 10117 Berlin; HRB 214503 B, Amtsgericht Charlottenburg) to Caldwell Analytics Inc. in the United States. A copy of TIA-005 is attached at Annexure D.
The TIA builds upon the US legal framework analysis conducted in TIA-001 and incorporates additional considerations specific to the German regulatory context. In particular, the TIA takes account of the guidance published by the German Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, "BfDI") regarding the requirements for international data transfers from Germany, including the BfDI's position on the application of supplementary measures following Schrems II. The TIA also considers the specific provisions of the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG") and the Telecommunications-Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz, "TTDSG") that may impose additional requirements on the transfer of subscriber data.
Conclusion of TIA-005: The assessment concludes that the supplementary measures described in TIA-001 are equally applicable to the Northgate GmbH transfer and are sufficient to reduce the residual risk to an acceptable level. No additional Germany-specific supplementary measures were identified as necessary beyond those already in place.
6.7 TIA-006: NTP → Moritaka Systems K.K. (Japan)
TIA-006 assesses the transfer of IoT platform analytics data from NTP to Moritaka Systems K.K. in Japan. A copy of TIA-006 is attached at Annexure I.
As noted in Section 5.5 above, the transfer to Japan is covered by the European Commission's adequacy decision (Commission Implementing Decision (EU) 2019/419 of 23 January 2019). Accordingly, no Article 46 GDPR transfer mechanism is required, and the transfer may proceed on the basis of Article 45 GDPR. Nevertheless, NTP has elected to conduct a TIA and implement supplementary measures as an additional safeguard, consistent with a belt-and-braces approach and best practice recommendations.
The data transferred to Moritaka comprises IoT analytics data from approximately 12,000 connected-vehicle telemetry endpoints. This data includes device identifiers, vehicle telematics data (speed, location, engine diagnostics), and pseudonymised driver/user identifiers.
Conclusion of TIA-006: The assessment concludes that the Japanese legal framework provides an adequate level of protection, as recognised by the European Commission's adequacy decision. The supplementary measures implemented — including encryption, access controls, and data minimisation — provide an additional layer of protection that further reduces any residual risk.
7. Supplementary Measures Implemented
7.1 Technical Measures
In accordance with the EDPB Recommendations 01/2020 and the conclusions of the six TIAs described in Section 6 above, NTP has implemented the following technical supplementary measures across all international data transfers within scope:
Encryption at Rest: All personal data stored by US-based processors (Caldwell Analytics Inc. and Sunderland-Hayes Payroll Services Inc.) is encrypted at rest using AES-256 encryption. Encryption keys are managed by the respective processors in accordance with industry-standard key management practices (NIST SP 800-57 recommendations) and are subject to NTP's contractual audit rights. NTP has assessed whether it would be feasible for NTP to retain sole control of encryption keys and has concluded that, for the Caldwell transfer, the pseudonymisation of direct identifiers prior to transfer (with pseudonymisation keys retained within the EEA) achieves an equivalent or superior level of protection, as it renders the data unintelligible to any party — including Caldwell itself and any government authority — without access to the pseudonymisation keys held by NTP in the EEA.
Encryption in Transit: All data flows between NTP/Northgate Ireland Ltd and third-country processors are encrypted in transit using TLS 1.3. NTP's network security team has verified that all API endpoints and data transfer channels are configured to reject connections using earlier TLS versions or deprecated cipher suites. Certificate pinning is implemented for the Caldwell API integration to prevent man-in-the-middle attacks.
Pseudonymisation: Direct identifiers — including subscriber names, email addresses, postal addresses, and telephone numbers — are pseudonymised through a tokenisation process before any personal data is transferred to Caldwell Analytics Inc. The pseudonymisation is performed within NTP's EEA infrastructure (Dublin data centre), and the pseudonymisation keys (the lookup tables that map tokens to direct identifiers) are retained exclusively within NTP's EEA data centres and are not accessible to Caldwell or any other third-country recipient. Only pseudonymised keys, device identifiers, and metadata are transferred. This measure is a central element of NTP's supplementary safeguard strategy, as it means that the data held by Caldwell cannot, on its own, be attributed to an identified natural person without access to the pseudonymisation keys that remain under NTP's sole control within the EEA.
Data Localisation: Certain categories of data are not transferred to third countries under any circumstances. Specifically, special category data within the meaning of Article 9 of the EU GDPR (including employee health data, trade union membership data, and biometric data) and raw subscriber identity data (un-pseudonymised subscriber records) are retained within NTP's EEA data centres (Dublin, Frankfurt, and Amsterdam) and are not transferred to, or accessible from, any third-country location. This data localisation policy is enforced through network segmentation and access control configurations that have been verified by Thomas Okoye, CISO.
7.2 Organisational Measures
Contractual Audit Rights: NTP retains contractual rights to audit Caldwell Analytics Inc. and Pinnacle Cloud Services Ltd (including its sub-processors, Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd), in order to verify compliance with the technical and organisational measures specified in the EU SCCs, the DPA, and the TIAs. Audit rights include the right to conduct on-site inspections of the processor's and sub-processor's facilities with reasonable notice (not less than 30 calendar days for routine audits). NTP may exercise its audit rights directly or through an independent third-party auditor engaged at NTP's expense. The first round of audits is scheduled for Q1 2024.
Government Access Request Protocols: Each of the transfer mechanisms includes contractual provisions requiring the data importer to notify NTP promptly of any government access request (including requests under FISA Section 702, the CLOUD Act, national security letters, or equivalent instruments under the laws of the destination country), unless legally prohibited from providing such notification. In the event that notification is legally prohibited, the data importer is required to use its best efforts to obtain a waiver of the prohibition and to challenge the government access request through available legal channels where the request is assessed as disproportionate or unlawful. The data importer is further required to provide the minimum necessary disclosure in response to any government access request and to document all such requests and responses for NTP's review.
Personnel Security: All processor and sub-processor personnel with access to NTP personal data are subject to pre-employment background checks (or equivalent vetting procedures) appropriate to the nature of the data accessed and the laws of the relevant jurisdiction. Additionally, all such personnel are required to execute individual confidentiality agreements or are bound by contractual confidentiality obligations that survive the termination of their employment or engagement.
7.3 Contractual Measures
The contractual framework for NTP's international data transfers has been comprehensively updated as part of the compliance programme. The key contractual measures now in place are as follows:
(a) EU SCCs Module 2 (Controller to Processor): Executed between NTP and Caldwell Analytics Inc. (17 July 2023) and between NTP and Sunderland-Hayes Payroll Services Inc. (17 July 2023), with full Annexes I, II, and III completed as described in Section 5.1 above.
(b) EU SCCs Module 3 (Processor to Sub-processor): Incorporated in the Pinnacle DPA to govern transfers from Pinnacle UK to Pinnacle India and Pinnacle Singapore.
(c) UK IDTA: Executed between NTP and Caldwell Analytics Inc. (17 July 2023) and between NTP and Sunderland-Hayes Payroll Services Inc. (17 July 2023).
(d) UK Addendum: Appended to the EU SCCs for four transfers where both UK GDPR and EU GDPR regimes apply.
(e) Amended DPAs: Incorporating Article 28 GDPR requirements, including sub-processor approval mechanisms (14-day notification period for intended changes to sub-processor lists), breach notification obligations (without undue delay and in any event within 36 hours), data deletion and return provisions, and audit rights.
The contractual framework ensures that all international data transfers are supported by enforceable commitments from data importers to maintain the technical and organisational measures specified in the TIAs and to cooperate with NTP and the competent supervisory authority in the event of any investigation or enforcement action.
8. Data Protection Impact Assessments Relevant to Cross-Border Transfers
8.1 DPIA-011: Caldwell Analytics Network Performance Data Transfer
DPIA-011 addresses the processing of NorthCloud subscriber analytics data by Caldwell Analytics Inc. in connection with AI-driven network analytics and predictive maintenance services. A copy of DPIA-011 is attached at Annexure J.
DPIA-011 was classified as high-risk on the basis of the following factors:
(a) The processing involves the large-scale transfer of personal data to a third country (the United States) that is not the subject of an adequacy decision by the European Commission (noting that, while the EU-US Data Privacy Framework was adopted on 10 July 2023, Caldwell is not DPF-certified);
(b) The processing involves profiling activities, in that Caldwell's AI-driven analytics platform analyses patterns in subscriber usage data to generate predictive models for network performance and maintenance, which may constitute the automated processing of personal data to evaluate certain aspects relating to a natural person (subscriber behaviour patterns, service usage characteristics);
(c) The transfer is subject to the US government surveillance risks identified in TIA-001, including the potential application of FISA Section 702 and Executive Order 12333.