PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT / LEGALLY PRIVILEGED
CALDERWOOD & HARKNESS LLP
One Moorgate Square, London EC2R 6AN
ENGAGEMENT CLOSING MEMORANDUM
8 September 2023
TO: Kevin Ostrowski, Responsible Partner, Privacy & Data Security
FROM: Sara Hendricks, Lead Associate, Privacy & Data Security
RE: Engagement Closing — GDPR Compliance Program Build for Northgate Telecommunications PLC
Engagement Reference: SC/NTP/2023-0213/PDS
Status: Approved by Kevin Ostrowski on 8 September 2023
Classification: Attorney Work Product / Legally Privileged
This memorandum is prepared by Calderwood & Harkness LLP for internal use only. It constitutes attorney work product and is protected by legal professional privilege. It is not intended for distribution to the client or any third party without the prior written authorisation of the Responsible Partner.
Right-click to update Table of Contents
1. Purpose and Executive Summary
The purpose of this memorandum is to formally document the closure of engagement SC/NTP/2023-0213/PDS and to provide a comprehensive record of the work performed, deliverables produced, fees incurred, and outstanding items arising from the GDPR compliance program build undertaken by Calderwood & Harkness LLP ("C&H" or the "Firm") for Northgate Telecommunications PLC ("NTP" or the "Client"). This memorandum summarises all deliverables produced across the five phases of the engagement, confirms completion status for each phase, reconciles fees against the agreed engagement fee caps, and identifies outstanding items requiring NTP's ongoing attention following engagement closure.
Engagement SC/NTP/2023-0213/PDS was opened on 13 February 2023 pursuant to an engagement letter signed on that date by Fiona Gallagher, General Counsel & Company Secretary of NTP. The engagement letter established the scope, fee arrangements, and phased delivery structure for a comprehensive GDPR compliance program build across NTP's United Kingdom and European Union operations, encompassing the parent company and five EU subsidiaries.
The engagement was completed and is formally closed as of 8 September 2023, representing a total duration of 207 calendar days from opening to closure. All five phases of the engagement were completed within the agreed timelines and the total engagement fees billed of £817,450 remain within the total engagement fee cap of £850,000, representing a variance of £32,550 under the cap. No individual phase exceeded its respective phase-level fee cap.
The key outputs of the engagement are as follows:
• 147 processing activities catalogued across NTP's United Kingdom operations (89 activities) and EU subsidiary operations (58 activities) in a comprehensive Article 30 GDPR Records of Processing Activities;
• 11 Data Protection Impact Assessments completed, of which 5 were classified as high-risk and required detailed mitigation plans, including a recommendation — accepted by the NTP Board on 14 June 2023 — to discontinue a facial recognition pilot at Northgate Tower;
• 6 Transfer Impact Assessments completed covering cross-border data transfers to the United States, India, Singapore, and Japan;
• A comprehensive policy suite delivered, including a Group Data Protection Policy, Data Subject Rights Procedure, Data Breach Notification Procedure, Data Retention Schedule, and revised consumer privacy notice;
• Board-level GDPR training delivered on 22 August 2023 at Northgate Tower, London; and
• A comprehensive DPC inquiry response (IN-22-11-3) drafted and submitted on 4 September 2023, addressing the Data Protection Commission's (Ireland) preliminary inquiry regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors.
The balance of this memorandum provides detailed information concerning the client and engagement background, the fee arrangement and financial reconciliation, a phase-by-phase summary of all deliverables, the DPC inquiry response, a complete deliverables index, open items and ongoing obligations, and engagement closure confirmation.
2. Client and Engagement Overview
2.1 Client Details
The Client's full details are set out below for the record of the engagement file.
NTP operates a mixed business model combining traditional telecommunications infrastructure services with a growing enterprise SaaS division operating under the "NorthCloud" brand. The NorthCloud platform provides cloud-based communications, collaboration, and data analytics services to approximately 42,000 enterprise clients, alongside consumer telecommunications services to approximately 6.3 million subscribers. NTP's data processing operations are substantial in scale and complexity, processing personal data relating to approximately 6.38 million data subjects across its consumer subscriber base, enterprise client contacts, workforce (including employees, contractors, temporary workers, and job applicants), and website visitors.
The key client contacts throughout the engagement were as follows:
• Fiona Gallagher — General Counsel & Company Secretary, NTP PLC. Ms Gallagher served as the primary legal sponsor of the engagement and the authorised signatory on the engagement letter. She was the principal recipient of all final deliverables and the signatory on the Handover & Ongoing Obligations Summary Letter at engagement closure.
• Sanjay Mehta — Data Protection Officer, NTP PLC. Mr Mehta served as the day-to-day operational contact for data protection matters throughout the engagement. He coordinated access to business unit stakeholders and internal documentation, facilitated the data mapping exercise, and was the signatory on the DPC inquiry response cover letter dated 4 September 2023.
• Thomas Okoye — Chief Information Security Officer, NTP PLC. Mr Okoye provided technical security input for the DPIAs and Transfer Impact Assessments, particularly in relation to supplementary technical measures (encryption standards, pseudonymisation protocols, and access controls).
• Laura Dearden — Vice President, Product & Engineering, NorthCloud. Ms Dearden provided product-specific input for the DPIAs relating to NorthCloud processing activities, including DPIA-001 (AI-driven customer churn prediction model), DPIA-007 (marketing profiling and targeted advertising), and DPIA-011 (Caldwell Analytics network performance data transfer).
• Philippa Crane — Head of People & HR, NTP PLC. Ms Crane provided input for HR-related processing activities in the ROPA, the employee wellbeing monitoring platform DPIA (DPIA-003), and the Data Retention Schedule as it relates to employee records.
• Marcus Engström — Head of EU Operations, Dublin. Mr Engström coordinated input from the five EU subsidiaries and served as the primary liaison for matters relating to the DPC inquiry.
2.2 NTP Subsidiaries in Scope
The engagement encompassed NTP PLC and five EU subsidiaries. The subsidiaries within scope are detailed below:
Each subsidiary operates as a controller in its own right for certain locally-determined processing activities, while also acting as a processor or joint controller with NTP PLC for group-wide processing operations including centrally managed HR systems, group-wide IT infrastructure, and NorthCloud platform services. The ROPA and DPIAs addressed the full range of controller and processor relationships across the NTP group.
2.3 Engagement Background and Mandate
The engagement arose from a resolution of the NTP Board Audit & Risk Committee dated 8 December 2022. The Board resolution mandated a comprehensive GDPR compliance program build with external counsel, to be completed by the end of Q3 2023 (30 September 2023). The Board's decision was informed by several factors requiring immediate and sustained attention.
ICO Enforcement History. NTP was the subject of an ICO Enforcement Notice (reference ENF/2021/0934) dated 15 September 2021, which imposed a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal. The ICO found that NTP's cookie consent banner failed to meet the requirements of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) and that NTP's reliance on implied consent for analytics and advertising cookies was non-compliant with Article 6(1)(a) of the UK GDPR. NTP completed the required remediation measures by March 2022, but the enforcement action highlighted broader gaps in NTP's compliance infrastructure and served as a catalyst for the Board Audit & Risk Committee's decision to commission a full program build.
DPC Preliminary Inquiry. In November 2022, the Data Protection Commission (Ireland) opened a preliminary inquiry (reference IN-22-11-3) regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors in the wake of the Court of Justice of the European Union's decision in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II"). The DPC's inquiry focused on the adequacy of transfer mechanisms relied upon by Northgate Ireland Ltd for transfers to Caldwell Analytics Inc. (a US-based network analytics provider) and the sub-processing arrangements under NTP's agreement with Pinnacle Cloud Services Ltd (a UK-based cloud infrastructure provider whose sub-processors include entities in India and Singapore). The inquiry created significant urgency around the remediation of international transfer mechanisms and was a principal driver of the phased approach adopted for this engagement.
Data Processing Scale. NTP's data processing operations are extensive. Across all entities in scope, NTP processes personal data relating to approximately 6.38 million data subjects, comprising approximately 6.3 million consumer subscribers, 42,000 enterprise clients, 11,400 employees, and approximately 28,000 additional data subjects including contractors, temporary workers, job applicants, and website visitors. The scale, diversity, and cross-border nature of NTP's processing activities warranted a comprehensive, structured compliance program build rather than a piecemeal remediation approach.
Against this background, C&H was engaged to deliver a five-phase GDPR compliance program build encompassing: (1) assessment and gap analysis; (2) Records of Processing Activities and data mapping; (3) Data Protection Impact Assessments; (4) international data transfer mechanisms; and (5) policies, governance, and training. The engagement was structured to address NTP's most pressing regulatory exposure — the DPC inquiry and international transfer mechanisms — within the phased framework while simultaneously building the foundational compliance infrastructure required for sustainable ongoing compliance.
2.4 Engagement Team
The C&H engagement team comprised the following individuals:
• Kevin Ostrowski — Responsible Partner, Privacy & Data Security. Mr Ostrowski is a solicitor admitted in 2005 with 18 years' experience in data protection and privacy law. He served as the Responsible Partner with overall accountability for the quality and completeness of the engagement, attended key client meetings and Board presentations, and reviewed and approved all high-risk deliverables including the DPIA reports, Transfer Impact Assessments, and the DPC inquiry response.
• Rachel Bernstein — Billing Partner, Privacy & Data Security. Ms Bernstein is a solicitor admitted in 2008 and is also admitted in the State of New York. She has particular expertise in cross-border data transfers and telecommunications regulation. Ms Bernstein served as the billing partner with responsibility for fee management and client billing. She was also substantively involved in the drafting and negotiation of the international transfer mechanism documentation (Phase 4) and co-drafted the DPC inquiry response with Sara Hendricks.
• Sara Hendricks — Lead Associate, Privacy & Data Security. Ms Hendricks is a solicitor admitted in 2017 with 6 years' post-qualification experience. She holds CIPP/E (Certified Information Privacy Professional / Europe) and CIPM (Certified Information Privacy Manager) certifications from the International Association of Privacy Professionals. Ms Hendricks served as the lead associate with day-to-day management responsibility for the engagement, including coordination of deliverable production, client communications, and supervision of working-level team members. She was the principal drafter of the ROPA, DPIAs, policy suite, and the DPC inquiry response.
• Priscilla Wynn — Working Associate, Privacy & Data Security. Ms Wynn is a solicitor admitted in 2020 with 3 years' post-qualification experience and specialist expertise in ROPA development and data mapping. Ms Wynn assisted with the data mapping questionnaire design and distribution, ROPA compilation, and the preparation of the Legitimate Interest Assessment template. She also provided research support for the UK GDPR versus EU GDPR divergence memorandum and the regulatory monitoring component of the gap analysis.
2.5 Key Third Parties Engaged During the Matter
The following third parties were engaged or consulted during the course of the engagement:
Ashdown Consulting Group Ltd (Company Number: 11293847; registered address: 15 Bedford Row, London WC1R 4BU). Ashdown was engaged directly by NTP (not through C&H) to provide privacy engineering services, technical data mapping support, and Sundial Solutions platform configuration. Ashdown's work ran in parallel with C&H's legal workstreams, with C&H providing legal oversight and quality assurance over the data mapping outputs and ROPA configuration within Sundial Solutions. The primary contacts at Ashdown were Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer). C&H coordinated closely with both individuals throughout Phases 1 and 2 to ensure consistency between the legal ROPA deliverables and the technical platform configuration.
Whitmore Kendall LLP (50 Broadwick Street, London W1F 7AQ). Whitmore Kendall serves as NTP's statutory auditors. C&H consulted with Eleanor Trask (Engagement Partner at Whitmore Kendall) during Phase 5 regarding the Audit & Risk Committee reporting framework and the appropriate treatment of data protection compliance matters in NTP's annual report risk disclosures. The consultation was limited in scope and was conducted with NTP's express consent and at NTP's direction.
Hargrove Lister & Webb LLP (555 Mission Street, Suite 3100, San Francisco, CA 94105, United States; London office at 30 Fenchurch Street, London EC3M 3BD, United Kingdom). Hargrove Lister & Webb acted as outside counsel for Caldwell Analytics Inc. ("Caldwell"), a US-based network analytics provider and key data processor for NTP. The primary contact was Natalie Prescott (Partner, Data Privacy & Cybersecurity, San Francisco office). C&H negotiated the EU Standard Contractual Clauses and UK International Data Transfer Agreement with Ms Prescott during Phase 4 of the engagement. Negotiation correspondence was conducted between 27 June 2023 and 17 July 2023, with the final executed agreements dated 17 July 2023.
3. Fee Arrangement and Financial Reconciliation
3.1 Engagement Fee Structure
The engagement was conducted on a blended hourly rate arrangement with phase-based fee caps, as agreed in the engagement letter dated 13 February 2023. The applicable hourly rates were as follows:
The engagement letter established individual fee caps for each of the five phases, as well as an overall total engagement fee cap. The phase-based fee caps were designed to provide NTP with cost certainty at each stage of the program build while allowing flexibility in the allocation of time and resources within each phase. The agreed phase-based fee caps were as follows:
In addition to the fee caps, the engagement letter provided for estimated disbursements and travel expenses of £32,000. Disbursements were not subject to the fee cap and were to be billed at cost. Disbursements included travel expenses for on-site meetings at Northgate Tower (London) and the Dublin offices of Northgate Ireland Ltd, courier and secure document delivery charges, and Sundial Solutions licence costs advanced on behalf of NTP during the platform configuration period.
3.2 Final Billing Summary
The final billing position for the engagement is as follows:
Total fees billed: £817,450
This represents a total variance of £32,550 under the engagement fee cap of £850,000. No individual phase exceeded its respective phase-level fee cap, as confirmed by the phase-by-phase reconciliation set out in Appendix B to this memorandum.
All invoices have been issued to NTP in accordance with the billing schedule set out in the engagement letter, with monthly invoices rendered in arrears for each calendar month of the engagement. Rachel Bernstein, as billing partner, has confirmed that all invoices are accurate and complete and that no further invoices are anticipated for this engagement. Final payment was received from NTP in respect of all invoices issued through August 2023. The September 2023 invoice (covering the final week of the engagement and the DPC inquiry response) will be issued in accordance with the standard monthly billing cycle and is expected to be paid within the agreed 30-day payment terms.
Disbursements were billed within the estimated parameters and are not subject to the fee cap. A detailed phase-by-phase fee reconciliation is set out in Appendix B.
4. Phase-by-Phase Deliverables Summary
4.1 Phase 1 — Assessment & Gap Analysis (13 February – 31 March 2023)
Fee cap: £185,000
Key Milestones. Phase 1 commenced upon opening of the engagement on 13 February 2023 and concluded with the delivery of the Gap Analysis Report on 31 March 2023. The principal milestones during Phase 1 were as follows:
• 20 February 2023: Phase 1 kickoff meeting held at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. Attendees included Kevin Ostrowski and Sara Hendricks (C&H), Fiona Gallagher, Sanjay Mehta, Thomas Okoye, Laura Dearden, and Philippa Crane (NTP), and Robert Fairclough and Anita Chakravarti (Ashdown Consulting Group). The kickoff meeting established the engagement governance structure, communication protocols, document sharing arrangements, and detailed the phased delivery timeline. Access to NTP's internal systems, existing data protection documentation, and key stakeholders was arranged.
• 1 March 2023: Data mapping questionnaires distributed to all NTP business units, including the UK parent company and each of the five EU subsidiaries. The questionnaires were distributed through Sanjay Mehta's office with coordination from the designated data stewards in each business unit. The questionnaire covered processing activities, data categories, data subjects, lawful bases, retention periods, recipients, international transfers, and technical and organisational security measures.
• 31 March 2023: Gap Analysis Report delivered to Fiona Gallagher and Sanjay Mehta. The report was the culminating deliverable of Phase 1 and provided the foundation for the prioritisation and sequencing of work in Phases 2 through 5.
Deliverables Produced. The following deliverables were produced and delivered during Phase 1:
1. GDPR Gap Analysis Report. This report provided a comprehensive assessment of NTP's then-current compliance state measured against the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR") and the United Kingdom General Data Protection Regulation (as retained and amended under the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018) ("UK GDPR"). The assessment covered all UK and EU operations within scope, including the parent company and five EU subsidiaries. The report identified material gaps across the following areas: (a) ROPA completeness — NTP's existing records of processing activities were incomplete, covering only approximately 40% of identifiable processing activities and lacking the granularity required by Article 30; (b) DPIA coverage — no formal DPIAs had been conducted for processing activities likely to result in high risk to the rights and freedoms of data subjects; (c) international transfer mechanisms — several cross-border transfers, including transfers to Caldwell Analytics Inc. in the United States, lacked compliant transfer mechanisms post-Schrems II; (d) data subject rights procedures — no formalised procedures existed for handling data subject access requests, erasure requests, or portability requests within the statutory timeframes; (e) breach notification processes — while an informal incident response process existed under the CISO's oversight, no documented procedure was in place to ensure compliance with the 72-hour notification requirement to supervisory authorities; and (f) governance structures — the DPO function, while established, lacked the formal mandate, resources, and reporting lines to operate effectively under Articles 37–39.
2. Data Mapping Questionnaire Template. A standardised questionnaire template was designed for use across all NTP business units to capture the information necessary for a comprehensive Article 30 ROPA. The questionnaire addressed the following data fields: (i) description of the processing activity; (ii) purpose of processing; (iii) categories of data subjects; (iv) categories of personal data; (v) special categories of personal data (if applicable); (vi) lawful basis relied upon under Article 6 (and Article 9 where applicable); (vii) data source (collected directly from data subjects or obtained from third parties); (viii) recipients or categories of recipients; (ix) international transfers (including recipient country, transfer mechanism, and supplementary measures); (x) retention periods and deletion/anonymisation methods; and (xi) technical and organisational security measures in place. The template was delivered in both Microsoft Word and Ashbury Holdings Excel formats to allow flexibility in completion across different business units.
3. Regulatory Risk Assessment Memorandum. This memorandum provided a detailed analysis of NTP's regulatory risk profile in light of the prior ICO enforcement action (Enforcement Notice ENF/2021/0934, imposing a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal) and the ongoing DPC preliminary inquiry (IN-22-11-3) regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors. The memorandum assessed the likelihood and potential impact of further enforcement action by both the ICO and the DPC, taking into account NTP's data processing scale (approximately 6.38 million data subjects), the seriousness of the identified compliance gaps, and the regulatory climate in both jurisdictions. The memorandum recommended prioritising the remediation of international transfer mechanisms (ultimately addressed in Phase 4) and the establishment of a defensible compliance infrastructure to mitigate enforcement risk in respect of the DPC inquiry.
4. Memorandum on UK GDPR vs. EU GDPR Divergence. This advisory memorandum addressed the post-Brexit regulatory divergence between the UK GDPR and the EU GDPR insofar as it affected NTP's compliance obligations. The memorandum covered the following topics: (a) the UK International Data Transfer Agreement ("UK IDTA") introduced under Section 119A of the Data Protection Act 2018, as compared with the EU Standard Contractual Clauses adopted by the European Commission's Implementing Decision (EU) 2021/914; (b) the respective supervisory authority roles of the ICO (for UK operations) and the DPC (as lead supervisory authority for NTP's EU operations, given the principal establishment of Northgate Ireland Ltd in Dublin); (c) EU adequacy decisions and their implications for UK–EU data flows; and (d) the potential implications of the UK Data Protection and Digital Information Bill, which was progressing through Parliament at the time and which proposed amendments to legitimate interest provisions, cookie consent requirements, DPO obligations, and international transfer mechanisms. The memorandum identified specific areas where NTP's compliance program would need to maintain parallel compliance tracks for UK and EU requirements, and where a unified approach could be adopted.
Coordination with Ashdown Consulting Group Ltd
During Phase 1, Ashdown Consulting Group Ltd commenced its parallel technical data mapping engagement under its separate retainer with NTP. Ashdown's Lead Privacy Engineer, Anita Chakravarti, worked in close coordination with C&H's Priscilla Wynn to ensure that the technical data mapping outputs were consistent with the legal requirements for the Article 30 ROPA. Sundial Solutions platform configuration was initiated during this period, with C&H providing guidance on the data fields, taxonomy, and classification structure to be implemented in the platform to support ongoing ROPA maintenance.
4.2 Phase 2 — Records of Processing Activities & Data Mapping (3 April – 19 May 2023)
Fee cap: £210,000
Key Milestones.
• 3 April 2023: Phase 2 formally commenced. All completed data mapping questionnaires had been received from NTP business units by this date, and the C&H team began the process of analysing, validating, and consolidating the responses into the Article 30 ROPA format. Follow-up interviews were conducted with data stewards across each business unit to clarify ambiguities, confirm data flows, and ensure completeness of the records.
• 19 May 2023: ROPA v1.0 delivered to Fiona Gallagher and Sanjay Mehta, comprising separate ROPA registers for UK operations and EU subsidiary operations, together with supporting guidance documentation and the Legitimate Interest Assessment template.
Deliverables Produced. 1. ROPA — Controller Activities (NTP PLC, UK Operations). This Article 30 register documented 89 processing activities conducted by NTP PLC in its capacity as data controller within UK operations. The register was structured in accordance with the requirements of Article 30(1) of the UK GDPR and included, for each processing activity: the name and contact details of the controller and DPO; the purposes of processing; the categories of data subjects and personal data; the categories of recipients; details of transfers to third countries or international organisations, including the transfer mechanism relied upon; envisaged time limits for erasure; and a general description of technical and organisational security measures. The 89 processing activities were organised by business function (e.g., human resources, marketing, product and engineering, finance, legal, IT and security, customer service, and corporate affairs) to facilitate ongoing management and review by the respective business unit data stewards.
2. ROPA — Controller Activities (EU Subsidiaries). This Article 30 register documented 58 processing activities conducted by the five EU subsidiaries in their capacity as data controllers. The register was prepared in accordance with Article 30(1) of the EU GDPR and was structured on a per-entity basis, with the following distribution of processing activities:
The variation in the number of processing activities per entity reflects the relative size and operational scope of each subsidiary, with Northgate Ireland Ltd — as the principal EU establishment and the entity with the largest EU headcount — conducting the most extensive range of locally-determined processing activities.
3. ROPA Methodology & Guidance Note. This internal guidance document was prepared for NTP's use in maintaining and updating the ROPA on an ongoing basis following engagement closure. The guidance note covered: (a) the responsibilities of the DPO (Sanjay Mehta) in maintaining and overseeing the ROPA, including the requirement to ensure accuracy, completeness, and timely updates; (b) the role of business unit data stewards, who are responsible for identifying new processing activities, changes to existing activities, and decommissioned activities within their respective business units; (c) triggers for ROPA updates, including the introduction of new processing activities, changes in lawful basis, new or changed international transfers, changes in data categories or data subjects, material changes to retention periods, and changes to technical or organisational security measures; (d) the annual review cycle, under which all ROPA entries are to be reviewed for accuracy and completeness on an annual basis; and (e) Sundial Solutions integration guidance, explaining how ROPA entries maintained in the Sundial Solutions platform (as configured by Ashdown Consulting Group Ltd) map to the legal ROPA structure and how updates should be reflected in the platform.
4. Legitimate Interest Assessment (LIA) Template. This template was developed for use by NTP in conducting and documenting legitimate interest assessments for the 64 processing activities across the group that rely on legitimate interest under Article 6(1)(f) of the GDPR as their lawful basis for processing. The template implements the three-part balancing test established in regulatory guidance from both the ICO and the Article 29 Working Party (now the European Data Protection Board): (i) purpose test — identifying the legitimate interest pursued and confirming it is lawful, specific, and real (not speculative); (ii) necessity test — demonstrating that the processing is necessary for the purpose and that there is no less intrusive means of achieving the same objective; and (iii) balancing test — weighing the legitimate interest against the interests, rights, and freedoms of the data subjects, taking into account the nature and source of the data, the reasonable expectations of data subjects, the impact on data subjects, and the safeguards in place to mitigate any adverse impact. The template includes worked examples drawn from NTP's actual processing activities to facilitate consistent application across the organisation.
Summary Statistics. The total number of processing activities catalogued across the NTP group was 147 (89 in UK operations; 58 across EU subsidiaries). The lawful bases relied upon across all 147 activities were distributed as follows:
The ROPA also identified 14 processing activities involving the processing of special categories of personal data under Article 9 of the GDPR. These activities related to: (a) employee health data processed for the purposes of occupational health, sickness absence management, and workplace adjustments; (b) trade union membership data processed for the purposes of payroll deductions and industrial relations management; and (c) biometric data (fingerprint and iris scans) processed for physical access controls at NTP data centres. Appropriate Article 9(2) conditions were identified and documented for each such activity.
4.3 Phase 3 — Data Protection Impact Assessments (22 May – 7 July 2023)
Fee cap: £155,000
Key Milestones.
• 22 May 2023: Phase 3 commenced. The processing activities requiring DPIAs were identified through the ROPA development process and the gap analysis, applying the threshold criteria in Article 35(1) of the GDPR (processing "likely to result in a high risk to the rights and freedoms of natural persons"), the ICO's screening checklist, and the European Data Protection Board's Guidelines 248 on DPIAs.
• 14 June 2023: The findings and recommendation arising from DPIA-008 (CCTV and facial recognition pilot at Northgate Tower, London E14 5HN) were presented to the NTP Board. The C&H team recommended that the facial recognition pilot be discontinued on the grounds that the residual risk to data subjects could not be sufficiently mitigated and that the processing was disproportionate to the stated security objectives. The recommendation was accepted by the Board at the same meeting.
• 7 July 2023: All 11 DPIAs completed and delivered to Fiona Gallagher and Sanjay Mehta.
DPIAs Completed. A total of 11 Data Protection Impact Assessments were completed during Phase 3. The DPIAs were conducted in accordance with Article 35(7) of the GDPR and followed the methodology prescribed in the ICO's DPIA guidance and the Article 29 Working Party's Guidelines on DPIAs (WP 248 rev.01). Each DPIA comprised: a systematic description of the processing operations and purposes; an assessment of the necessity and proportionality of the processing; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.
The full listing of all 11 DPIAs is set out below:
Of the 11 DPIAs, five were classified as high-risk, requiring detailed mitigation plans with specific technical and organisational measures to reduce residual risk to an acceptable level. The high-risk DPIAs were DPIA-001, DPIA-003, DPIA-007, DPIA-008, and DPIA-011.
DPIA-008 — Facial Recognition Pilot
DPIA-008 merits particular attention in this closing memorandum. The DPIA assessed a proposed pilot deployment of facial recognition technology integrated with the existing CCTV infrastructure at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. The stated purpose of the pilot was to enhance physical security and access control for restricted areas within the building.
The C&H team's assessment concluded that the processing involved special category biometric data (facial geometry templates) under Article 9 of the GDPR, engaged systematic and extensive evaluation of personal aspects relating to natural persons (facial recognition profiling), and would be conducted on a large scale affecting all individuals entering or moving within Northgate Tower (including employees, visitors, contractors, and delivery personnel). The assessment identified significant residual risks including: the difficulty of obtaining valid, freely-given consent from individuals who have no realistic alternative to entering the building for work purposes; the risk of bias and inaccuracy in facial recognition algorithms; the chilling effect on employee privacy and freedom of expression; and the absence of a compelling justification for facial recognition technology given the availability of less intrusive security alternatives (including existing badge-based access control systems).
Following a thorough analysis, the C&H team recommended that the facial recognition pilot be discontinued on the grounds that the residual risk to data subjects' rights and freedoms could not be sufficiently mitigated and that the processing was disproportionate to the stated security objectives. The recommendation was presented to the NTP Board on 14 June 2023 and was accepted at that meeting. The Board directed that the facial recognition pilot be permanently discontinued and that the decision be recorded in the Board minutes.
Deliverables Produced. 1. Full DPIA Reports for DPIA-001, DPIA-003, DPIA-007, DPIA-008, and DPIA-011. Individual, detailed DPIA reports were prepared for each of the five high-risk processing activities. Each report followed a standardised structure including: executive summary; description of the processing; assessment of necessity and proportionality; identification and assessment of risks to data subjects; measures to mitigate risks (including technical measures, organisational measures, and contractual safeguards); residual risk assessment; and recommendations. The reports for DPIA-001, DPIA-003, DPIA-007, and DPIA-011 each concluded that, subject to implementation of the recommended mitigation measures, the residual risk was acceptable. The report for DPIA-008 concluded that the residual risk remained unacceptable and recommended discontinuation of the pilot.
2. DPIA Summary Register & Board Report. An executive summary document was prepared for presentation to the NTP Audit & Risk Committee. The report provided a consolidated overview of all 11 DPIAs, including: a brief description of each processing activity assessed; the risk rating assigned (standard or high risk); key findings and concerns; the mitigation measures recommended and their implementation status; and residual risk assessments. The Board Report was designed to enable the Audit & Risk Committee to exercise appropriate oversight over data protection risk management and to satisfy the accountability requirements of Article 5(2) of the GDPR.
4.4 Phase 4 — International Data Transfer Mechanisms (10 July – 4 August 2023)
Fee cap: £175,000
Key Milestones.
• 28 June 2023: Amended Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd executed. This milestone preceded the formal commencement of Phase 4 by approximately two weeks; the Pinnacle DPA amendment was expedited to address the urgency arising from the DPC inquiry (IN-22-11-3), which specifically concerned the cross-border data transfer arrangements involving Pinnacle's sub-processors in India and Singapore. The decision to accelerate this workstream was taken in consultation with Fiona Gallagher and Sanjay Mehta and was approved by Kevin Ostrowski.
• 10 July 2023: Phase 4 formally commenced for the remaining transfer mechanism workstreams, including the negotiation and execution of the Caldwell Analytics SCCs and UK IDTA, and the completion of all Transfer Impact Assessments.
• 17 July 2023: EU Standard Contractual Clauses (Module 2: Controller to Processor) and UK International Data Transfer Agreement between NTP and Caldwell Analytics Inc. executed. These agreements were the product of a negotiation process that commenced on 27 June 2023 when C&H circulated initial drafts to Natalie Prescott at Hargrove Lister & Webb LLP (acting for Caldwell). Caldwell's comments were received on 10 July 2023. Key negotiation issues included the scope of contractual audit rights, the notification period for sub-processor replacement, liability allocation between the parties, and mutual confidentiality obligations. All issues were resolved through negotiation, and the final agreements were executed on 17 July 2023.
• 4 August 2023: All six Transfer Impact Assessments completed and delivered.
Transfer Mechanisms Implemented
The engagement addressed a total of 16 identified cross-border data transfers from NTP group entities to recipients in third countries (i.e., countries outside the UK and the EEA that are not subject to an adequacy decision for the relevant transfer). The transfer mechanisms implemented or relied upon were as follows:
The UK Addendum to EU SCCs was used for four transfers where the personal data originated from both UK data subjects (subject to the UK GDPR) and EEA data subjects (subject to the EU GDPR), allowing a single set of contractual documentation to serve both regulatory frameworks.
Transfer Impact Assessments Completed
Six Transfer Impact Assessments ("TIAs") were completed during this phase. Each TIA assessed the legal framework in the recipient country with respect to government access to personal data, the effectiveness of the transfer mechanism in providing essentially equivalent protection to that guaranteed within the EEA/UK, and the supplementary measures necessary to address any gaps identified. The TIAs were conducted in accordance with the methodology set out in the European Data Protection Board's Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, and the ICO's international transfer risk assessment guidance.
The six TIAs completed are detailed below:
TIA-001: NTP → Caldwell Analytics Inc. (United States) — Network Analytics Data. This TIA assessed the risks associated with the transfer of network performance and subscriber analytics data from NTP to Caldwell Analytics Inc., a Delaware corporation with principal offices in Austin, Texas. The assessment analysed the implications of: Section 702 of the Foreign intelligence Surveillance Act (FISA), which authorises the US government to compel the production of communications data from electronic communication service providers for foreign intelligence purposes; Executive Order 12333, which authorises signals intelligence collection activities by the National Security Agency; and the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), which permits US law enforcement to compel production of data held by US companies regardless of the data's physical storage location. The TIA also assessed the relevance and impact of the EU-US Data Privacy Framework, which was adopted by the European Commission's adequacy decision on 10 July 2023, and evaluated whether Caldwell's participation in the Data Privacy Framework (pending at the time of assessment) could serve as a supplementary safeguard. The TIA concluded that supplementary technical and organisational measures were necessary and identified specific measures to be implemented.
TIA-002: Pinnacle Cloud Services → Pinnacle India Pvt Ltd (India) — Infrastructure Support Data. This TIA assessed the risks associated with the onward transfer of infrastructure support data (including limited personal data such as system administrator credentials, log data containing IP addresses, and incidental customer data in support tickets) from Pinnacle Cloud Services Ltd (UK) to Pinnacle India Pvt Ltd (CIN: U72200HR2016PTC065412), a sub-processor located in Gurugram, Haryana, India. The assessment analysed the Indian Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and Indian surveillance and lawful intercept laws, including Section 69 of the IT Act (power to intercept, monitor or decrypt any information) and the Telegraph Act 1885.
TIA-003: Pinnacle Cloud Services → Pinnacle APAC Pte Ltd (Singapore) — Infrastructure Monitoring. This TIA assessed the transfer of infrastructure monitoring data from Pinnacle Cloud Services Ltd (UK) to Pinnacle APAC Pte Ltd (UEN: 201824567K), located in Singapore. The assessment considered the Personal Data Protection Act 2012 (Singapore) and Singapore's surveillance and lawful access framework.
TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (United States) — Expatriate Payroll. This TIA assessed the transfer of payroll data for approximately 45 NTP expatriate employees to Sunderland-Hayes Payroll Services Inc., a US-based payroll services provider. Given the limited volume and sensitivity of the data (payroll and employment records for a small group of employees), the TIA focused on the proportionality of supplementary measures relative to the transfer risk.
TIA-005: NTP GmbH → Caldwell Analytics Inc. (United States) — German Subscriber Analytics. This TIA assessed the transfer of German subscriber analytics data from Northgate GmbH (Berlin) to Caldwell Analytics Inc. (US). The assessment was conducted in parallel with TIA-001 and addressed the same US legal framework risks, but with additional consideration of German-specific data protection requirements under the Bundesdatenschutzgesetz (BDSG) and the particular expectations of the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) regarding international transfers of telecommunications subscriber data.
TIA-006: NTP → Moritaka Systems K.K. (Japan) — IoT Platform Analytics. This TIA assessed the transfer of IoT platform analytics data (covering approximately 12,000 IoT device endpoints deployed in NTP's smart city pilot in Birmingham) to Moritaka Systems K.K., a Japanese technology company providing IoT data analytics services. Japan is the subject of an EU adequacy decision (Commission Implementing Decision (EU) 2019/419), which provides that Japan ensures an adequate level of protection for personal data transferred from the EEA. The TIA confirmed that the adequacy decision applied to the transfers in question but also recommended supplementary measures to address residual risks, including encryption at rest and in transit and contractual audit rights.
Supplementary Measures. Across the six TIAs, the following supplementary technical and organisational measures were identified as necessary and were implemented or contractually required:
• Encryption at rest using AES-256 encryption standard for all personal data stored by recipient processors and sub-processors in third countries;
• Encryption in transit using TLS 1.3 for all personal data transmitted between NTP group entities and third-country recipients;
• Pseudonymisation of direct identifiers (names, email addresses, telephone numbers) prior to transfer where technically feasible and consistent with the processing purpose;
• Contractual audit rights enabling NTP (or its designated auditor) to conduct on-site or remote audits of recipient processors' and sub-processors' data processing practices, security measures, and compliance with the transfer mechanism;
• Data localisation for certain categories of particularly sensitive data (including special category data and law enforcement-related data) that were determined not to require transfer to third countries and could be processed within the UK/EEA.
Deliverables Produced. The deliverables produced during Phase 4 were as follows:
1. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. Executed 17 July 2023. This agreement implemented Module 2 of the European Commission's Standard Contractual Clauses (adopted under Implementing Decision (EU) 2021/914) for the transfer of personal data from NTP (as controller) to Caldwell (as processor) in the United States.
2. UK International Data Transfer Agreement — NTP to Caldwell Analytics Inc. Executed 17 July 2023. This agreement implemented the UK IDTA (as approved under Section 119A of the Data Protection Act 2018) for the transfer of UK personal data from NTP to Caldwell in the United States, operating in parallel with the EU SCCs for EEA-originating personal data.
3. TIA-001 (NTP → Caldwell Analytics Inc., US). The detailed Transfer Impact Assessment analysing FISA Section 702, Executive Order 12333, the CLOUD Act, and the EU-US Data Privacy Framework, as described above.
4. TIA-002 (Pinnacle Cloud Services → Pinnacle India Pvt Ltd, India). The detailed Transfer Impact Assessment analysing the Indian IT Act 2000 and Indian surveillance and lawful access laws, as described above.
5. TIA-003 (Pinnacle Cloud Services → Pinnacle APAC Pte Ltd, Singapore). The Transfer Impact Assessment for the Singapore transfer, as described above.
6. TIA-004 (NTP → Sunderland-Hayes Payroll Services Inc., US). The Transfer Impact Assessment for the expatriate payroll data transfer, as described above.
7. TIA-005 (NTP GmbH → Caldwell Analytics Inc., US). The Transfer Impact Assessment for the German subscriber analytics transfer, as described above.
8. TIA-006 (NTP → Moritaka Systems K.K., Japan). The Transfer Impact Assessment for the IoT platform analytics transfer, as described above.
9. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd. Executed 28 June 2023. This amended DPA replaced the existing data processing agreement between NTP and Pinnacle Cloud Services Ltd and was comprehensively updated to incorporate: full Article 28 GDPR requirements (including processing instructions, confidentiality obligations, security measures, sub-processing restrictions, and cooperation with the controller); a sub-processor approval mechanism with specific authorisation for Pinnacle India Pvt Ltd (CIN: U72200HR2016PTC065412) and Pinnacle APAC Pte Ltd (UEN: 201824567K); international transfer provisions incorporating EU SCCs Module 3 (Processor to Sub-processor) and the UK Addendum; contractual audit rights exercisable by NTP on reasonable notice; breach notification obligations (notification to NTP within 36 hours of becoming aware of a personal data breach affecting NTP personal data); and data deletion/return provisions at the termination or expiry of the processing agreement.
10. Redline of Pinnacle DPA Showing Negotiation Changes. A tracked-changes version of the Pinnacle DPA showing all amendments negotiated with Graham Alderton, Head of Legal at Pinnacle Cloud Services Ltd. This document was retained in the C&H matter file for reference purposes and to document the negotiation process and rationale for specific provisions.
11. UK Addendum to EU SCCs — Template. A template UK Addendum to the EU Standard Contractual Clauses was prepared for use across the four identified transfers where both UK and EU regulatory regimes applied. The template allows NTP to incorporate the UK Addendum into any future EU SCC arrangement where UK personal data is also in scope.
12. International Transfers Policy & Mechanism Selection Guidance. An internal NTP policy document providing a comprehensive framework for assessing, selecting, and implementing appropriate transfer mechanisms for international data transfers. The policy includes: a decision tree for selecting the appropriate transfer mechanism based on the recipient country, the nature of the transfer (controller-to-controller, controller-to-processor, or processor-to-sub-processor), and the applicable regulatory regime (UK GDPR, EU GDPR, or both); a standardised TIA methodology for conducting Transfer Impact Assessments; guidance on supplementary measures; and a monitoring and reassessment protocol.
Negotiation with Caldwell Analytics' Counsel
The negotiation of the EU SCCs and UK IDTA with Caldwell Analytics Inc. was conducted with Natalie Prescott, Partner in the Data Privacy & Cybersecurity practice at Hargrove Lister & Webb LLP (San Francisco and London offices). C&H circulated initial drafts of the EU SCCs and UK IDTA to Ms Prescott on 27 June 2023. Caldwell's marked-up comments were received on 10 July 2023. The principal negotiation issues and their resolution were as follows:
• Audit rights scope: Caldwell initially sought to limit audit rights to remote, document-based audits only. C&H negotiated the inclusion of on-site audit rights, exercisable on not less than 30 business days' written notice, with a frequency cap of one audit per calendar year (unless required by a supervisory authority investigation or in the event of a personal data breach).
• Sub-processor replacement notification period: Caldwell proposed a 14-day notification period for new sub-processor appointments. C&H negotiated a 30-day notification period with a right of objection and a termination right for NTP in the event that a reasonable objection could not be resolved.
• Liability allocation: Caldwell sought to include a mutual limitation of liability capping aggregate liability under the SCCs at the total fees paid by NTP to Caldwell in the preceding 12 months. C&H resisted the inclusion of any liability cap within the SCC framework itself, on the basis that such caps may be incompatible with the requirements of the SCCs and the rights of data subjects. The final position excluded liability caps from the SCCs, with the parties' commercial liability allocation governed by the underlying master service agreement.
• Mutual confidentiality obligations: The confidentiality provisions were aligned between the SCCs and the underlying master service agreement to ensure consistency.
All issues were resolved through negotiation, and the final agreements were executed on 17 July 2023.
4.5 Phase 5 — Policies, Governance & Training (7 August – 1 September 2023)
Fee cap: £125,000
Key Milestones.
• 7 August 2023: Phase 5 commenced. The policy development workstream drew upon the findings and recommendations from all preceding phases to create a comprehensive governance framework tailored to NTP's operational structure and regulatory profile.
• 22 August 2023: Board-level GDPR training session delivered at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. The session was attended by members of the NTP Board of Directors and senior leadership team. The training was delivered by Kevin Ostrowski and Sara Hendricks and covered the full range of the compliance program, as detailed below.
• 1 September 2023: Final policy suite delivered to Fiona Gallagher and Sanjay Mehta, completing the substantive deliverables of the engagement.
Deliverables Produced. 1. Group Data Protection Policy. This overarching, Board-approved policy establishes NTP's group-wide data protection governance framework and applies to all UK and EU operations within scope. The policy covers: (a) scope and application — confirming that the policy applies to NTP PLC and all subsidiaries listed in Section 2.2 of this memorandum, and to all processing of personal data within those entities; (b) roles and responsibilities — defining the responsibilities of the DPO (Sanjay Mehta), the CISO (Thomas Okoye), the General Counsel (Fiona Gallagher), business unit data stewards, and all employees and contractors who process personal data; (c) data protection principles — articulating NTP's commitment to the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability as set out in Articles 5 and 6 of the GDPR; (d) lawful basis selection — establishing the framework and decision-making process for identifying and documenting the appropriate lawful basis under Article 6 for each processing activity; (e) privacy by design and default — embedding the requirements of Article 25 into NTP's product development, system procurement, and business process design practices; (f) ROPA maintenance — establishing the obligations and processes for maintaining the Article 30 records of processing activities; (g) DPIA triggers — defining the criteria for when a DPIA is required, the DPIA process, and the escalation procedure for high-risk findings; (h) international transfers — cross-referencing the International Transfers Policy & Mechanism Selection Guidance and establishing the approval process for new international transfers; (i) data subject rights — cross-referencing the Data Subject Rights Procedure and establishing the organisational commitment to facilitating the exercise of data subject rights within statutory timeframes; (j) breach notification — cross-referencing the Data Breach Notification Procedure and establishing the organisational response framework; and (k) accountability framework — establishing the reporting, audit, and assurance structures necessary to demonstrate compliance with Article 5(2) of the GDPR. The Group Data Protection Policy was approved by the NTP Board and forms the cornerstone of the ongoing governance framework.
2. Data Subject Rights Procedure. This procedure establishes the process for handling requests from data subjects exercising their rights under the GDPR, including the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), and the right to object (Article 21). The procedure includes: (a) service level agreements — a response time of one calendar month from receipt of a valid request, with the ability to extend by a further two months where the request is complex or where a high volume of requests has been received, subject to notification to the data subject within the initial one-month period; (b) identity verification requirements — defining the steps to be taken to verify the identity of the requestor before processing the request, in order to prevent unauthorised disclosure of personal data; (c) escalation procedures — defining the escalation path from the initial handler to the DPO and, where necessary, to legal counsel for complex or high-risk requests; (d) exemption assessment — guidance on assessing and applying applicable exemptions under the Data Protection Act 2018 (e.g., legal professional privilege, regulatory purposes, management forecasts); and (e) template response letters — standardised response templates for acknowledging receipt, requesting identity verification, extending the response deadline, fulfilling the request, and partially or wholly refusing the request (with reasons).
3. Data Breach Notification Procedure. This procedure establishes the internal escalation chain and process for identifying, assessing, containing, and reporting personal data breaches in accordance with Articles 33 and 34 of the GDPR. The procedure defines the escalation chain as follows: initial identification by any NTP employee or contractor → immediate escalation to Thomas Okoye (CISO) for containment and initial risk assessment → escalation to Sanjay Mehta (DPO) for assessment of notification obligations → escalation to Fiona Gallagher (General Counsel) for any breach requiring supervisory authority notification, data subject notification, or external legal advice. The procedure establishes the 72-hour notification deadline for reporting to the ICO and/or DPC (as applicable), the criteria for determining whether notification to data subjects is required (where the breach is likely to result in a high risk to their rights and freedoms), and the cross-border coordination requirements where a breach affects personal data subject to both UK and EU regulatory regimes. The procedure also includes: template notification forms for both the ICO and the DPC; a post-incident review protocol to identify root causes and implement corrective measures; and a breach register template for maintaining a record of all personal data breaches in accordance with Article 33(5).
4. Data Retention Schedule. This comprehensive schedule sets out the retention periods applicable to each category of personal data processed by NTP, together with the lawful basis for retention, the applicable regulatory or legal basis for the specified retention period, and the deletion or anonymisation method to be applied at the expiry of the retention period. The retention periods have been determined by reference to applicable statutory and regulatory requirements, including: the Investigatory Powers Act 2016 (communications data retention obligations); the Limitation Act 1980 (relevant limitation periods for potential civil claims); the Companies Act 2006 (statutory record-keeping requirements); Her Majesty's Revenue and Customs requirements for payroll and tax records; and sector-specific telecommunications regulatory obligations. The schedule covers all categories of personal data identified in the ROPA, including consumer subscriber data, enterprise client data, employee and HR data, contractor and temporary worker data, job applicant data, CCTV and surveillance data, and website visitor data.
5. Privacy Notice — Consumer Subscribers (NorthCloud Platform). A revised customer-facing privacy notice was prepared for use on the NorthCloud platform. The notice was drafted to comply with the transparency requirements of Articles 13 and 14 of the GDPR and provides clear, accessible information to consumer subscribers regarding: the identity and contact details of the controller; the contact details of the DPO; the purposes and lawful bases for processing; the categories of personal data collected; the recipients or categories of recipients; details of international transfers; retention periods; data subject rights; the right to lodge a complaint with the ICO or the relevant EU supervisory authority; and information regarding automated decision-making and profiling. The notice was drafted in plain English and structured to be accessible to a consumer audience, in accordance with ICO guidance on transparency