DATA PROTECTION IMPACT ASSESSMENT (DPIA)

DATA PROTECTION IMPACT ASSESSMENT (DPIA)
Reference: DPIA-001
Processing Activity: NorthCloud AI-Driven Customer Churn Prediction Model
RISK CLASSIFICATION: HIGH-RISK
This document has been prepared by Calderwood & Harkness LLP for the sole use of Northgate Telecommunications PLC and is subject to legal professional privilege and the duty of confidence. It must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC. Nothing in this document constitutes a guarantee of compliance with data protection legislation; rather, it sets out an assessment of the processing activity described herein and recommended mitigation measures to reduce identified risks.
DOCUMENT CONTROL & APPROVAL
Version History.  
Approval Signatures.  
Author / Lead Associate, Calderwood & Harkness LLP
By: ________
Name: Sara Hendricks
Title: Lead Associate, Privacy & Data Security
Date: ________
Reviewing Partner, Calderwood & Harkness LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Date: ________
Data Protection Officer, Northgate Telecommunications PLC
By: ________
Name: Sanjay Mehta
Title: Data Protection Officer (CIPP/E)
Date: ________
Chief Information Security Officer, Northgate Telecommunications PLC
By: ________
Name: Thomas Okoye
Title: Chief Information Security Officer
Date: ________
VP, Product & Engineering, NorthCloud, Northgate Telecommunications PLC
By: ________
Name: Laura Dearden
Title: Vice President, Product & Engineering
Date: ________
General Counsel & Company Secretary, Northgate Telecommunications PLC
By: ________
Name: Fiona Gallagher
Title: General Counsel & Company Secretary
Date: ________
Next Review Date: This DPIA must be reviewed no later than 12 months from the date of approval set out above, or earlier upon any material change to the processing activity as described in Section 7.3 below.
Right-click to update Table of Contents
1. INTRODUCTION AND PURPOSE OF THIS ASSESSMENT
1.1 Background
Northgate Telecommunications PLC ("NTP" or the "Company") is a United Kingdom-headquartered public limited company (Company Number: 04837291) operating telecommunications infrastructure, managed connectivity services, and software-as-a-service ("SaaS") platforms across the United Kingdom and the European Union. In the financial year ended 31 March 2023 ("FY 2022"), NTP reported consolidated revenue of approximately £2.47 billion and employed approximately 11,400 individuals globally, of whom approximately 8,200 are based in the UK and EU/EEA member states.
NTP's operations span consumer telecommunications services (mobile and fixed-line), enterprise connectivity solutions, and a portfolio of cloud-based software platforms marketed under the "North" brand family. Among these, NorthCloud is NTP's cloud-based unified communications and collaboration platform, offered on a subscription basis to both enterprise clients and consumer subscribers. NorthCloud is sold across the United Kingdom and 14 EU/EEA member states through NTP's subsidiary undertakings, providing voice, video conferencing, team messaging, file sharing, and API-based integration capabilities. The platform competes with established unified communications providers and has experienced significant growth since its launch in 2019.
As a data controller, NTP processes personal data relating to approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients (and their individual users), and approximately 11,400 employees globally. The breadth and scale of NTP's processing activities give rise to significant data protection obligations under both the UK General Data Protection Regulation (the "UK GDPR") as retained and amended by the Data Protection Act 2018, and the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR" and, together with the UK GDPR, the "GDPR"), applicable to NTP's operations through its EU subsidiary undertakings.
On 8 December 2022, the NTP Board Audit & Risk Committee passed a resolution mandating a comprehensive GDPR compliance program build (the "Program") to address identified gaps in NTP's data protection governance, operational processes, and documentation. This resolution was prompted by a combination of factors, including NTP's prior regulatory history (discussed further at Section 1.2 below), the increasing regulatory scrutiny facing the telecommunications sector, and the desire of the NTP Board to demonstrate robust data protection compliance to investors, enterprise clients, and supervisory authorities alike.
On 13 February 2023, NTP engaged Calderwood & Harkness LLP (engagement reference: SC/NTP/2023-0213/PDS) to design, advise upon, and support the implementation of the compliance program. The engagement is structured in six phases:
•  Phase 1 (February — March 2023): Governance framework design, including the appointment of Sanjay Mehta as DPO and the establishment of the Data Protection Steering Committee.
•  Phase 2 (March — May 2023): Comprehensive data mapping and Record of Processing Activities ("ROPA") build across all NTP entities, comprising 147 processing activities, supported by Ashdown Consulting Group Ltd as specialist data mapping and Sundial Solutions implementation consultants.
•  Phase 3 (May — July 2023): Data Protection Impact Assessments for high-risk and potentially high-risk processing activities. Eleven DPIAs were conducted during this phase, of which five — including this assessment — were classified as high-risk requiring formal mitigation plans.
•  Phase 4 (July — August 2023): Transfer Impact Assessments ("TIAs") and international data transfer mechanism reviews for restricted transfers.
•  Phase 5 (August — October 2023): Policy and procedure drafting, including the Group Data Protection Policy, Privacy Notices, Data Subject Rights Procedure, Data Breach Response Procedure, and related operational documents.
•  Phase 6 (October — December 2023): Training, embedding, and assurance, including Board-level GDPR training, operational staff training, and an initial compliance assurance review.
This Data Protection Impact Assessment ("DPIA") constitutes DPIA-001 within the Program and addresses the NorthCloud AI-driven customer churn prediction model (the "Churn Model" or the "Model"). It is one of the eleven DPIAs completed during Phase 3 of the engagement, which commenced on 22 May 2023 and during which all DPIAs were finalised by 7 July 2023.
1.2 Legal Basis for Conducting This DPIA
This DPIA is required under Article 35(1) of the GDPR / UK GDPR, which mandates that a data protection impact assessment be carried out where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is "likely to result in a high risk to the rights and freedoms of natural persons."
The NorthCloud Churn Model triggers the mandatory DPIA requirement under multiple provisions:
(a) Article 35(3)(a) GDPR / UK GDPR: The Churn Model involves a systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling, and on which decisions that may produce effects concerning data subjects are based. Specifically, the Model generates individualised churn probability scores for each subscriber based on an automated analysis of their usage patterns, billing history, support interactions, and network quality data. These scores are used to inform retention decisions and proactive outreach, which — whilst generally intended to benefit the data subject — constitute decisions based on profiling that may have effects of significance to the individual concerned.
(b) Article 35(3)(b) GDPR / UK GDPR: The processing involves personal data on a large scale. The Churn Model processes data relating to approximately 2.1 million active NorthCloud subscribers across the UK and 14 EU/EEA member states. This volume clearly constitutes "large-scale" processing within the meaning of Recital 91 and the guidance issued by the European Data Protection Board ("EDPB") and the UK Information Commissioner's Office ("ICO").
In addition to the specific provisions of Article 35(3), Calderwood & Harkness LLP has assessed the Churn Model processing against the nine criteria identified by the EDPB in its Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (WP 248 rev.01, adopted 4 October 2017, last revised 4 April 2018). The EDPB guidance indicates that processing which meets two or more of these criteria will generally require a DPIA. The Churn Model meets at least four of the nine criteria:
1.  Evaluation or scoring — the Model evaluates individual subscribers and generates predictive scores regarding their behaviour (likelihood of churn).
2.  Automated decision-making with legal or similar significant effect — whilst the Model does not itself make final decisions, its outputs are used to inform decisions regarding retention actions that may affect subscribers' service experience.
3.  Processing of data on a large scale — approximately 2.1 million data subjects are processed.
4.  Innovative use or applying new technological or organisational solutions — the deployment of a machine learning-based predictive model for individual-level churn scoring represents an innovative application of technology within NTP's operations.
It should also be noted that NTP's prior regulatory history heightens the importance of conducting robust DPIAs. On 15 September 2021, the ICO issued Enforcement Notice ENF/2021/0934 against NTP, imposing a monetary penalty of £320,000 in respect of NTP's failure to implement adequate consent mechanisms for direct marketing communications to consumer subscribers. Whilst that enforcement action related to a distinct processing activity (direct marketing under the Privacy and Electronic Communications Regulations 2003), it is relevant context: any deficiency in NTP's compliance with data protection principles, particularly in relation to large-scale processing of consumer data, is likely to attract heightened regulatory scrutiny. This underscores the necessity of a thorough and rigorous DPIA for the Churn Model.
Furthermore, NTP is aware of a preliminary inquiry by the Data Protection Commission (Ireland) ("DPC"), reference IN-22-11-3, opened in November 2022, concerning cross-border data transfers by NTP's Irish subsidiary, Northgate Ireland Ltd. Whilst that inquiry relates principally to international transfer mechanisms rather than the Churn Model processing specifically, NTP is conscious that DPC scrutiny of its broader data processing operations requires a demonstrably robust compliance posture, of which this DPIA forms a critical component.
1.3 Scope of This DPIA
This DPIA assesses the processing of personal data carried out by the NorthCloud AI-driven customer churn prediction model. The scope of the assessment encompasses:
(a) The complete processing lifecycle of the Churn Model, from data ingestion and feature extraction through model training, inference, output generation, and downstream use of churn scores in NTP's customer success and retention workflows.
(b) Processing conducted in the United Kingdom under the UK GDPR, where NTP operates directly as controller.
(c) Processing conducted across 14 EU/EEA member states under the EU GDPR, where NTP operates through the following subsidiary undertakings:
•  Northgate Ireland Ltd (CRO Number 587214), registered at 25-28 North Wall Quay, Dublin 1, D01 H104, Ireland;
•  Northgate GmbH (HRB 214503 B), registered at Friedrichstraße 191, 10117 Berlin, Germany;
•  Northgate B.V. (KvK 72841936), registered at Strawinskylaan 3127, 1077 ZX Amsterdam, The Netherlands;
•  Northgate France SAS (SIREN 891 247 503), registered at 42 Avenue de la Grande Armée, 75017 Paris, France; and
•  Northgate Iberia S.L. (CIF B-91847263), registered at Paseo de la Castellana 259D, 28046 Madrid, Spain.
(d) The role of processors and sub-processors in the Churn Model processing:
•  Pinnacle Cloud Services Ltd (Company Number: 09142837), NTP's primary infrastructure hosting provider, which hosts the NorthCloud platform and the Churn Model compute environment across data centres in London, Frankfurt, Amsterdam, and Dublin. Pinnacle acts as a processor under NTP's control pursuant to a Data Processing Agreement amended and executed on 28 June 2023 (the "Pinnacle DPA").
•  Caldwell Analytics Inc., a Delaware C-corporation with principal offices at 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA. Caldwell provides network analytics data under a Master Services Agreement dated 1 June 2021. Certain network quality data inputs to the Churn Model may originate from Caldwell's platform. The data protection implications of the Caldwell relationship are addressed separately and in greater detail in DPIA-011 (Caldwell Analytics Network Data Processing) and TIA-001 (Transfer Impact Assessment — Caldwell Analytics Inc., US).
(e) The assessment considers requirements under both the UK GDPR and the EU GDPR, given NTP's dual-regime operations. Where the requirements of the UK GDPR and EU GDPR differ materially in relation to any point addressed in this DPIA, such differences are noted. In general, for the purposes of this assessment, the two regimes impose substantially aligned obligations.
This DPIA does not assess processing activities that are ancillary or upstream to the Churn Model but which are the subject of separate assessments, including (without limitation) the broader NorthCloud platform data processing (addressed in the ROPA and in NTP's general processing documentation), the Caldwell Analytics international transfer (DPIA-011 and TIA-001), or NTP's marketing profiling activities (DPIA-007).
2. SYSTEMATIC DESCRIPTION OF THE PROCESSING
2.1 Nature of the Processing
The NorthCloud AI-driven customer churn prediction model is a machine learning system designed and operated by NTP's Data Science team (which reports to Laura Dearden, VP, Product & Engineering) to analyse multiple categories of customer data and generate a predictive assessment of the likelihood that individual NorthCloud subscribers — both enterprise client users and consumer subscribers — will discontinue or fail to renew their NorthCloud subscription within a defined forward-looking period.
The Model employs supervised machine learning algorithms, trained on historical data spanning 24 months of NorthCloud subscriber activity (from the period approximately June 2021 to May 2023 for the initial training dataset). The training process involves the following high-level steps:
(a) Data Collection and Feature Engineering: Subscriber data is extracted from NorthCloud's production databases (hosted on Pinnacle Cloud Services Ltd infrastructure) across the categories described in Section 2.3 below. Raw data is transformed into model features through an ETL (Extract, Transform, Load) pipeline that aggregates, normalises, and encodes the data into formats suitable for machine learning consumption.
(b) Pseudonymisation: Within the ETL pipeline, direct identifiers (subscriber name, email address) are replaced with internal subscriber IDs. A separate lookup table — maintained with restricted access — permits re-identification where necessary for downstream use (e.g., enabling Customer Success teams to contact the subscriber identified as at risk). The pseudonymised dataset is used for model training and inference.
(c) Model Training: The pseudonymised feature dataset is used to train one or more machine learning models. The specific algorithm(s) employed include gradient-boosted decision tree ensembles (specifically, XGBoost) as the primary model architecture, with ongoing evaluation of alternative approaches. The model is trained to predict a binary outcome (churn / no churn within the forward-looking period) and calibrated to output a probability score.
(d) Inference (Scoring): The trained model is deployed in two operational modes:
•  Weekly batch predictions: Every Sunday evening (UTC), the Model processes the full active subscriber base (approximately 2.1 million subscribers) and generates an updated churn probability score for each subscriber.
•  Near-real-time triggered scoring: Certain events — such as a support ticket escalation to Tier 3, a service downgrade request, a payment failure, or a sustained period of low platform engagement — trigger an immediate re-scoring of the affected subscriber's churn probability. These triggers are defined in the Model's operational configuration and reviewed quarterly.
(e) Output Generation: For each subscriber, the Model outputs:
•  A churn probability score on a continuous scale from 0.0 to 1.0, where 1.0 represents the highest predicted likelihood of churn.
•  A contributing factor analysis identifying the key features (e.g., declining login frequency, recent support escalation, low NPS score, payment delays) that most influenced the churn probability score for that individual subscriber. This analysis is generated using SHAP (SHapley Additive exPlanations) values applied to the model output.
•  A customer health score that combines the churn probability with other engagement metrics into a composite index used by the Customer Success team.
•  A subscriber segment classification (e.g., "high risk — engagement decline," "moderate risk — billing friction," "low risk — stable") for workflow routing purposes.
(f) Downstream Use: Model outputs are written to NTP's customer success CRM module (an internal system built on the NorthCloud platform), where they are surfaced to authorised Customer Success and Commercial team members via dashboards and workflow queues. Churn-score-triggered retention actions are initiated through this CRM module, including proactive outreach calls, tailored retention offers, enhanced support prioritisation, and service adjustment recommendations.
2.2 Purpose of the Processing
The processing of personal data through the Churn Model serves the following purposes:
(a) Primary Purpose — Customer Retention: The primary purpose of the Churn Model is to enable NTP to identify NorthCloud subscribers who are at elevated risk of discontinuing their subscription and to take proactive, targeted retention measures to reduce churn and improve customer satisfaction. These measures include, but are not limited to, personalised retention offers (e.g., discounted renewal pricing, service upgrades), enhanced technical support, dedicated account manager engagement, and service adjustments designed to address the specific factors contributing to the subscriber's churn risk. The commercial rationale is significant: each percentage point reduction in annual churn across the NorthCloud subscriber base is estimated to represent approximately £8.2 million in preserved annual recurring revenue.
(b) Secondary Purpose — Product Improvement: The Churn Model's contributing factor analysis provides actionable intelligence to Laura Dearden's Product & Engineering team regarding feature gaps, service quality issues, and user experience friction points that are correlated with elevated churn risk. This data informs product roadmap prioritisation, feature development decisions, and service quality improvement initiatives.
(c) Ancillary Purpose — Aggregate Reporting: Aggregated and anonymised churn analytics derived from the Model's outputs are included in NTP's internal management reporting, Board-level reporting, and investor relations materials. At this level of aggregation, no individual subscriber is identifiable, and the data is used for strategic business planning purposes.
It is emphasised that the Churn Model is not used for, and its outputs are not applied to, any of the following purposes: credit scoring or credit-related decisions; differential pricing based on individual churn risk (i.e., subscribers are not charged more because they are assessed as less likely to churn); employment-related decisions; automated contract termination or service denial; or sharing of individual-level churn data with third parties.
2.3 Categories of Personal Data Processed
The Churn Model ingests and processes the following categories of personal data:
(a) Account and Identification Data:
•  Subscriber name (first name and surname)
•  Email address (primary contact email associated with the NorthCloud account)
•  Company name (for enterprise client users)
•  Job title (where provided by enterprise client users)
•  Account identifier (unique NorthCloud account ID)
•  Subscription tier (e.g., Basic, Professional, Enterprise)
•  Account creation date and tenure
(b) Usage and Behavioural Data:
•  Login frequency (number and pattern of logins per defined period)
•  Feature utilisation metrics (which NorthCloud features are used, frequency of use, depth of engagement)
•  Session duration (average and aggregate time spent on the platform per session)
•  Collaboration activity metadata, including: meeting frequency (number of video/audio meetings initiated or attended); messaging volume (number of messages sent and received — metadata only, not message content); file sharing frequency (number of files shared — metadata only, not file content)
•  API usage patterns (for enterprise clients integrating NorthCloud via API)
•  Mobile application usage metrics (where the NorthCloud mobile application is used)
(c) Support Interaction Data:
•  Support ticket history (number of tickets raised, ticket categories, resolution times, escalation records)
•  Customer satisfaction survey responses (post-interaction satisfaction ratings)
•  Net Promoter Score ("NPS") responses
•  Escalation records (including escalation to Tier 2 and Tier 3 support)
(d) Billing and Financial Data:
•  Subscription plan details (plan type, pricing tier, billing cycle)
•  Payment history (payment dates, payment method type — not payment card numbers or bank account details, which are held by the payment processor)
•  Invoice amounts and billing history
•  Upgrade and downgrade history
•  Promotional offers redeemed (Discount codes, trial extensions, loyalty offers)
(e) Network Quality Data:
•  Call quality metrics, including jitter, latency, and packet loss measurements associated with individual subscribers' voice and video sessions
•  Service availability records per subscriber (uptime/downtime experienced)
•  Device type and operating system version (used for correlation with quality-of-service issues)
(f) Derived Data (Model Outputs):
•  Churn probability score (0.0 to 1.0)
•  Contributing factor weightings (SHAP values for each input feature)
•  Customer health score (composite index)
•  Subscriber segment classification
Exclusions: The Churn Model does not process:
•  Message content, call content, or file content (communications content is excluded; only metadata is used);
•  Special category data within the meaning of Article 9 GDPR (including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation);
•  Criminal conviction data within the meaning of Article 10 GDPR;
•  Payment card numbers, bank account details, or other financial account credentials (these are held separately by NTP's payment processor and are not ingested by the Churn Model).
2.4 Categories of Data Subjects
The data subjects whose personal data is processed by the Churn Model comprise:
(a) Consumer subscribers of NorthCloud: Individual consumers who subscribe directly to the NorthCloud platform for personal or small-business use. These data subjects form a subset of NTP's approximately 6.3 million consumer subscribers.
(b) Enterprise client users: Individual employees, contractors, and authorised users of NTP's approximately 42,000 enterprise client organisations who access and use the NorthCloud platform as part of their employer's or organisation's enterprise subscription. In this context, the enterprise client organisation is typically the contracting party with NTP, but the individual users are the data subjects whose personal data is processed by the Churn Model.
The estimated total number of data subjects directly affected by Churn Model scoring is approximately 2.1 million active NorthCloud subscribers across the United Kingdom and 14 EU/EEA member states. This figure represents the active subscriber base as of the date of this assessment and is subject to fluctuation as subscribers join and leave the platform.
2.5 Recipients and Data Sharing
The personal data processed by the Churn Model, including the Model's outputs, is shared with the following categories of recipients:
Internal Recipients within NTP:
(a) Customer Success Team: Primary recipients of churn scores, contributing factor analyses, and customer health scores. Customer Success team members use this data to prioritise outreach, plan retention interventions, and manage individual subscriber relationships. Access is role-based and limited to team members with a legitimate operational need.
(b) Commercial / Sales Teams: Receive churn scores and segment classifications for enterprise client accounts to inform account management strategies and renewal discussions. Access is limited to account managers assigned to the relevant accounts.
(c) Product & Engineering (Laura Dearden's team): Receives aggregated and, in some cases, individual-level contributing factor data to inform product improvement decisions. The Data Science team within Product & Engineering has access to the model training environment, including the pseudonymised training and inference datasets.
(d) Marketing Team: Receives aggregated insights only (e.g., "subscribers in segment X show elevated churn risk correlated with feature gap Y"). Individual-level churn scores are not shared with the Marketing team, and churn data is not used for direct marketing targeting.
(e) Executive Leadership: Receives aggregated and anonymised churn analytics in Board and management reporting packs. No individual-level data is included in executive reporting.
External Recipients (Processors and Sub-Processors):
(f) Pinnacle Cloud Services Ltd (Company Number: 09142837): Acts as a data processor under NTP's control. Pinnacle hosts the NorthCloud platform infrastructure, including the compute environment in which the Churn Model is trained and executed. Pinnacle's data centres are located in London (United Kingdom), Frankfurt (Germany), Amsterdam (The Netherlands), and Dublin (Ireland). All Churn Model processing occurs within these EU/UK data centres. The processing relationship is governed by the Pinnacle DPA, which was amended and executed on 28 June 2023 to align with the requirements of Article 28 GDPR and to incorporate enhanced provisions for sub-processor controls, audit rights, and breach notification (within 36 hours of awareness).
(g) Pinnacle sub-processors: The Pinnacle DPA authorises the use of the following sub-processors:
•  Pinnacle India Pvt Ltd (CIN U72200HR2016PTC065412, Gurugram, Haryana, India): Provides infrastructure support services, including monitoring and maintenance of the hosting environment. This sub-processing involves potential access to personal data hosted on Pinnacle's infrastructure. International transfer considerations are addressed in TIA-002 (Transfer Impact Assessment — Pinnacle India Pvt Ltd).
•  Pinnacle APAC Pte Ltd (UEN 201824567K, Singapore): Provides network monitoring services. International transfer considerations are addressed in TIA-003 (Transfer Impact Assessment — Pinnacle APAC Pte Ltd).
(h) Caldwell Analytics Inc. (Delaware C-corporation, 2700 Technology Drive, Suite 400, San Jose, CA 95134, USA): Network quality data inputs to the Churn Model may originate from Caldwell's network analytics platform under the Master Services Agreement dated 1 June 2021. The nature and extent of personal data flowing from Caldwell into the Churn Model pipeline, and the associated international transfer implications, are addressed separately and in detail in DPIA-011 (Caldwell Analytics Network Data Processing) and TIA-001 (Transfer Impact Assessment — Caldwell Analytics Inc., US).
No Direct Sharing of Individual Churn Scores Externally:
It is confirmed that NTP does not share individual-level churn scores or contributing factor analyses with any external third party (beyond the processors described above, acting under NTP's instructions). In the enterprise client context, individual users' churn scores are not shared with the users' employers (the enterprise client organisations), and enterprise clients do not have access to the Churn Model outputs for their individual users.
2.6 Data Flows and Architecture
The data flow architecture of the Churn Model is described below in narrative form and illustrated in the data flow diagram at Appendix A.
Step 1 — Data Ingestion: Personal data is extracted from the NorthCloud production databases, which are hosted on Pinnacle Cloud Services Ltd infrastructure within EU/UK data centres (London, Frankfurt, Amsterdam, and Dublin). The data categories extracted correspond to those described in Section 2.3(a) through (e) above. Data extraction is performed via automated ETL (Extract, Transform, Load) pipelines that run on a scheduled basis (weekly for batch processing) and in near-real-time for triggered event scoring.
Step 2 — Transformation and Pseudonymisation: Within the ETL pipeline, the extracted data is transformed (aggregated, normalised, encoded) into model features. As part of this transformation, direct identifiers (subscriber name and email address) are removed and replaced with internal subscriber IDs, achieving pseudonymisation within the meaning of Article 4(5) GDPR. The lookup table that maps subscriber IDs to direct identifiers is maintained separately, with access restricted to a named group of no more than five authorised individuals (see Section 5.4 below).
Step 3 — Model Training and Inference: The pseudonymised feature dataset is loaded into the ML training and inference environment, which is also hosted on Pinnacle infrastructure within EU/UK data centres. Model training occurs on a quarterly cycle (or more frequently if triggered by performance degradation). Inference (scoring) occurs weekly (batch) and in near-real-time (triggered events).
Step 4 — Output to CRM: Model outputs (churn probability scores, contributing factor analyses, customer health scores, and segment classifications) are written back to NTP's customer success CRM module, where they are associated with the relevant subscriber account records. At this stage, the outputs are re-associated with the subscriber's direct identifiers within the CRM for operational use by authorised personnel.
Step 5 — Dashboard and Reporting: Authorised NTP personnel (Customer Success, Commercial, Product & Engineering, and Executive leadership) access churn model outputs through dashboards and reporting interfaces within the CRM module and NTP's business intelligence platform. Access is controlled through role-based access controls, and all access is logged.
Key architectural points:
•  All processing described above occurs within Pinnacle Cloud Services Ltd's EU/UK data centre infrastructure (London, Frankfurt, Amsterdam, Dublin). There is no bulk transfer of personal data outside the EEA/UK for the Churn Model processing itself.
•  The Caldwell Analytics network quality data input pathway is a distinct upstream data flow. To the extent that network quality data inputs originate from Caldwell's platform (which is US-hosted), this involves a cross-border data transfer that is assessed separately in DPIA-011 and TIA-001. Once network quality data has been ingested into the NorthCloud production databases on Pinnacle infrastructure, it is processed within the EU/UK data centre environment in common with all other Churn Model input data.
2.7 Retention Periods
The retention periods applicable to personal data processed by the Churn Model are as follows, aligned with NTP's Data Retention Schedule (version 1.0, delivered as part of the Phase 2 data mapping exercise on 19 May 2023):
The 12-month post-termination retention period for input data is justified on the basis that it enables NTP to evaluate the accuracy and performance of the Churn Model (i.e., to validate whether subscribers predicted as high churn risk did in fact terminate) and to refine the Model accordingly. Beyond this period, the data is no longer necessary for the purposes of the Churn Model and is deleted or irreversibly anonymised.
Deletion and anonymisation processes are aligned with NTP's Data Retention Schedule and will be implemented through automated retention enforcement mechanisms to be configured in NTP's data management systems as part of the broader compliance program.
2.8 Technical and Organisational Measures in Place
NTP and its processor, Pinnacle Cloud Services Ltd, have implemented the following technical and organisational measures to protect personal data processed by the Churn Model:
Technical Measures:
(a) Encryption at rest: All personal data stored within the Churn Model processing environment (including production databases, ETL staging areas, ML training datasets, and CRM output stores) is encrypted at rest using AES-256 encryption across all Pinnacle-hosted environments.
(b) Encryption in transit: All data transmitted between components of the Churn Model architecture (including between production databases and the ETL pipeline, between the ETL pipeline and the ML environment, and between the ML environment and the CRM module) is encrypted in transit using TLS 1.3.
(c) Access controls: Role-based access controls ("RBAC") are implemented throughout the Churn Model architecture:
•  Churn scores and derived data in the CRM module are accessible only to authorised members of the Customer Success and Commercial teams, and to Laura Dearden's Product & Engineering team (for product improvement purposes).
•  The model training and inference environment is restricted to NTP's Data Science team and designated members of Laura Dearden's engineering team.
•  The pseudonymisation lookup table (mapping subscriber IDs to direct identifiers) is accessible only to a named group of no more than five authorised individuals, with access logged and reviewed monthly.
(d) Pseudonymisation: As described in Sections 2.1 and 2.6, direct identifiers (name and email address) are replaced with internal subscriber IDs within the ML pipeline. Re-identification is possible only via the separately held lookup table with restricted access. This measure reduces (but does not eliminate) the risk associated with processing within the ML environment.
(e) Logging and audit trails: All access to churn model outputs — including queries to the CRM module, dashboard views, and data exports — is logged in a centralised audit log. Logs are retained for a minimum of 12 months and are available for review by the DPO (Sanjay Mehta) and CISO (Thomas Okoye).
(f) Network and infrastructure security: Pinnacle Cloud Services Ltd maintains ISO 27001-certified data centre operations, with physical security controls (access controls, CCTV, environmental monitoring), network security controls (firewalls, intrusion detection/prevention systems, DDoS protection), and vulnerability management processes. Pinnacle's security posture is subject to annual audit by NTP pursuant to the audit rights provisions of the Pinnacle DPA.
Organisational Measures:
(g) Data Processing Agreement: The Pinnacle DPA (amended and executed 28 June 2023) governs Pinnacle's processing of personal data on NTP's behalf. The Pinnacle DPA includes provisions addressing: the subject-matter, duration, nature, and purpose of processing; the types of personal data and categories of data subjects; NTP's instructions to Pinnacle; Pinnacle's obligations regarding confidentiality, security, sub-processor management, data subject rights assistance, breach notification (within 36 hours of awareness), audit and inspection rights, and data return/deletion upon termination.
(h) Sub-processor controls: The Pinnacle DPA requires Pinnacle to obtain NTP's prior written consent before engaging any new sub-processor and to impose equivalent data protection obligations on all sub-processors. The current authorised sub-processors (Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd) are identified in the DPA, and their international transfer implications are assessed in TIA-002 and TIA-003 respectively.
(i) Staff training and awareness: NTP personnel who access churn model outputs are required to complete data protection awareness training. Specific training on the responsible use of churn scores and the prohibition on automated decision-making without human review is being developed as part of Phase 6 of the compliance program.
(j) DPO oversight: Sanjay Mehta, as NTP's DPO, maintains oversight of the Churn Model processing, including review of this DPIA, monitoring of compliance with the mitigation measures identified in Section 5, and maintenance of the ROPA entry for this processing activity.
3. ASSESSMENT OF NECESSITY AND PROPORTIONALITY
3.1 Lawful Basis
The lawful basis relied upon by NTP for the processing of personal data through the Churn Model is legitimate interest under Article 6(1)(f) GDPR / UK GDPR.
NTP's legitimate interest in the processing is the reduction of customer churn on the NorthCloud platform, the improvement of service quality and customer satisfaction, and the maintenance of the commercial viability and competitive position of NorthCloud as a product. These are recognised and genuine commercial interests that are consistent with the reasonable expectations of data subjects (as discussed further in Section 3.4 below).
A Legitimate Interest Assessment ("LIA") has been conducted for this processing activity using the three-part test template developed by Calderwood & Harkness LLP during Phase 2 of the engagement. The LIA template follows the structure recommended by the ICO and the EDPB, comprising: (i) purpose identification; (ii) necessity assessment; and (iii) balancing test. The full LIA is summarised in Appendix B and is held on file as a standalone document within the engagement records.
For context, the Churn Model processing activity is one of 64 processing activities across NTP that rely on legitimate interest as their lawful basis under Article 6(1)(f), out of a total of 147 processing activities catalogued in NTP's ROPA (version 1.0, delivered 19 May 2023). The lawful basis for each processing activity has been assessed individually through the LIA process.
Alternative lawful bases considered and rejected:
(a) Contract performance (Article 6(1)(b) GDPR): Consideration was given to whether the Churn Model processing could be justified as necessary for the performance of the subscription contract between NTP and the subscriber. This lawful basis was rejected. Whilst the subscription contract entitles the subscriber to use the NorthCloud platform, the performance of that contract does not require NTP to conduct predictive analytics on the subscriber's usage patterns or to generate churn probability scores. The Churn Model is an ancillary analytical activity that serves NTP's commercial interests in customer retention; it is not a service that the subscriber has contracted for, nor is it necessary for NTP to fulfil its contractual obligations. This interpretation is consistent with the EDPB's guidance in Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, which cautions against over-reliance on contractual necessity for processing that is not objectively necessary for the core service.
(b) Consent (Article 6(1)(a) GDPR): Consideration was given to whether consent could serve as the lawful basis for the Churn Model processing. This approach was rejected as impractical and inappropriate for the following reasons:
•  Scale: Obtaining meaningful, informed, specific, and freely given consent from approximately 2.1 million subscribers would impose a significant administrative burden and create consent fatigue among the subscriber base.
•  Withdrawal risk: Under Article 7(3) GDPR, data subjects have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent. If consent were relied upon, widespread consent withdrawal would undermine the reliability and representativeness of the Churn Model (creating selection bias in the training data and incomplete coverage in the inference outputs).
•  Freely given requirement: In the enterprise client context, where individual users access NorthCloud as part of their employer's subscription, there is a question as to whether consent can be freely given, given the imbalance of power between the employer/organisation and the individual user.
•  Legitimate interest as more appropriate: The processing is proportionate, involves strong safeguards (as set out in Section 5), and is consistent with data subjects' reasonable expectations. Legitimate interest provides a more stable, appropriate, and proportionate lawful basis.
3.2 Necessity Assessment
The necessity test under the legitimate interest assessment requires NTP to demonstrate that the specific processing carried out by the Churn Model is necessary for the purpose pursued and that the purpose cannot be achieved by less intrusive means.
NTP's Customer Success function is responsible for managing the retention and satisfaction of approximately 2.1 million active NorthCloud subscribers. Without individual-level predictive scoring, NTP cannot efficiently allocate its finite Customer Success resources across this subscriber base. The Churn Model enables NTP to identify, with a reasonable degree of accuracy, which subscribers are most at risk of churn and to direct proactive retention interventions toward those subscribers, rather than applying a uniform (and necessarily less effective) approach to all subscribers or relying on reactive intervention after a subscriber has already initiated cancellation.
Less intrusive alternatives were considered and assessed:
(a) Manual review by account managers: Under this approach, Customer Success and account management teams would manually review subscriber accounts to identify churn risk indicators. This alternative was assessed as infeasible at scale: with approximately 2.1 million active subscribers and a Customer Success team of approximately 85 staff, individual manual review of each subscriber's usage patterns, billing history, support interactions, and network quality data is not operationally viable. Manual review is effective only for NTP's largest enterprise accounts (which benefit from dedicated account managers), but it cannot scale to the broader subscriber base.
(b) Aggregate-only analytics: Under this approach, NTP would analyse churn trends at an aggregate level (e.g., by subscriber segment, geography, or product tier) without generating individual-level churn scores. This alternative was assessed as insufficient for the purpose: aggregate analytics can inform broad strategic decisions (e.g., product investment priorities, segment-level marketing), but they cannot support targeted, individual-level retention interventions. The primary purpose of the Churn Model — proactive, personalised retention outreach — requires individual-level scoring.
(c) Opt-in model: Under this approach, subscribers would be given the choice to opt in to the churn prediction analysis, and only those who opted in would be scored. This alternative was assessed as impractical and counterproductive: an opt-in approach would introduce significant selection bias into the model (subscribers who opt in may differ systematically from those who do not), rendering the model unreliable. Moreover, the subscribers most at risk of churn may be the least likely to engage with an opt-in mechanism, defeating the purpose of the exercise.
Conclusion: The specific processing carried out by the Churn Model — individual-level scoring via machine learning analysis of subscriber data — is necessary for the legitimate interest pursued. No less intrusive alternative can achieve the same purpose with equivalent effectiveness.
3.3 Proportionality Assessment
The proportionality of the processing has been assessed against the data protection principles enshrined in Article 5 GDPR:
(a) Data minimisation (Article 5(1)(c)): The Churn Model ingests only those categories of personal data that are strictly relevant to churn prediction. In particular, NTP has made a deliberate design decision to exclude message content and call content from the Model's inputs; only metadata (e.g., messaging volume, meeting frequency) is used. Similarly, payment card numbers and bank account details are excluded. Special category data is not processed. The data categories used (account data, usage metadata, support interactions, billing data, and network quality metrics) are each directly relevant to predicting churn behaviour.
(b) Purpose limitation (Article 5(1)(b)): Churn scores and derived data are used exclusively for customer retention activities and product improvement. They are not used for credit decisions, pricing discrimination, employment decisions, or shared with external third parties. This purpose limitation is enforced through organisational controls (the Churn Model Acceptable Use Policy, discussed in Section 5.5) and technical controls (purpose-limitation metadata tagging in Sundial Solutions).
(c) Storage limitation (Article 5(1)(d)): Retention periods are proportionate and time-limited. Input data is retained for the duration of the subscriber relationship plus 12 months post-termination (to enable model performance evaluation). Churn scores are retained for 24 months before anonymisation. Model training datasets are pseudonymised, with direct identifiers removed after feature extraction. These periods are aligned with NTP's Data Retention Schedule and are subject to automated enforcement.
(d) Accuracy (Article 5(1)(d)): Model performance is monitored quarterly, with metrics including precision, recall, F1 score, and calibration assessed against defined thresholds. Where model accuracy degrades, retraining is triggered. Furthermore, subscribers who are the subject of retention actions based on churn scoring may contact NTP to challenge or query those actions, providing an indirect mechanism for accuracy correction.
3.4 Balancing Test (Data Subject Rights and Freedoms)
The balancing test requires NTP to weigh its legitimate interests against the rights and freedoms of the data subjects whose personal data is processed by the Churn Model. The following factors have been considered:
Data subjects' reasonable expectations:
Enterprise and consumer subscribers of a cloud-based communications platform would reasonably expect the platform provider to analyse their usage patterns, engagement levels, and service experience for the purpose of improving the service and identifying and addressing factors that may lead to dissatisfaction. Churn prediction and proactive retention outreach are standard practices in the SaaS industry and would not come as a surprise to a reasonable subscriber. This expectation is reinforced by the fact that NTP's updated Privacy Notice (to be published as part of Phase 5) will include specific disclosure of the churn prediction processing.
Impact on data subjects:
The impact of the Churn Model on data subjects is predominantly positive or neutral. Subscribers identified as at risk of churn may receive proactive contact from NTP's Customer Success team, which may include offers of enhanced support, tailored pricing, or service adjustments — outcomes that are generally beneficial to the subscriber. The Churn Model is not used to impose adverse consequences on data subjects: there is no service termination, price increase, or withdrawal of benefits based solely on a subscriber's churn score.
The most significant potential adverse impact is the intrusiveness of profiling itself — the creation and maintenance of a predictive profile of each subscriber's behaviour and likelihood of leaving the service. However, this impact is mitigated by the safeguards described below and the transparency measures to be implemented.
Safeguards that tip the balance:
The following safeguards, described in detail in Section 5, are critical to ensuring that the balance favours NTP's legitimate interest:
•  Pseudonymisation within the ML pipeline reduces the exposure of directly identifiable data within the model training and inference environment.
•  No adverse automated decisions: No service termination, price increase, or withdrawal of benefits may occur based solely on a churn score. All material actions require human review (the "human-in-the-loop" requirement — see Section 5.1).
•  Model explainability: Interpretable contributing factor analyses enable NTP to explain churn scores and the basis for retention actions to data subjects upon request (see Section 5.3).
•  Transparency: The updated Privacy Notice will disclose the churn prediction processing, the logic involved, and the data subject's right to object (see Section 5.6).
•  Right to object: Data subjects may exercise their right to object to the churn profiling under Article 21 GDPR, and NTP will implement a process to suppress objecting subscribers' data from the Model (see Section 5.6).
Conclusion: NTP's legitimate interests in reducing churn, improving service quality, and maintaining the commercial viability of NorthCloud are not overridden by the rights and freedoms of the data subjects, provided that the mitigation measures identified in Section 5 of this DPIA are fully implemented and maintained. The processing is lawful under Article 6(1)(f) GDPR on this basis.
4. IDENTIFICATION AND ASSESSMENT OF RISKS
4.1 Risk Framework
The risks identified in this Section 4 have been assessed using a risk assessment methodology consistent with the guidance provided by the ICO (How do we do a DPIA?, updated March 2023) and the EDPB (Guidelines on Data Protection Impact Assessment, WP 248 rev.01). Risks are assessed on a matrix with two dimensions:
Likelihood — the probability that the risk will materialise:
•  Remote: The risk is theoretically possible but unlikely to occur given current circumstances and controls.
•  Possible: The risk could reasonably occur; there is a credible scenario in which it materialises.
•  Probable: The risk is more likely than not to occur, or there is evidence suggesting it is already occurring or will occur without intervention.
Severity — the impact on the rights and freedoms of data subjects if the risk materialises:
•  Minimal: The impact on data subjects would be negligible or easily reversible (e.g., minor inconvenience, no material detriment).
•  Significant: The impact on data subjects would be material but not catastrophic (e.g., unwanted profiling, inappropriate contact, potential for unfair treatment, difficulty exercising rights).
•  Severe: The impact on data subjects would be serious and potentially irreversible (e.g., significant financial loss, discriminatory treatment, substantial distress, identity theft, physical harm).
The combination of likelihood and severity produces an overall risk rating:
Risks are also categorised by type: (a) risks to the rights and freedoms of data subjects; (b) organisational and regulatory risks to NTP; and (c) reputational risks. In accordance with DPIA best practice, the primary focus of this assessment is on risks to the rights and freedoms of data subjects, as required by Article 35 GDPR. Organisational and reputational risks are noted where relevant but are secondary to the rights-based analysis.
Seven risks have been identified in relation to the Churn Model processing. Each is described in detail below.
4.2 Risk 1: Automated Decision-Making and Profiling Without Adequate Safeguards
Risk Description: The Churn Model constitutes profiling within the meaning of Article 4(4) GDPR, as it involves the automated processing of personal data to evaluate certain personal aspects relating to natural persons — specifically, to analyse and predict their behaviour (likelihood of discontinuing their NorthCloud subscription). If churn scores are used as the basis for decisions that produce legal effects concerning data subjects or that similarly significantly affect them, without adequate human intervention, the processing may engage the prohibition on solely automated decision-making under Article 22(1) GDPR.
Whilst the Model's outputs are intended to inform, rather than replace, human decision-making, there is a tangible risk that in practice, Customer Success team members and commercial staff may treat churn scores as deterministic and take automatic or near-automatic actions based solely on a subscriber's churn probability score. Examples of such actions include:
•  Automatic service downgrade or removal of promotional pricing for subscribers scored as "high churn risk" on the assumption that they are likely to leave regardless;
•  Automatic deprioritisation of support for high-churn-risk subscribers;
•  Automatic triggering of retention offers (including pricing changes) without individual assessment of the subscriber's circumstances;
•  Non-renewal decisions or changes to contract terms for enterprise accounts based predominantly on aggregate churn scoring of the account's users.
Such actions, if taken without meaningful human review, could constitute decisions based solely on automated processing that significantly affect data subjects, triggering the protections of Article 22 GDPR and potentially resulting in unfair or unjustified outcomes for individual subscribers.
Likelihood: Possible — the risk is credible given the operational pressure on Customer Success teams to act efficiently at scale, and the natural tendency to defer to algorithmic outputs.
Severity: Significant — subscribers could experience material adverse consequences (loss of promotional pricing, reduced service quality, or inappropriate contact) without individual assessment of their circumstances.
Pre-Mitigation Risk Rating: HIGH
4.3 Risk 2: Algorithmic Bias and Discrimination
Risk Description: The Churn Model is trained on historical data reflecting 24 months of NorthCloud subscriber activity. Machine learning models trained on historical data are susceptible to embedding and amplifying biases present in that data. If the historical data contains patterns that correlate churn behaviour with subscriber characteristics that serve as proxies for protected characteristics — such as geography, language, sector of employment, company size, or other factors that may correlate with racial or ethnic origin, nationality, or socioeconomic status — the Model may systematically generate higher churn probability scores for certain subscriber segments, leading to disparate treatment.
For example:
•  Subscribers based in certain EU member states may be scored as higher churn risk due to historical patterns (e.g., higher churn rates among subscribers in markets where NorthCloud was launched more recently and where the product was less mature), even though current churn risk is not genuinely elevated.
•  Subscribers from smaller enterprises may be scored as higher churn risk due to historical correlations between company size and churn, leading to reduced retention investment in smaller accounts.
•  Sector-based patterns (e.g., higher historical churn in certain industries) may lead to biased scoring that does not reflect individual subscriber circumstances.
Whilst the Churn Model does not process special category data directly, the risk of indirect discrimination (discrimination arising from facially neutral factors that correlate with protected characteristics) is a recognised concern in algorithmic decision-making. The EDPB's Guidelines on Automated Individual Decision-Making and Profiling (WP 251 rev.01) specifically identify algorithmic bias as a risk that controllers must assess and mitigate.
Likelihood: Possible — bias in historical training data is a well-documented phenomenon in machine learning, and the risk is present unless specific testing and monitoring is conducted.
Severity: Significant — biased scoring could lead to systematic unfair treatment of identifiable subscriber groups, with potential for indirect discrimination, regulatory enforcement, and reputational harm.
Pre-Mitigation Risk Rating: HIGH
4.4 Risk 3: Lack of Transparency and Explainability
Risk Description: Complex machine learning models — particularly deep learning architectures and ensemble methods such as gradient-boosted decision trees — may produce outputs that lack interpretability. If the Churn Model is a "black box" that generates churn probability scores without a clear, human-understandable explanation of why a particular score was assigned, NTP faces several related risks:
(a) Compliance with transparency obligations: Articles 13(2)(f) and 14(2)(g) GDPR require the controller to provide data subjects with "meaningful information about the logic involved, as well as the significance and the envisaged consequences" of profiling. If the Model's logic cannot be explained in meaningful terms, NTP cannot fully comply with these transparency obligations.
(b) Data subjects' ability to exercise rights: Under Article 22(3) GDPR, data subjects who are subject to solely automated decision-making (if Article 22 is engaged) have the right to obtain human intervention, to express their point of view, and to contest the decision. Effective exercise of these rights requires the data subject to understand the basis on which the decision was made. Lack of explainability undermines this right.
(c) Internal governance: If Customer Success and Commercial team members cannot understand why a subscriber received a particular churn score, they cannot exercise meaningful human oversight over the Model's outputs, increasing the risk that algorithmic outputs are accepted uncritically (compounding Risk 1).
Likelihood: Probable — the Model employs gradient-boosted ensemble methods that, whilst more interpretable than deep neural networks, still produce complex multi-feature interactions that are not immediately transparent to non-technical users. Without specific explainability tools, meaningful explanation of individual scores is difficult.
Severity: Significant — lack of transparency undermines data subjects' rights, reduces the effectiveness of human oversight, and exposes NTP to regulatory risk (particularly given the ICO's and EDPB's emphasis on transparency in algorithmic processing).
Pre-Mitigation Risk Rating: HIGH
4.5 Risk 4: Re-identification of Pseudonymised Data
Risk Description: Although the Churn Model pipeline pseudonymises direct identifiers (replacing subscriber names and email addresses with internal subscriber IDs), the combination of residual data categories — usage patterns, billing history, support ticket records, network quality metrics, and device information — may contain sufficient information to permit the re-identification of individual subscribers, either in isolation or through linkage with other datasets available to NTP or to an attacker.
Pseudonymised data remains personal data under the GDPR (Recital 26), and the risk of re-identification determines whether the safeguard of pseudonymisation provides meaningful additional protection. If the pseudonymised dataset within the ML training and inference environment could be re-identified without access to the separate lookup table, the