1022-00007 · Northgate Telecommunications PLC · DPIAs

dpia-003-northpulse-employee-wellbeing.docx DOCUMENT Finance & Banking

13 / 39 ← → ✕

Contract analysis Extract to table

DATA PROTECTION IMPACT ASSESSMENT

DPIA-003

NorthPulse Employee Wellbeing Monitoring Platform

Northgate Telecommunications PLC (Company Number 04837291)

Classification: Confidential — Legal Privileged

Prepared by:

Sara Hendricks, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP

Priscilla Wynn, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP

Reviewed by:

Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP

Client: Northgate Telecommunications PLC (Company Number 04837291)

Client Contacts Consulted:

This document has been prepared by Calderwood & Harkness LLP on the instruction of Northgate Telecommunications PLC and is subject to legal professional privilege. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the client. Nothing in this document constitutes legal advice to any person other than the client.

Right-click to update Table of Contents

1. Executive Summary

This Data Protection Impact Assessment ("DPIA") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Northgate Telecommunications PLC ("NTP" or the "Company") in respect of the NorthPulse Employee Wellbeing Monitoring Platform ("NorthPulse" or the "Platform"). This DPIA forms part of the comprehensive GDPR compliance programme being conducted by C&H under Engagement Reference SC/NTP/2023-0213/PDS, and is designated DPIA-003 in the programme's DPIA register.

NorthPulse is an internal employee wellbeing monitoring platform that has been developed and deployed by NTP across its United Kingdom and European Union operations. The Platform collects and processes employee health and wellbeing data across several categories, including self-reported stress levels, mental health indicators, sleep quality metrics, physical activity data derived from optional wearable device integrations, and engagement survey responses. The Platform is designed to generate both individual-level wellbeing insights for employees and aggregate-level dashboards and trend analyses for management and HR decision-making.

The processing activities associated with NorthPulse encompass approximately 11,400 employees globally, of whom approximately 8,200 are based in the United Kingdom and European Union jurisdictions. In addition, the Platform's scope potentially extends to approximately 28,000 contractors, temporary workers, and other data subjects who fall within the broader HR processing ecosystem managed by Philippa Crane's People & HR function.

This DPIA was triggered under GDPR Article 35(1) and Article 35(3) on the basis of four overlapping criteria that collectively necessitate a data protection impact assessment:

(a) the processing involves special category data, specifically health data within the meaning of Article 9 of the GDPR, including self-reported stress levels, mental health indicators, sleep quality metrics, and biometric-adjacent data derived from wearable devices;

(b) the processing involves systematic monitoring of employees within the meaning of Article 35(3)(c), as the Platform is designed to track wellbeing indicators on an ongoing basis across the organisation;

(c) the processing involves evaluation and scoring of individuals, particularly through the generation of wellbeing scores, burnout risk scores, and engagement indices that assess and profile individual employees; and

(d) the processing involves data subjects who may be considered vulnerable in the data protection context, given the inherent power imbalance in the employer-employee relationship, which may affect the ability of employees to freely consent to or refuse participation in monitoring activities.

This DPIA has been classified as HIGH RISK. It is one of five DPIAs classified as high risk out of the eleven DPIAs conducted during the Phase 3 engagement workstream, alongside DPIA-001 (Customer Behavioural Analytics Platform), DPIA-007 (Automated Fraud Detection System), DPIA-008 (Biometric Access Control Systems), and DPIA-011 (Third-Party Marketing Data Enrichment Programme).

The key risks identified in this assessment are as follows:

• Erosion of employee autonomy: The deployment of an employer-operated wellbeing monitoring platform creates a risk that employees will feel compelled to participate and to disclose sensitive health information, even where participation is nominally voluntary, due to the power imbalance inherent in the employment relationship.

• Coercive data collection environment: Employees may reasonably perceive non-participation as reflecting negatively on their engagement or commitment to the organisation, creating a chilling effect that undermines the validity of any consent obtained.

• Potential for discriminatory outcomes: Wellbeing and burnout scores may correlate with protected characteristics, including disability, mental health conditions, and pregnancy, giving rise to a risk of discriminatory treatment or adverse inferences.

• Function creep: There is a material risk that wellbeing data collected for the stated purpose of supporting employee health may be repurposed for performance management, disciplinary proceedings, redundancy selection, or other adverse employment decisions.

• Inadequate lawful basis: The processing of special category health data in the employment context presents significant challenges in establishing a lawful basis under Article 9, particularly given the limitations on consent in the employer-employee relationship.

The mitigation measures recommended in this DPIA include the implementation of a genuinely voluntary participation model with demonstrable absence of adverse consequences for non-participation, the anonymisation of all aggregate reports with a minimum aggregation threshold of 25 employees per reportable unit, strict data minimisation measures including limiting wearable device data to step count and sleep duration only, robust purpose limitation safeguards enforced through both technical and contractual controls, enhanced transparency through a comprehensive NorthPulse-specific privacy notice and internal communications campaign, and governance controls including quarterly DPO oversight reviews and annual DPIA re-assessment.

Following the implementation of all recommended mitigation measures, the residual risk assessment has been reduced from HIGH to MEDIUM. This residual risk level has been assessed as acceptable by the DPO, Sanjay Mehta, subject to the full implementation of all mitigation measures prior to the Platform's deployment across NTP's operations.

2. Introduction and Scope

2.1 Purpose of this DPIA

This Data Protection Impact Assessment has been conducted pursuant to Article 35 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and Article 35 of the UK GDPR (as incorporated into domestic law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018), which require data controllers to carry out an assessment of the impact of envisaged processing operations on the protection of personal data where the processing is likely to result in a high risk to the rights and freedoms of natural persons.

This DPIA forms part of the comprehensive GDPR compliance programme being conducted by Calderwood & Harkness LLP for Northgate Telecommunications PLC under Engagement Reference SC/NTP/2023-0213/PDS. The engagement was opened on 13 February 2023 and has been structured across five workstream phases:

• Phase 1 (February–March 2023): Scoping, data mapping, and gap analysis, conducted with the support of Ashdown Consulting Group Ltd as specialist privacy engineering consultants;

• Phase 2 (March–May 2023): Development of the compliance framework, including policies, procedures, templates, and the Legitimate Interest Assessment template;

• Phase 3 (22 May–7 July 2023): Conduct of Data Protection Impact Assessments across eleven identified processing activities, including this DPIA-003;

• Phase 4 (ongoing): International transfer assessments and Transfer Impact Assessments; and

• Phase 5 (ongoing): Implementation support and remediation oversight.

Phase 3 commenced on 22 May 2023. All eleven DPIAs were completed by 7 July 2023, in accordance with the project timeline agreed with the NTP Board Audit & Risk Committee.

The decision to undertake a comprehensive DPIA programme was mandated by the NTP Board Audit & Risk Committee pursuant to a resolution dated 8 December 2022. That resolution was adopted in the context of NTP's heightened regulatory risk profile and the Board's recognition that NTP's data protection compliance posture required material improvement. The resolution authorised the engagement of external counsel and the allocation of internal resources necessary to complete the compliance programme.

2.2 Scope of the Processing Under Assessment

This DPIA assesses the NorthPulse Employee Wellbeing Monitoring Platform as deployed across the following NTP entities:

United Kingdom operations:

NTP PLC (Company Number 04837291) operates from its principal offices in the United Kingdom. In the course of Phase 1, a comprehensive Record of Processing Activities ("ROPA") was compiled, cataloguing a total of 89 processing activities attributable to the UK controller entity. The NorthPulse Platform constitutes one of these processing activities and is cross-referenced in the ROPA at Activities UK-HR-012 through UK-HR-018, reflecting the distinct data collection, analysis, reporting, wearable integration, occupational health, and retention activities associated with the Platform.

EU subsidiary operations:

NTP operates through five EU subsidiary entities, collectively accounting for 58 processing activities catalogued in the ROPA. The EU subsidiaries within the scope of this DPIA are:

The NorthPulse Platform is intended for deployment across all of these subsidiary operations, and the scope of this DPIA encompasses the processing activities of each subsidiary in connection with the Platform, including jurisdiction-specific considerations arising from local employment law and data protection implementing legislation.

NorthPulse is one of 14 processing activities identified across NTP's operations as involving the processing of special category data within the meaning of Article 9 of the GDPR. The special category data processed by NTP across these 14 activities includes primarily employee health data, trade union membership information, and biometric data processed by biometric access control systems. This DPIA is concerned specifically with the employee health data processed through the NorthPulse Platform.

2.3 Background and Context

The NorthPulse Platform was introduced by Philippa Crane, NTP's Head of People & HR, as a central component of the Company's post-pandemic employee wellbeing strategy. The initiative was developed in response to the significant changes in working patterns and employee wellbeing challenges experienced across the telecommunications sector following the COVID-19 pandemic, including increased rates of remote and hybrid working, elevated levels of employee stress and burnout, and concerns about employee engagement and retention.

The Platform was designed to be integrated with NTP's existing HR systems, which are managed by Philippa Crane's function, and was intended to provide both individual employees and the organisation as a whole with enhanced insight into wellbeing trends and potential areas of concern. The business case for the Platform, as articulated by Philippa Crane during the consultation process, centred on NTP's corporate responsibility commitments and its stated objective of creating a supportive and sustainable working environment across its operations.

NTP is a public limited company listed on the London Stock Exchange, with reported revenue of £2.47 billion for the financial year ended 31 March 2022. The Company employs a complex multi-jurisdictional workforce spanning the United Kingdom and five European Union Member States, as well as operations in other international jurisdictions not within the scope of this DPIA. The organisational scale and geographic complexity of NTP's workforce are material factors in this assessment, particularly in relation to the challenges of implementing consistent data protection safeguards across multiple jurisdictions with varying employment law and data protection regulatory frameworks.

The regulatory context in which this DPIA has been prepared is one of heightened scrutiny. NTP has a recent regulatory history that is directly relevant to this assessment:

(a) ICO Enforcement Notice ENF/2021/0934 (15 September 2021): The Information Commissioner's Office issued an enforcement notice to NTP PLC, accompanied by a monetary penalty of £320,000, in respect of inadequate consent mechanisms deployed across certain of the Company's consumer-facing digital services. The enforcement action identified failures in the Company's approach to obtaining valid consent for the processing of personal data, including concerns about the clarity and specificity of consent requests and the mechanisms for recording and managing consent. While the enforcement action related to consumer data processing rather than employee data, it is indicative of systemic weaknesses in NTP's approach to consent management that are directly relevant to the consent-based processing envisaged under NorthPulse.

(b) DPC Preliminary Inquiry IN-22-11-3 (active): The Data Protection Commission (Ireland), acting as the lead supervisory authority for NTP's EU cross-border processing operations (given that Northgate Ireland Ltd is the Company's largest EU establishment), has an active preliminary inquiry in respect of certain aspects of NTP's cross-border data processing activities. The specific scope and current status of this inquiry are subject to confidential communications between NTP and the DPC, but the existence of the inquiry heightens the regulatory sensitivity of any new processing activities introduced across NTP's EU operations.

NTP's ICO Registration Number is ZA482917. The lead data protection authority for NTP's EU processing activities is the Data Protection Commission (Ireland), reflecting the Company's principal EU establishment in Dublin.

2.4 Consultation Process

In accordance with Article 35(2) of the GDPR, which requires the controller to seek the advice of the data protection officer when carrying out a data protection impact assessment, and in accordance with good practice for DPIA preparation, the following individuals and organisations were consulted during the preparation of this DPIA:

Philippa Crane, Head of People & HR, NTP PLC. Ms Crane was consulted in her capacity as the business owner and sponsor of the NorthPulse Platform. Consultations with Ms Crane covered the Platform's functionality and feature set, the HR purposes for which the Platform was designed, employee engagement objectives, and the intended use cases for workforce analytics derived from the Platform's outputs. Ms Crane provided information regarding the genesis of the Platform, the post-pandemic wellbeing strategy of which it forms a part, and the feasibility of implementing the voluntary participation model recommended in this assessment. Ms Crane was consulted on 31 May 2023, 14 June 2023, and 26 June 2023, with follow-up written queries addressed between sessions.

Sanjay Mehta, Data Protection Officer, NTP PLC. Mr Mehta (CIPP/E certified, appointed to the DPO role in March 2019) was consulted throughout the DPIA process in accordance with Article 35(2). Mr Mehta's input covered the lawful basis analysis for both Article 6 and Article 9 processing, the assessment of data subject rights and the mechanisms for their exercise in the context of NorthPulse, the regulatory risk profile of the processing given NTP's enforcement history, and the DPO's independent opinion on the acceptability of the residual risk. Mr Mehta was consulted on 25 May 2023, 7 June 2023, 19 June 2023, and 2 July 2023.

Thomas Okoye, Chief Information Security Officer, NTP PLC. Mr Okoye was consulted in respect of the technical and organisational security measures applied to the NorthPulse Platform, including encryption standards, role-based access controls, pseudonymisation techniques deployed in analytics pipelines, audit logging capabilities, and the security assessment and penetration testing programme. Mr Okoye was consulted on 1 June 2023 and 20 June 2023.

Laura Dearden, Vice President, Product & Engineering, NorthCloud. Ms Dearden was consulted in respect of the technical architecture of the NorthPulse Platform, including the application layer design, data flow architecture, hosting arrangements with Pinnacle Cloud Services Ltd, integration points with existing HR systems, and the technical feasibility of implementing anonymisation and access control measures. Ms Dearden was consulted on 6 June 2023.

Ashdown Consulting Group Ltd (Robert Fairclough, Managing Director; Anita Chakravarti, Lead Privacy Engineer). Ashdown Consulting was engaged by NTP to provide specialist privacy engineering support during Phase 1 of the compliance programme. In the context of this DPIA, Ashdown Consulting provided the data mapping outputs for NorthPulse-related processing activities, conducted the Sundial Solutions platform integration analysis for NorthPulse consent management workflows, and advised on technical data flow design. Ashdown Consulting was consulted on 29 May 2023 and 15 June 2023.

Employee representatives and works councils. In jurisdictions where employee representation bodies have co-determination or consultation rights in respect of employee monitoring systems, consultation was undertaken or initiated as follows:

(a) Germany (Northgate GmbH): The works council (Betriebsrat) of Northgate GmbH was consulted in accordance with the requirements of the Works Constitution Act (Betriebsverfassungsgesetz — "BetrVG"), specifically Section 87(1)(6) BetrVG, which confers co-determination rights on the works council in respect of the introduction and application of technical devices designed to monitor the behaviour or performance of employees. The consultation process was initiated on 12 June 2023, with a formal information package provided to the works council chair. As at the date of this DPIA, the works council consultation is ongoing and deployment at Northgate GmbH is contingent upon the satisfactory completion of this process.

(b) France (Northgate France SAS): Employee representative consultation was initiated in accordance with the French Labour Code (Code du travail) provisions governing the introduction of employee monitoring technologies. The Comité Social et Économique (CSE) of Northgate France SAS was formally consulted on 19 June 2023. As at the date of this DPIA, the CSE has provided preliminary observations and the consultation is ongoing.

3. Systematic Description of the Processing

3.1 Nature of the Processing

The NorthPulse Platform processes employee wellbeing data through several distinct but interconnected data collection and analysis mechanisms. The nature of the processing can be described across the following activity categories:

Self-reported surveys. The Platform administers two categories of survey instruments to participating employees. First, weekly "pulse surveys" consisting of a short questionnaire (typically five to eight questions) designed to capture a snapshot of the employee's current wellbeing state, including self-assessed stress levels, mood indicators, and workload perceptions. Second, quarterly "deep-dive questionnaires" comprising a more comprehensive instrument (typically 30 to 45 questions) covering a broader range of wellbeing dimensions, including mental health indicators, physical health status, work-life balance, social connectedness, and job satisfaction. Survey responses are recorded at the individual employee level and are associated with the employee's profile within the Platform.

Optional wearable device integration. The Platform offers an optional integration with consumer wearable devices (including fitness trackers and smartwatches) that allows participating employees to share certain health and activity data with the Platform. The data categories currently capable of being imported via wearable integration include step counts, sleep duration and quality metrics, and heart rate variability data. Wearable device integration is presented as an optional additional feature and requires a separate technical connection to be established by the employee. As discussed in Section 7.3 below, this DPIA recommends that the scope of wearable data collection be significantly restricted.

Platform engagement metrics. The Platform records certain behavioural data relating to each employee's interaction with the Platform itself, including login frequency, duration of Platform sessions, and the utilisation of specific wellbeing resources and features offered through the Platform (such as meditation guides, exercise programmes, or mental health support resources).

Manager wellbeing check-in records. The Platform provides a facility for line managers to record the outcomes of structured wellbeing check-in conversations conducted with their direct reports. These check-in records capture the manager's assessment of the employee's stated wellbeing status, any concerns raised by the employee, and any actions agreed. The manager who inputs this data is also a data subject in respect of the record created.

Aggregation and analysis. Individual-level data collected through the mechanisms described above is aggregated and analysed to produce team-level, department-level, and entity-level wellbeing dashboards. These dashboards present anonymised and aggregated metrics designed to provide management with visibility into organisational wellbeing trends without disclosing the data of individual employees.

Trend analysis and predictive modelling. The Platform incorporates analytical capabilities designed to identify trends in employee wellbeing data over time and to apply predictive models to estimate burnout risk and attrition probability. As currently configured, these predictive models are capable of generating outputs at the individual employee level, although this DPIA recommends that individual-level predictive scoring be discontinued in favour of anonymised cohort-level modelling (see Section 7.3).

Personalised wellbeing recommendations. Based on the individual employee's survey responses, engagement data, and (where applicable) wearable device data, the Platform generates personalised wellbeing recommendations and suggested resources tailored to the employee's apparent needs. These recommendations are visible only to the individual employee.

Integration with HR systems. NorthPulse data is integrated with NTP's broader HR systems for the purpose of workforce planning analytics. This integration allows HR to correlate wellbeing trends with workforce metrics such as absenteeism rates, turnover rates, and organisational restructuring planning. The extent and nature of this integration is a key concern addressed in the purpose limitation analysis in Section 4.3 and the mitigation measures in Section 7.4.

3.2 Categories of Personal Data

The following categories of personal data are processed through the NorthPulse Platform:

Identification data: Employee name, unique employee identification number, corporate email address, department, team, reporting line (direct manager), and employment location (office, region, and country).

Special category data (Article 9 GDPR): The Platform processes health data within the meaning of Article 9(1) of the GDPR. This includes self-reported data relating to stress levels, mental health indicators (including self-assessed anxiety, depression, and emotional wellbeing), physical health conditions disclosed through survey responses, and sleep quality metrics. Where employees opt into wearable device integration, the Platform additionally processes data derived from wearable devices, including step counts, sleep duration and quality data, and heart rate variability data. While step count and sleep duration data may not in all cases constitute health data, the European Data Protection Board and the Article 29 Working Party have adopted a broad interpretation of "data concerning health" under Article 9, and in the context of a platform specifically designed to assess employee wellbeing, all such data is treated as health data for the purposes of this assessment. This conservative classification is appropriate and prudent given NTP's regulatory risk profile.

Behavioural data: Data relating to the employee's engagement with the Platform itself, including login frequency, session duration, survey completion rates, and utilisation of specific wellbeing resources and features.

Employment data: The employee's role, department, seniority level, tenure with the organisation, and working pattern (remote, hybrid, or office-based). This data is drawn from NTP's existing HR systems and linked to the employee's NorthPulse profile for contextual analysis purposes.

Derived and inferred data: The Platform generates derived data through analysis of the primary data categories described above. This includes wellbeing scores (composite indices reflecting an employee's overall wellbeing based on survey responses and other inputs), burnout risk scores (predictive assessments of the likelihood that an employee is at risk of burnout), and engagement indices (measures of the employee's engagement with the Platform and with organisational wellbeing initiatives). These derived data points constitute personal data in their own right and, to the extent that they reveal or are capable of revealing information about the employee's health status, may also constitute special category data.

3.3 Categories of Data Subjects

The data subjects affected by the NorthPulse processing activities are:

(a) Employees: Approximately 8,200 full-time and part-time employees of NTP PLC and its EU subsidiaries in the jurisdictions described in Section 2.2 above. If the Platform is extended to NTP's operations beyond the UK and EU (which is under consideration but not currently in scope), the total employee population would be approximately 11,400.

(b) Contractors and temporary workers: The NorthPulse Platform is potentially capable of being extended to the approximately 28,000 contractors, temporary workers, and other non-employee individuals who fall within the broader scope of NTP's HR processing activities. As at the date of this DPIA, contractors and temporary workers have not been included in the NorthPulse deployment, but the potential for future inclusion has been considered in this assessment.

(c) Managers: Line managers who input wellbeing check-in records through the Platform are themselves data subjects in respect of the records they create, which may contain information attributable to the manager (such as the fact and timing of check-in conversations, and the manager's recorded observations).

3.4 Purpose of the Processing

The purposes of the processing conducted through the NorthPulse Platform have been identified and documented as follows:

Primary purpose: Supporting employee wellbeing and identifying organisational wellbeing trends across NTP's workforce. This encompasses providing individual employees with personalised wellbeing insights, resources, and recommendations; monitoring organisational wellbeing at the team, department, and entity level; and identifying areas of concern that may require targeted wellbeing interventions.

Secondary purposes: The following secondary purposes have been identified:

(a) Informing HR policy decisions relating to employee wellbeing, working conditions, and workplace culture based on aggregate wellbeing trend data;

(b) Reducing employee absenteeism and attrition by enabling early identification of wellbeing risks and deployment of supportive interventions;

(c) Fulfilling the employer's duty of care obligations towards its employees, including obligations arising under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999 in respect of mental health and psychosocial risks in the workplace; and

(d) Supporting workforce planning by integrating wellbeing trend data with broader HR analytics to inform decisions about resource allocation, organisational design, and talent management strategy.

The business justification for the Platform, as articulated by Philippa Crane during consultation, is that NorthPulse represents a core component of NTP's post-pandemic wellbeing initiative, which is itself aligned with the Company's published corporate responsibility commitments and its stated ambition to be recognised as an employer of choice in the telecommunications sector. Ms Crane emphasised that the Platform was conceived as a supportive tool rather than a surveillance mechanism, and that the Company's intention was to use wellbeing data to improve working conditions and provide targeted support to employees, rather than to monitor individual performance or behaviour.

3.5 Data Flows and Recipients

Data collection and hosting. Employee wellbeing data is collected through the NorthPulse application, which is hosted on infrastructure provided by Pinnacle Cloud Services Ltd (Company Number 09142837). Pinnacle Cloud Services Ltd acts as a data processor on behalf of NTP in respect of the NorthPulse hosting services. The data processing arrangements between NTP and Pinnacle are governed by a data processing agreement, which was amended and re-executed on 28 June 2023 as part of the compliance programme's Phase 2 deliverables (the "Amended DPA"). NorthPulse data is hosted in Pinnacle data centres located in London, United Kingdom and Dublin, Ireland.

Internal recipients. The following internal functions and individuals have access to NorthPulse data, subject to the role-based access controls described in Section 3.7:

(a) HR team (Philippa Crane's function): Designated members of the People & HR function have access to individual-level wellbeing data for the purpose of providing wellbeing support and administering the Platform. Access is limited to named individuals within the HR function who have been authorised and trained.

(b) Line managers: Line managers have access to aggregate-level dashboards only, presenting anonymised and aggregated wellbeing metrics for their respective teams. Line managers do not have access to individual-level wellbeing data for any of their direct reports.

(c) Occupational health team: Designated members of the occupational health function have access to individual-level wellbeing data where this is necessary for the provision of occupational health support, subject to the employee's consent and appropriate confidentiality safeguards.

(d) Data Protection Officer (Sanjay Mehta): The DPO has access to NorthPulse data for the purpose of compliance oversight, audit, and the exercise of the DPO's functions under Article 39 of the GDPR.

Sub-processor involvement. Pinnacle Cloud Services Ltd maintains a sub-processor chain that includes Pinnacle India Pvt Ltd (CIN: U72200HR2016PTC065412, Gurugram, Haryana, India), which provides infrastructure support services for the Pinnacle hosting environment, and Pinnacle APAC Pte Ltd (Singapore), which provides certain ancillary technical services. The involvement of Pinnacle India Pvt Ltd gives rise to international transfer implications, as NorthPulse data hosted on the Pinnacle infrastructure may be accessible to Pinnacle India personnel during the course of infrastructure support activities. The international transfer risk associated with this sub-processor arrangement is addressed in Risk 8 (Section 6.2) and the mitigation measures in Section 7.9.

It is noted that no planned transfer of NorthPulse data to Caldwell Analytics Inc. (the US-based analytics provider engaged by NTP in respect of certain other processing activities) has been identified. NorthPulse data is not transferred to the United States for any purpose associated with this processing activity.

Consent management. The Sundial Solutions privacy management platform, as configured by Ashdown Consulting Group Ltd, is utilised for the management of consent records in respect of NorthPulse, including the recording of consent given, the management of consent withdrawal requests, and the documentation of consent status for each data subject and each data collection element.

3.6 Data Retention

The following retention periods apply to the categories of personal data processed through NorthPulse, as aligned with NTP's Data Retention Schedule (version 2.0, updated as part of the Phase 2 compliance programme deliverables):

These retention periods have been assessed as proportionate to the purposes for which the data is processed, subject to the recommendation that wearable device data should not be retained for more than six months in identifiable form, reflecting the heightened sensitivity of this data category and the limited necessity for long-term retention.

3.7 Technical and Organisational Measures

The following technical and organisational measures have been implemented or are planned for implementation in respect of the NorthPulse processing activities:

Encryption. All NorthPulse data is encrypted at rest using the Advanced Encryption Standard with 256-bit key length (AES-256) and in transit using Transport Layer Security version 1.3 (TLS 1.3). These encryption standards are consistent with the supplementary technical measures applied across NTP's processing activities as documented in the Technical and Organisational Measures Register maintained by Thomas Okoye's information security function.

Role-based access controls. Access to NorthPulse data is governed by a role-based access control framework that restricts access to personal data based on the recipient's organisational role and the legitimate purpose for which access is required. Under this framework, individual-level wellbeing data is accessible only to the individual employee to whom it relates and to designated members of the HR and occupational health functions who have been authorised and trained to handle such data. Line managers have access only to anonymised and aggregated team-level dashboards, with no ability to drill down to individual employee data.

Pseudonymisation. Data processed through the NorthPulse analytics pipeline is subject to pseudonymisation measures, whereby direct identifiers (employee name, email address, and employee ID) are replaced with pseudonymous identifiers before data is processed for aggregation and trend analysis purposes. The pseudonymisation key is held separately from the pseudonymised data and is accessible only to authorised personnel within the HR function.

Audit logging. All access to individual-level NorthPulse records is subject to comprehensive audit logging, which records the identity of the user accessing the data, the date and time of access, the nature of the access (read, modify, or delete), and the specific records accessed. Audit logs are reviewed on a quarterly basis by the DPO as part of the ongoing compliance oversight programme.

Data minimisation. The Platform is configured to collect only the categories of personal data that are strictly necessary for the stated wellbeing assessment purposes, as documented in the data inventory compiled during Phase 1.

Security testing. The NorthPulse hosting environment is subject to regular penetration testing and vulnerability assessments, overseen by Thomas Okoye in his capacity as CISO. The most recent penetration test of the Pinnacle hosting environment was conducted in April 2023, and no critical vulnerabilities were identified. The next scheduled penetration test is due in October 2023.

4. Assessment of Necessity and Proportionality

4.1 Necessity

Article 35(7)(b) of the GDPR requires that a DPIA include an assessment of the necessity of the processing operations in relation to the purposes. This section assesses whether the processing activities described in Section 3 are necessary to achieve the stated purposes identified in Section 3.4.

The stated primary purpose of NorthPulse is supporting employee wellbeing and identifying organisational wellbeing trends. The question of necessity therefore centres on whether the collection and processing of individual-level employee health and wellbeing data — including special category data — is necessary to achieve this purpose, or whether the same purpose could be achieved through less intrusive means.

The following alternative approaches have been considered:

(a) Anonymous surveys without individual tracking. Organisational wellbeing trends could be identified through anonymised survey instruments that do not link responses to individual employees. This approach would significantly reduce the privacy impact of the processing, as no individual-level health data would be collected or retained. However, this approach would not support the generation of personalised wellbeing recommendations to individual employees, nor would it enable targeted wellbeing interventions for individuals identified as being at risk.

(b) Voluntary opt-in only, with no wearable integration. Limiting participation to a genuinely voluntary opt-in model and removing the wearable device integration would reduce the scope of data collection and the associated privacy risks. This approach would preserve the ability to generate personalised insights for participating employees while reducing the risk of coercive data collection.

(c) Periodic organisational culture audits. NTP could commission periodic organisational culture and wellbeing audits conducted by external providers, using anonymised methodologies, to assess organisational wellbeing trends without the need for continuous individual-level monitoring. This approach would provide periodic snapshots of organisational health but would not support real-time trend analysis or individual-level support.

Having considered these alternatives, it is concluded that individual-level data processing is not strictly necessary for all of the stated purposes. Specifically:

• Organisational trend analysis and HR policy-making can be effectively supported by aggregate, anonymised data. Individual-level tracking is not necessary for these purposes and introduces disproportionate privacy risks.

• Personalised wellbeing recommendations do require individual-level data processing, but this purpose can only justify the collection and processing of the minimum data necessary to generate such recommendations, and only for employees who have voluntarily opted to receive them.

• The wearable device integration collects granular biometric-adjacent health data that is not strictly necessary for the wellbeing assessment purposes. The same wellbeing insights can be obtained from self-reported survey data alone.

Accordingly, while the processing is necessary for certain elements of the stated purpose (particularly the provision of personalised wellbeing support to voluntarily participating employees), the current scope of data collection and processing exceeds what is strictly necessary, and the data minimisation measures recommended in Section 7.3 are required to bring the processing within the bounds of necessity.

4.2 Proportionality

The proportionality assessment requires balancing the employer's legitimate interest in supporting employee wellbeing against the fundamental right to privacy and data protection of the employees whose data is processed. This balancing exercise is particularly complex in the employment context due to the inherent power imbalance in the employer-employee relationship.

The power imbalance between employer and employee is a well-recognised concern in data protection law, extensively addressed in the guidance of both the ICO and the European Data Protection Board. The EDPB's Opinion 2/2017 on Data Processing at Work emphasised that employees are rarely in a position to freely give, refuse, or revoke consent, given the dependency inherent in the employment relationship. The ICO's Employment Practices Code — Monitoring at Work similarly acknowledges that the imbalance of power may affect the voluntariness of any consent provided by employees and that employers must be especially cautious when processing employee data.

In the context of NorthPulse, this power imbalance manifests in several ways:

(a) Employees may feel that non-participation in the Platform will be perceived negatively by management, even if the Company states that participation is voluntary. The fear of implicit consequences — such as being viewed as disengaged, unsupportive of corporate initiatives, or having something to hide — may effectively coerce participation.

(b) The integration of NorthPulse with NTP's HR systems creates a risk that employees will perceive a link between their wellbeing data and employment decisions, even where no such link is intended or permitted.

(c) The generation of individual-level wellbeing and burnout risk scores creates a risk that employees will be profiled and assessed on the basis of their health data, potentially to their detriment.

The proportionality assessment further considers the nature and sensitivity of the data involved. Self-reported mental health indicators, stress levels, and data from wearable health devices are among the most sensitive categories of personal data, and their processing in the employment context requires the most compelling justification and the most robust safeguards.

Wearable device integration has been assessed as disproportionate for any mandatory deployment. The collection of granular biometric-adjacent data from wearable devices (including heart rate variability and continuous sleep monitoring) goes significantly beyond what is necessary for organisational wellbeing monitoring and represents a level of intrusion into the employee's private life that is difficult to justify in the employment context. Wearable integration is acceptable only on the basis of strictly voluntary, informed, and granular consent, and with the scope of data collection restricted as set out in Section 7.3.

Predictive burnout modelling at the individual level has been assessed as disproportionate. The generation of individual-level predictive burnout risk scores amounts to profiling within the meaning of Article 4(4) of the GDPR and creates a material risk of adverse consequences for the data subject, including the potential for discriminatory treatment based on health-related predictions. The recommendation is that predictive burnout modelling be limited to anonymised cohort-level analysis, which can provide meaningful organisational insights without the privacy risks associated with individual-level prediction.

4.3 Purpose Limitation

A significant risk identified in this assessment is the risk of function creep: the gradual expansion of the purposes for which NorthPulse data is used beyond the originally stated wellbeing purposes, potentially to the detriment of data subjects.

The specific function creep risks identified include:

(a) Performance management: Wellbeing data could be used to assess whether an employee is performing below expectations due to stress or mental health difficulties, and this assessment could influence performance review outcomes.

(b) Disciplinary decisions: An employee's wellbeing profile could be considered as a factor in disciplinary proceedings, for example where low engagement scores or declining wellbeing metrics are interpreted as indicators of disengagement or poor attitude.

(c) Redundancy selection: In a redundancy exercise, wellbeing data could be used as a criterion (explicitly or implicitly) for selecting employees for redundancy, particularly where burnout risk scores are perceived as indicators of reduced future productivity.

(d) Insurance assessments: Wellbeing data could be shared with group insurance providers as part of underwriting assessments or claims management processes, potentially affecting employees' insurance terms or eligibility.

Each of these secondary uses would represent a fundamental departure from the stated purpose of the processing and would cause significant harm to data subjects. Strict purpose limitation safeguards — implemented through both technical controls and contractual restrictions — are required to prevent function creep and are detailed in Section 7.4.

The principle of purpose limitation under Article 5(1)(b) of the GDPR requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. NorthPulse data must not be used for any employment decision to the detriment of the data subject, and this prohibition must be enforced through binding policy, technical access controls, and ongoing governance oversight.

5. Lawful Basis Analysis

5.1 Article 6 Lawful Basis — Processing of Personal Data

The identification of an appropriate lawful basis under Article 6(1) of the GDPR is a prerequisite for all processing of personal data through the NorthPulse Platform. The following analysis considers the available lawful bases and identifies the basis most appropriate for the processing activities in question.

Legitimate interest — Article 6(1)(f). NTP has a legitimate interest in supporting the wellbeing of its employees, meeting its duty of care obligations, reducing absenteeism and attrition, and maintaining an engaged and productive workforce. These interests are real, current, and directly connected to the processing activities conducted through NorthPulse. A legitimate interest assessment ("LIA") has been conducted using the LIA template developed during Phase 2 of the compliance programme, and a summary is provided at Annex C.

However, legitimate interest under Article 6(1)(f) cannot serve as the lawful basis for the processing of special category data under Article 9 — a separate condition must be identified and satisfied under Article 9(2). Even in respect of non-special-category data processed through NorthPulse, the balancing test required by Article 6(1)(f) is challenging in the employment context. The legitimate interest of the employer must be weighed against the interests, rights, and freedoms of the employees, taking into account the power imbalance, the sensitivity of the data (even where it does not reach the threshold of special category data), and the reasonable expectations of the data subjects. Across NTP's operations as a whole, legitimate interest was identified as the lawful basis for 64 of the Company's 147 catalogued processing activities (approximately 43.5%), but particular scrutiny is warranted in the employment wellbeing monitoring context.

The LIA concluded that the employer's legitimate interest outweighs the impact on data subjects for the non-special-category elements of NorthPulse processing (identification data, employment data, and platform engagement metrics), subject to the implementation of the safeguards described in this DPIA. The balancing test is satisfied on the basis that the processing is conducted with robust transparency, data minimisation, purpose limitation, and access control measures, and that employees are provided with a genuine and effective right to object.

Consent — Article 6(1)(a). Consent is a problematic lawful basis in the employment context. Both the European Data Protection Board (in Opinion 2/2017 and subsequent guidance) and the ICO (in its Employment Practices Code) have consistently stated that consent is rarely freely given by employees, owing to the power imbalance inherent in the employment relationship. An employee may feel unable to refuse consent or to withdraw it without fear of adverse consequences, even where the employer states that no such consequences will follow.

If consent is relied upon as the Article 6 lawful basis, it must be genuinely voluntary with no adverse consequences for refusal, specific to each element of processing, informed through clear and accessible information, and unambiguous. The burden is on the controller to demonstrate that these requirements are satisfied, and the controller must accept that consent may be withdrawn at any time without detriment to the data subject.

Given the inherent difficulties with consent in the employment context, consent should not be the sole Article 6 lawful basis for NorthPulse processing. Reliance on consent as the primary Article 6 basis creates a fragile compliance position, as any challenge to the validity of the consent would undermine the lawful basis for the entire processing activity.

Recommendation. Article 6(1)(f) (legitimate interest) is recommended as the primary lawful basis for the non-special-category processing elements of NorthPulse, subject to the completion of a robust LIA (summarised at Annex C) and the implementation of all safeguards and mitigation measures detailed in this DPIA. Consent under Article 6(1)(a) should not be relied upon as the sole Article 6 basis due to the power imbalance concerns described above.

5.2 Article 9 Condition — Special Category Data (Health Data)

The processing of health data through NorthPulse constitutes processing of special categories of personal data within the meaning of Article 9(1) of the GDPR. Such processing is prohibited unless one of the conditions set out in Article 9(2) is satisfied. The following conditions have been considered:

Explicit consent — Article 9(2)(a). Explicit consent requires a freely given, specific, informed, and unambiguous indication of the data subject's wishes by which, by a statement or by a clear affirmative action, the data subject signifies agreement to the processing of their personal data. In the employment context, the requirement that consent be "freely given" is the principal challenge, for the reasons discussed in Section 5.1 above.

However, the EDPB and the ICO have acknowledged that consent in the employment context is not automatically invalid — rather, it requires particular care and safeguards to ensure that it is genuinely voluntary. Where the employer can demonstrate that participation is truly optional, that no adverse consequences follow from refusal, and that employees are fully informed of their rights, explicit consent may be a valid condition for processing special category data.

The implementation of the voluntary participation model recommended in Section 7.1 — including clear communication that non-participation will not affect employment status, promotion prospects, or any other employment decision; separate granular consent for each data collection element; and the ability to withdraw consent at any time without detriment — is designed to create the conditions in which explicit consent can be genuinely and freely given.

Employment, social security, and social protection law — Article 9(2)(b). This condition permits the processing of special category data where it is necessary for the purposes of carrying out obligations and exercising specific rights of the controller or the data subject in the field of employment, social security, and social protection law, insofar as it is authorised by Union or Member State law providing for appropriate safeguards.

This condition may apply to the extent that NorthPulse processing is necessary for the purposes of NTP's obligations under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999, which require employers to assess and manage risks to the health of their employees, including psychosocial risks and work-related stress. However, the scope of these statutory obligations is narrower than the full range of processing activities conducted through NorthPulse. The statutory duty of care requires employers to take reasonable steps to identify and mitigate workplace health risks, but it does not require the implementation of a comprehensive individual-level wellbeing monitoring platform with wearable device integration and predictive burnout modelling. Accordingly, Article 9(2)(b) can support only a narrow subset of the NorthPulse processing — specifically, processing directly related to the identification and management of occupational health risks that fall within the scope of the employer's statutory obligations.

Substantial public interest — Article 9(2)(g) / DPA 2018 Schedule 1. This condition permits the processing of special category data where it is necessary for reasons of substantial public interest, on the basis of Union or Member State law which is proportionate to the aim pursued. In the UK, the relevant implementing provision is Schedule 1 to the Data Protection Act 2018, which sets out specific substantial public interest conditions. Condition 18 of Schedule 1 (safeguarding of economic well-being of individuals) has been considered as a potential basis, but its applicability to employer-operated wellbeing monitoring platforms is uncertain, and reliance on this condition would require the preparation and maintenance of an appropriate policy document under Schedule 1, Part 4.

Recommendation. Explicit consent under Article 9(2)(a) is recommended as the primary condition for the processing of special category data through NorthPulse, supported by the implementation of the genuinely voluntary participation model detailed in Section 7.1. This recommendation is made on the basis that the voluntary participation model, if properly implemented and maintained, can create the conditions in which explicit consent is genuinely and freely given, notwithstanding the employment context. Article 9(2)(b) is recommended as a supplementary condition, but only for the narrowly-scoped processing activities that are directly required by the employer's statutory occupational health obligations under UK employment and health and safety law.

5.3 UK-Specific Considerations

The UK GDPR applies to the processing activities of NTP PLC in respect of its UK operations. The ICO is the competent supervisory authority, and NTP is registered with the ICO under Registration Number ZA482917.

Where special category data is processed in the UK in reliance on an Article 9(2) condition, the Data Protection Act 2018 imposes additional requirements. In particular, where processing is based on explicit consent (Schedule 1, Condition 1 — consent of the data subject), the controller must prepare and maintain an appropriate policy document in accordance with Schedule 1, Part 4. The appropriate policy document must set out the controller's procedures for ensuring compliance with the data protection principles, explain the controller's policies regarding the retention and erasure of personal data processed in reliance on the relevant condition, and be reviewed and updated at regular intervals. A summary of the required appropriate policy document is provided at Annex D.

The ICO's guidance on employee monitoring (the Employment Practices Code — Monitoring at Work), although predating the GDPR, remains relevant and has been taken into account in this assessment. The ICO's guidance emphasises the need for proportionality, transparency, and accountability in all employee monitoring activities, and cautions against the collection of health data in the employment context absent a compelling justification and robust safeguards.

5.4 EU Jurisdiction-Specific Considerations

The deployment of NorthPulse across NTP's EU subsidiary operations requires consideration of jurisdiction-specific requirements in each Member State where the Platform is deployed.

Germany (Northgate GmbH, Berlin). The Federal Data Protection Act (Bundesdatenschutzgesetz — "BDSG"), specifically Section 26 (Processing of Personal Data in the Employment Context), provides the legal framework for the processing of employee data in Germany. Section 26(1) BDSG permits the processing of employee data where it is necessary for the purposes of the employment relationship, including for decisions relating to the establishment, performance, or termination of the employment relationship. Section 26(3) BDSG addresses the processing of special category data in the employment context, requiring that the data subject's interests in the exclusion of processing do not override the employer's justified interests. In addition, the works council (Betriebsrat) of Northgate GmbH has co-determination rights under Section 87(1)(6) of the Works Constitution Act (Betriebsverfassungsgesetz — "BetrVG") in respect of the introduction and application of technical devices designed to monitor employee behaviour or performance. NorthPulse falls within the scope of this provision, and deployment at Northgate GmbH is therefore contingent upon the satisfactory completion of the works council co-determination process. The consultation was initiated on 12 June 2023 and is ongoing.

France (Northgate France SAS, Paris). The Commission Nationale de l'Informatique et des Libertés (CNIL) has issued specific guidance on employee monitoring, emphasising the requirements of proportionality, transparency, and employee consultation. The French Labour Code (Code du travail) imposes additional requirements, including the obligation to inform and consult the Comité Social et Économique (CSE) prior to the introduction of any technology that permits the monitoring of employee activity. The proportionality of the monitoring must be assessed in light of the objective pursued, and the monitoring must not disproportionately intrude on employees' fundamental rights and freedoms. Consultation with the CSE of Northgate France SAS was initiated on 19 June 2023.

Ireland (Northgate Ireland Ltd, Dublin). The Data Protection Commission (DPC) is the competent supervisory authority for Northgate Ireland Ltd and serves as the lead supervisory authority for NTP's cross-border EU processing activities under the GDPR's one-stop-shop mechanism. The deployment of NorthPulse at Northgate Ireland Ltd must be undertaken with particular care given the active DPC preliminary inquiry IN-22-11-3, which creates a context of heightened regulatory scrutiny in which any new processing activity — particularly one involving special category data — will be subject to close examination.

Netherlands (Northgate B.V., Amsterdam). The Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) implements the GDPR in the Netherlands and includes specific provisions relevant to the processing of special category data. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has issued guidance on employee monitoring that emphasises the proportionality principle and the need for clear communication with employees.

Spain (Northgate Iberia S.L., Madrid). The Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) implements the GDPR in Spain and includes specific provisions relevant to the processing of employee data, including the right to digital disconnection and the employer's obligation to develop a policy governing the use of digital devices in the workplace.

6. Risk Identification and Assessment

6.1 Risk Matrix

The following risk matrix sets out the methodology applied to the identification and assessment of risks arising from the NorthPulse processing activities. Each risk has been assessed on two dimensions: likelihood of the risk materialising (rated as HIGH, MEDIUM, or LOW) and severity of impact on data subjects if the risk materialises (rated as HIGH, MEDIUM, or LOW). The inherent risk rating is determined by the combination of likelihood and severity, using the following matrix:

Each identified risk is accompanied by a description of the risk, the inherent risk rating (befo

DATA PROTECTION IMPACT ASSESSMENT
DPIA-003
NorthPulse Employee Wellbeing Monitoring Platform
Northgate Telecommunications PLC (Company Number 04837291)
Classification: Confidential — Legal Privileged
Prepared by:
Sara Hendricks, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
Priscilla Wynn, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
Reviewed by:
Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP
Client: Northgate Telecommunications PLC (Company Number 04837291)
Client Contacts Consulted:
This document has been prepared by Calderwood & Harkness LLP on the instruction of Northgate Telecommunications PLC and is subject to legal professional privilege. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the client. Nothing in this document constitutes legal advice to any person other than the client.
Right-click to update Table of Contents
1. Executive Summary
This Data Protection Impact Assessment ("DPIA") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Northgate Telecommunications PLC ("NTP" or the "Company") in respect of the NorthPulse Employee Wellbeing Monitoring Platform ("NorthPulse" or the "Platform"). This DPIA forms part of the comprehensive GDPR compliance programme being conducted by C&H under Engagement Reference SC/NTP/2023-0213/PDS, and is designated DPIA-003 in the programme's DPIA register.
NorthPulse is an internal employee wellbeing monitoring platform that has been developed and deployed by NTP across its United Kingdom and European Union operations. The Platform collects and processes employee health and wellbeing data across several categories, including self-reported stress levels, mental health indicators, sleep quality metrics, physical activity data derived from optional wearable device integrations, and engagement survey responses. The Platform is designed to generate both individual-level wellbeing insights for employees and aggregate-level dashboards and trend analyses for management and HR decision-making.
The processing activities associated with NorthPulse encompass approximately 11,400 employees globally, of whom approximately 8,200 are based in the United Kingdom and European Union jurisdictions. In addition, the Platform's scope potentially extends to approximately 28,000 contractors, temporary workers, and other data subjects who fall within the broader HR processing ecosystem managed by Philippa Crane's People & HR function.
This DPIA was triggered under GDPR Article 35(1) and Article 35(3) on the basis of four overlapping criteria that collectively necessitate a data protection impact assessment:
(a) the processing involves special category data, specifically health data within the meaning of Article 9 of the GDPR, including self-reported stress levels, mental health indicators, sleep quality metrics, and biometric-adjacent data derived from wearable devices;
(b) the processing involves systematic monitoring of employees within the meaning of Article 35(3)(c), as the Platform is designed to track wellbeing indicators on an ongoing basis across the organisation;
(c) the processing involves evaluation and scoring of individuals, particularly through the generation of wellbeing scores, burnout risk scores, and engagement indices that assess and profile individual employees; and
(d) the processing involves data subjects who may be considered vulnerable in the data protection context, given the inherent power imbalance in the employer-employee relationship, which may affect the ability of employees to freely consent to or refuse participation in monitoring activities.
This DPIA has been classified as HIGH RISK. It is one of five DPIAs classified as high risk out of the eleven DPIAs conducted during the Phase 3 engagement workstream, alongside DPIA-001 (Customer Behavioural Analytics Platform), DPIA-007 (Automated Fraud Detection System), DPIA-008 (Biometric Access Control Systems), and DPIA-011 (Third-Party Marketing Data Enrichment Programme).
The key risks identified in this assessment are as follows:
•  Erosion of employee autonomy: The deployment of an employer-operated wellbeing monitoring platform creates a risk that employees will feel compelled to participate and to disclose sensitive health information, even where participation is nominally voluntary, due to the power imbalance inherent in the employment relationship.
•  Coercive data collection environment: Employees may reasonably perceive non-participation as reflecting negatively on their engagement or commitment to the organisation, creating a chilling effect that undermines the validity of any consent obtained.
•  Potential for discriminatory outcomes: Wellbeing and burnout scores may correlate with protected characteristics, including disability, mental health conditions, and pregnancy, giving rise to a risk of discriminatory treatment or adverse inferences.
•  Function creep: There is a material risk that wellbeing data collected for the stated purpose of supporting employee health may be repurposed for performance management, disciplinary proceedings, redundancy selection, or other adverse employment decisions.
•  Inadequate lawful basis: The processing of special category health data in the employment context presents significant challenges in establishing a lawful basis under Article 9, particularly given the limitations on consent in the employer-employee relationship.
The mitigation measures recommended in this DPIA include the implementation of a genuinely voluntary participation model with demonstrable absence of adverse consequences for non-participation, the anonymisation of all aggregate reports with a minimum aggregation threshold of 25 employees per reportable unit, strict data minimisation measures including limiting wearable device data to step count and sleep duration only, robust purpose limitation safeguards enforced through both technical and contractual controls, enhanced transparency through a comprehensive NorthPulse-specific privacy notice and internal communications campaign, and governance controls including quarterly DPO oversight reviews and annual DPIA re-assessment.
Following the implementation of all recommended mitigation measures, the residual risk assessment has been reduced from HIGH to MEDIUM. This residual risk level has been assessed as acceptable by the DPO, Sanjay Mehta, subject to the full implementation of all mitigation measures prior to the Platform's deployment across NTP's operations.
2. Introduction and Scope
2.1 Purpose of this DPIA
This Data Protection Impact Assessment has been conducted pursuant to Article 35 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and Article 35 of the UK GDPR (as incorporated into domestic law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018), which require data controllers to carry out an assessment of the impact of envisaged processing operations on the protection of personal data where the processing is likely to result in a high risk to the rights and freedoms of natural persons.
This DPIA forms part of the comprehensive GDPR compliance programme being conducted by Calderwood & Harkness LLP for Northgate Telecommunications PLC under Engagement Reference SC/NTP/2023-0213/PDS. The engagement was opened on 13 February 2023 and has been structured across five workstream phases:
•  Phase 1 (February–March 2023): Scoping, data mapping, and gap analysis, conducted with the support of Ashdown Consulting Group Ltd as specialist privacy engineering consultants;
•  Phase 2 (March–May 2023): Development of the compliance framework, including policies, procedures, templates, and the Legitimate Interest Assessment template;
•  Phase 3 (22 May–7 July 2023): Conduct of Data Protection Impact Assessments across eleven identified processing activities, including this DPIA-003;
•  Phase 4 (ongoing): International transfer assessments and Transfer Impact Assessments; and
•  Phase 5 (ongoing): Implementation support and remediation oversight.
Phase 3 commenced on 22 May 2023. All eleven DPIAs were completed by 7 July 2023, in accordance with the project timeline agreed with the NTP Board Audit & Risk Committee.
The decision to undertake a comprehensive DPIA programme was mandated by the NTP Board Audit & Risk Committee pursuant to a resolution dated 8 December 2022. That resolution was adopted in the context of NTP's heightened regulatory risk profile and the Board's recognition that NTP's data protection compliance posture required material improvement. The resolution authorised the engagement of external counsel and the allocation of internal resources necessary to complete the compliance programme.
2.2 Scope of the Processing Under Assessment
This DPIA assesses the NorthPulse Employee Wellbeing Monitoring Platform as deployed across the following NTP entities:
United Kingdom operations:
NTP PLC (Company Number 04837291) operates from its principal offices in the United Kingdom. In the course of Phase 1, a comprehensive Record of Processing Activities ("ROPA") was compiled, cataloguing a total of 89 processing activities attributable to the UK controller entity. The NorthPulse Platform constitutes one of these processing activities and is cross-referenced in the ROPA at Activities UK-HR-012 through UK-HR-018, reflecting the distinct data collection, analysis, reporting, wearable integration, occupational health, and retention activities associated with the Platform.
EU subsidiary operations:
NTP operates through five EU subsidiary entities, collectively accounting for 58 processing activities catalogued in the ROPA. The EU subsidiaries within the scope of this DPIA are:
The NorthPulse Platform is intended for deployment across all of these subsidiary operations, and the scope of this DPIA encompasses the processing activities of each subsidiary in connection with the Platform, including jurisdiction-specific considerations arising from local employment law and data protection implementing legislation.
NorthPulse is one of 14 processing activities identified across NTP's operations as involving the processing of special category data within the meaning of Article 9 of the GDPR. The special category data processed by NTP across these 14 activities includes primarily employee health data, trade union membership information, and biometric data processed by biometric access control systems. This DPIA is concerned specifically with the employee health data processed through the NorthPulse Platform.
2.3 Background and Context
The NorthPulse Platform was introduced by Philippa Crane, NTP's Head of People & HR, as a central component of the Company's post-pandemic employee wellbeing strategy. The initiative was developed in response to the significant changes in working patterns and employee wellbeing challenges experienced across the telecommunications sector following the COVID-19 pandemic, including increased rates of remote and hybrid working, elevated levels of employee stress and burnout, and concerns about employee engagement and retention.
The Platform was designed to be integrated with NTP's existing HR systems, which are managed by Philippa Crane's function, and was intended to provide both individual employees and the organisation as a whole with enhanced insight into wellbeing trends and potential areas of concern. The business case for the Platform, as articulated by Philippa Crane during the consultation process, centred on NTP's corporate responsibility commitments and its stated objective of creating a supportive and sustainable working environment across its operations.
NTP is a public limited company listed on the London Stock Exchange, with reported revenue of £2.47 billion for the financial year ended 31 March 2022. The Company employs a complex multi-jurisdictional workforce spanning the United Kingdom and five European Union Member States, as well as operations in other international jurisdictions not within the scope of this DPIA. The organisational scale and geographic complexity of NTP's workforce are material factors in this assessment, particularly in relation to the challenges of implementing consistent data protection safeguards across multiple jurisdictions with varying employment law and data protection regulatory frameworks.
The regulatory context in which this DPIA has been prepared is one of heightened scrutiny. NTP has a recent regulatory history that is directly relevant to this assessment:
(a) ICO Enforcement Notice ENF/2021/0934 (15 September 2021): The Information Commissioner's Office issued an enforcement notice to NTP PLC, accompanied by a monetary penalty of £320,000, in respect of inadequate consent mechanisms deployed across certain of the Company's consumer-facing digital services. The enforcement action identified failures in the Company's approach to obtaining valid consent for the processing of personal data, including concerns about the clarity and specificity of consent requests and the mechanisms for recording and managing consent. While the enforcement action related to consumer data processing rather than employee data, it is indicative of systemic weaknesses in NTP's approach to consent management that are directly relevant to the consent-based processing envisaged under NorthPulse.
(b) DPC Preliminary Inquiry IN-22-11-3 (active): The Data Protection Commission (Ireland), acting as the lead supervisory authority for NTP's EU cross-border processing operations (given that Northgate Ireland Ltd is the Company's largest EU establishment), has an active preliminary inquiry in respect of certain aspects of NTP's cross-border data processing activities. The specific scope and current status of this inquiry are subject to confidential communications between NTP and the DPC, but the existence of the inquiry heightens the regulatory sensitivity of any new processing activities introduced across NTP's EU operations.
NTP's ICO Registration Number is ZA482917. The lead data protection authority for NTP's EU processing activities is the Data Protection Commission (Ireland), reflecting the Company's principal EU establishment in Dublin.
2.4 Consultation Process
In accordance with Article 35(2) of the GDPR, which requires the controller to seek the advice of the data protection officer when carrying out a data protection impact assessment, and in accordance with good practice for DPIA preparation, the following individuals and organisations were consulted during the preparation of this DPIA:
Philippa Crane, Head of People & HR, NTP PLC. Ms Crane was consulted in her capacity as the business owner and sponsor of the NorthPulse Platform. Consultations with Ms Crane covered the Platform's functionality and feature set, the HR purposes for which the Platform was designed, employee engagement objectives, and the intended use cases for workforce analytics derived from the Platform's outputs. Ms Crane provided information regarding the genesis of the Platform, the post-pandemic wellbeing strategy of which it forms a part, and the feasibility of implementing the voluntary participation model recommended in this assessment. Ms Crane was consulted on 31 May 2023, 14 June 2023, and 26 June 2023, with follow-up written queries addressed between sessions.
Sanjay Mehta, Data Protection Officer, NTP PLC. Mr Mehta (CIPP/E certified, appointed to the DPO role in March 2019) was consulted throughout the DPIA process in accordance with Article 35(2). Mr Mehta's input covered the lawful basis analysis for both Article 6 and Article 9 processing, the assessment of data subject rights and the mechanisms for their exercise in the context of NorthPulse, the regulatory risk profile of the processing given NTP's enforcement history, and the DPO's independent opinion on the acceptability of the residual risk. Mr Mehta was consulted on 25 May 2023, 7 June 2023, 19 June 2023, and 2 July 2023.
Thomas Okoye, Chief Information Security Officer, NTP PLC. Mr Okoye was consulted in respect of the technical and organisational security measures applied to the NorthPulse Platform, including encryption standards, role-based access controls, pseudonymisation techniques deployed in analytics pipelines, audit logging capabilities, and the security assessment and penetration testing programme. Mr Okoye was consulted on 1 June 2023 and 20 June 2023.
Laura Dearden, Vice President, Product & Engineering, NorthCloud. Ms Dearden was consulted in respect of the technical architecture of the NorthPulse Platform, including the application layer design, data flow architecture, hosting arrangements with Pinnacle Cloud Services Ltd, integration points with existing HR systems, and the technical feasibility of implementing anonymisation and access control measures. Ms Dearden was consulted on 6 June 2023.
Ashdown Consulting Group Ltd (Robert Fairclough, Managing Director; Anita Chakravarti, Lead Privacy Engineer). Ashdown Consulting was engaged by NTP to provide specialist privacy engineering support during Phase 1 of the compliance programme. In the context of this DPIA, Ashdown Consulting provided the data mapping outputs for NorthPulse-related processing activities, conducted the Sundial Solutions platform integration analysis for NorthPulse consent management workflows, and advised on technical data flow design. Ashdown Consulting was consulted on 29 May 2023 and 15 June 2023.
Employee representatives and works councils. In jurisdictions where employee representation bodies have co-determination or consultation rights in respect of employee monitoring systems, consultation was undertaken or initiated as follows:
(a) Germany (Northgate GmbH): The works council (Betriebsrat) of Northgate GmbH was consulted in accordance with the requirements of the Works Constitution Act (Betriebsverfassungsgesetz — "BetrVG"), specifically Section 87(1)(6) BetrVG, which confers co-determination rights on the works council in respect of the introduction and application of technical devices designed to monitor the behaviour or performance of employees. The consultation process was initiated on 12 June 2023, with a formal information package provided to the works council chair. As at the date of this DPIA, the works council consultation is ongoing and deployment at Northgate GmbH is contingent upon the satisfactory completion of this process.
(b) France (Northgate France SAS): Employee representative consultation was initiated in accordance with the French Labour Code (Code du travail) provisions governing the introduction of employee monitoring technologies. The Comité Social et Économique (CSE) of Northgate France SAS was formally consulted on 19 June 2023. As at the date of this DPIA, the CSE has provided preliminary observations and the consultation is ongoing.
3. Systematic Description of the Processing
3.1 Nature of the Processing
The NorthPulse Platform processes employee wellbeing data through several distinct but interconnected data collection and analysis mechanisms. The nature of the processing can be described across the following activity categories:
Self-reported surveys. The Platform administers two categories of survey instruments to participating employees. First, weekly "pulse surveys" consisting of a short questionnaire (typically five to eight questions) designed to capture a snapshot of the employee's current wellbeing state, including self-assessed stress levels, mood indicators, and workload perceptions. Second, quarterly "deep-dive questionnaires" comprising a more comprehensive instrument (typically 30 to 45 questions) covering a broader range of wellbeing dimensions, including mental health indicators, physical health status, work-life balance, social connectedness, and job satisfaction. Survey responses are recorded at the individual employee level and are associated with the employee's profile within the Platform.
Optional wearable device integration. The Platform offers an optional integration with consumer wearable devices (including fitness trackers and smartwatches) that allows participating employees to share certain health and activity data with the Platform. The data categories currently capable of being imported via wearable integration include step counts, sleep duration and quality metrics, and heart rate variability data. Wearable device integration is presented as an optional additional feature and requires a separate technical connection to be established by the employee. As discussed in Section 7.3 below, this DPIA recommends that the scope of wearable data collection be significantly restricted.
Platform engagement metrics. The Platform records certain behavioural data relating to each employee's interaction with the Platform itself, including login frequency, duration of Platform sessions, and the utilisation of specific wellbeing resources and features offered through the Platform (such as meditation guides, exercise programmes, or mental health support resources).
Manager wellbeing check-in records. The Platform provides a facility for line managers to record the outcomes of structured wellbeing check-in conversations conducted with their direct reports. These check-in records capture the manager's assessment of the employee's stated wellbeing status, any concerns raised by the employee, and any actions agreed. The manager who inputs this data is also a data subject in respect of the record created.
Aggregation and analysis. Individual-level data collected through the mechanisms described above is aggregated and analysed to produce team-level, department-level, and entity-level wellbeing dashboards. These dashboards present anonymised and aggregated metrics designed to provide management with visibility into organisational wellbeing trends without disclosing the data of individual employees.
Trend analysis and predictive modelling. The Platform incorporates analytical capabilities designed to identify trends in employee wellbeing data over time and to apply predictive models to estimate burnout risk and attrition probability. As currently configured, these predictive models are capable of generating outputs at the individual employee level, although this DPIA recommends that individual-level predictive scoring be discontinued in favour of anonymised cohort-level modelling (see Section 7.3).
Personalised wellbeing recommendations. Based on the individual employee's survey responses, engagement data, and (where applicable) wearable device data, the Platform generates personalised wellbeing recommendations and suggested resources tailored to the employee's apparent needs. These recommendations are visible only to the individual employee.
Integration with HR systems. NorthPulse data is integrated with NTP's broader HR systems for the purpose of workforce planning analytics. This integration allows HR to correlate wellbeing trends with workforce metrics such as absenteeism rates, turnover rates, and organisational restructuring planning. The extent and nature of this integration is a key concern addressed in the purpose limitation analysis in Section 4.3 and the mitigation measures in Section 7.4.
3.2 Categories of Personal Data
The following categories of personal data are processed through the NorthPulse Platform:
Identification data: Employee name, unique employee identification number, corporate email address, department, team, reporting line (direct manager), and employment location (office, region, and country).
Special category data (Article 9 GDPR): The Platform processes health data within the meaning of Article 9(1) of the GDPR. This includes self-reported data relating to stress levels, mental health indicators (including self-assessed anxiety, depression, and emotional wellbeing), physical health conditions disclosed through survey responses, and sleep quality metrics. Where employees opt into wearable device integration, the Platform additionally processes data derived from wearable devices, including step counts, sleep duration and quality data, and heart rate variability data. While step count and sleep duration data may not in all cases constitute health data, the European Data Protection Board and the Article 29 Working Party have adopted a broad interpretation of "data concerning health" under Article 9, and in the context of a platform specifically designed to assess employee wellbeing, all such data is treated as health data for the purposes of this assessment. This conservative classification is appropriate and prudent given NTP's regulatory risk profile.
Behavioural data: Data relating to the employee's engagement with the Platform itself, including login frequency, session duration, survey completion rates, and utilisation of specific wellbeing resources and features.
Employment data: The employee's role, department, seniority level, tenure with the organisation, and working pattern (remote, hybrid, or office-based). This data is drawn from NTP's existing HR systems and linked to the employee's NorthPulse profile for contextual analysis purposes.
Derived and inferred data: The Platform generates derived data through analysis of the primary data categories described above. This includes wellbeing scores (composite indices reflecting an employee's overall wellbeing based on survey responses and other inputs), burnout risk scores (predictive assessments of the likelihood that an employee is at risk of burnout), and engagement indices (measures of the employee's engagement with the Platform and with organisational wellbeing initiatives). These derived data points constitute personal data in their own right and, to the extent that they reveal or are capable of revealing information about the employee's health status, may also constitute special category data.
3.3 Categories of Data Subjects
The data subjects affected by the NorthPulse processing activities are:
(a) Employees: Approximately 8,200 full-time and part-time employees of NTP PLC and its EU subsidiaries in the jurisdictions described in Section 2.2 above. If the Platform is extended to NTP's operations beyond the UK and EU (which is under consideration but not currently in scope), the total employee population would be approximately 11,400.
(b) Contractors and temporary workers: The NorthPulse Platform is potentially capable of being extended to the approximately 28,000 contractors, temporary workers, and other non-employee individuals who fall within the broader scope of NTP's HR processing activities. As at the date of this DPIA, contractors and temporary workers have not been included in the NorthPulse deployment, but the potential for future inclusion has been considered in this assessment.
(c) Managers: Line managers who input wellbeing check-in records through the Platform are themselves data subjects in respect of the records they create, which may contain information attributable to the manager (such as the fact and timing of check-in conversations, and the manager's recorded observations).
3.4 Purpose of the Processing
The purposes of the processing conducted through the NorthPulse Platform have been identified and documented as follows:
Primary purpose: Supporting employee wellbeing and identifying organisational wellbeing trends across NTP's workforce. This encompasses providing individual employees with personalised wellbeing insights, resources, and recommendations; monitoring organisational wellbeing at the team, department, and entity level; and identifying areas of concern that may require targeted wellbeing interventions.
Secondary purposes: The following secondary purposes have been identified:
(a) Informing HR policy decisions relating to employee wellbeing, working conditions, and workplace culture based on aggregate wellbeing trend data;
(b) Reducing employee absenteeism and attrition by enabling early identification of wellbeing risks and deployment of supportive interventions;
(c) Fulfilling the employer's duty of care obligations towards its employees, including obligations arising under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999 in respect of mental health and psychosocial risks in the workplace; and
(d) Supporting workforce planning by integrating wellbeing trend data with broader HR analytics to inform decisions about resource allocation, organisational design, and talent management strategy.
The business justification for the Platform, as articulated by Philippa Crane during consultation, is that NorthPulse represents a core component of NTP's post-pandemic wellbeing initiative, which is itself aligned with the Company's published corporate responsibility commitments and its stated ambition to be recognised as an employer of choice in the telecommunications sector. Ms Crane emphasised that the Platform was conceived as a supportive tool rather than a surveillance mechanism, and that the Company's intention was to use wellbeing data to improve working conditions and provide targeted support to employees, rather than to monitor individual performance or behaviour.
3.5 Data Flows and Recipients
Data collection and hosting. Employee wellbeing data is collected through the NorthPulse application, which is hosted on infrastructure provided by Pinnacle Cloud Services Ltd (Company Number 09142837). Pinnacle Cloud Services Ltd acts as a data processor on behalf of NTP in respect of the NorthPulse hosting services. The data processing arrangements between NTP and Pinnacle are governed by a data processing agreement, which was amended and re-executed on 28 June 2023 as part of the compliance programme's Phase 2 deliverables (the "Amended DPA"). NorthPulse data is hosted in Pinnacle data centres located in London, United Kingdom and Dublin, Ireland.
Internal recipients. The following internal functions and individuals have access to NorthPulse data, subject to the role-based access controls described in Section 3.7:
(a) HR team (Philippa Crane's function): Designated members of the People & HR function have access to individual-level wellbeing data for the purpose of providing wellbeing support and administering the Platform. Access is limited to named individuals within the HR function who have been authorised and trained.
(b) Line managers: Line managers have access to aggregate-level dashboards only, presenting anonymised and aggregated wellbeing metrics for their respective teams. Line managers do not have access to individual-level wellbeing data for any of their direct reports.
(c) Occupational health team: Designated members of the occupational health function have access to individual-level wellbeing data where this is necessary for the provision of occupational health support, subject to the employee's consent and appropriate confidentiality safeguards.
(d) Data Protection Officer (Sanjay Mehta): The DPO has access to NorthPulse data for the purpose of compliance oversight, audit, and the exercise of the DPO's functions under Article 39 of the GDPR.
Sub-processor involvement. Pinnacle Cloud Services Ltd maintains a sub-processor chain that includes Pinnacle India Pvt Ltd (CIN: U72200HR2016PTC065412, Gurugram, Haryana, India), which provides infrastructure support services for the Pinnacle hosting environment, and Pinnacle APAC Pte Ltd (Singapore), which provides certain ancillary technical services. The involvement of Pinnacle India Pvt Ltd gives rise to international transfer implications, as NorthPulse data hosted on the Pinnacle infrastructure may be accessible to Pinnacle India personnel during the course of infrastructure support activities. The international transfer risk associated with this sub-processor arrangement is addressed in Risk 8 (Section 6.2) and the mitigation measures in Section 7.9.
It is noted that no planned transfer of NorthPulse data to Caldwell Analytics Inc. (the US-based analytics provider engaged by NTP in respect of certain other processing activities) has been identified. NorthPulse data is not transferred to the United States for any purpose associated with this processing activity.
Consent management. The Sundial Solutions privacy management platform, as configured by Ashdown Consulting Group Ltd, is utilised for the management of consent records in respect of NorthPulse, including the recording of consent given, the management of consent withdrawal requests, and the documentation of consent status for each data subject and each data collection element.
3.6 Data Retention
The following retention periods apply to the categories of personal data processed through NorthPulse, as aligned with NTP's Data Retention Schedule (version 2.0, updated as part of the Phase 2 compliance programme deliverables):
These retention periods have been assessed as proportionate to the purposes for which the data is processed, subject to the recommendation that wearable device data should not be retained for more than six months in identifiable form, reflecting the heightened sensitivity of this data category and the limited necessity for long-term retention.
3.7 Technical and Organisational Measures
The following technical and organisational measures have been implemented or are planned for implementation in respect of the NorthPulse processing activities:
Encryption. All NorthPulse data is encrypted at rest using the Advanced Encryption Standard with 256-bit key length (AES-256) and in transit using Transport Layer Security version 1.3 (TLS 1.3). These encryption standards are consistent with the supplementary technical measures applied across NTP's processing activities as documented in the Technical and Organisational Measures Register maintained by Thomas Okoye's information security function.
Role-based access controls. Access to NorthPulse data is governed by a role-based access control framework that restricts access to personal data based on the recipient's organisational role and the legitimate purpose for which access is required. Under this framework, individual-level wellbeing data is accessible only to the individual employee to whom it relates and to designated members of the HR and occupational health functions who have been authorised and trained to handle such data. Line managers have access only to anonymised and aggregated team-level dashboards, with no ability to drill down to individual employee data.
Pseudonymisation. Data processed through the NorthPulse analytics pipeline is subject to pseudonymisation measures, whereby direct identifiers (employee name, email address, and employee ID) are replaced with pseudonymous identifiers before data is processed for aggregation and trend analysis purposes. The pseudonymisation key is held separately from the pseudonymised data and is accessible only to authorised personnel within the HR function.
Audit logging. All access to individual-level NorthPulse records is subject to comprehensive audit logging, which records the identity of the user accessing the data, the date and time of access, the nature of the access (read, modify, or delete), and the specific records accessed. Audit logs are reviewed on a quarterly basis by the DPO as part of the ongoing compliance oversight programme.
Data minimisation. The Platform is configured to collect only the categories of personal data that are strictly necessary for the stated wellbeing assessment purposes, as documented in the data inventory compiled during Phase 1.
Security testing. The NorthPulse hosting environment is subject to regular penetration testing and vulnerability assessments, overseen by Thomas Okoye in his capacity as CISO. The most recent penetration test of the Pinnacle hosting environment was conducted in April 2023, and no critical vulnerabilities were identified. The next scheduled penetration test is due in October 2023.
4. Assessment of Necessity and Proportionality
4.1 Necessity
Article 35(7)(b) of the GDPR requires that a DPIA include an assessment of the necessity of the processing operations in relation to the purposes. This section assesses whether the processing activities described in Section 3 are necessary to achieve the stated purposes identified in Section 3.4.
The stated primary purpose of NorthPulse is supporting employee wellbeing and identifying organisational wellbeing trends. The question of necessity therefore centres on whether the collection and processing of individual-level employee health and wellbeing data — including special category data — is necessary to achieve this purpose, or whether the same purpose could be achieved through less intrusive means.
The following alternative approaches have been considered:
(a) Anonymous surveys without individual tracking. Organisational wellbeing trends could be identified through anonymised survey instruments that do not link responses to individual employees. This approach would significantly reduce the privacy impact of the processing, as no individual-level health data would be collected or retained. However, this approach would not support the generation of personalised wellbeing recommendations to individual employees, nor would it enable targeted wellbeing interventions for individuals identified as being at risk.
(b) Voluntary opt-in only, with no wearable integration. Limiting participation to a genuinely voluntary opt-in model and removing the wearable device integration would reduce the scope of data collection and the associated privacy risks. This approach would preserve the ability to generate personalised insights for participating employees while reducing the risk of coercive data collection.
(c) Periodic organisational culture audits. NTP could commission periodic organisational culture and wellbeing audits conducted by external providers, using anonymised methodologies, to assess organisational wellbeing trends without the need for continuous individual-level monitoring. This approach would provide periodic snapshots of organisational health but would not support real-time trend analysis or individual-level support.
Having considered these alternatives, it is concluded that individual-level data processing is not strictly necessary for all of the stated purposes. Specifically:
•  Organisational trend analysis and HR policy-making can be effectively supported by aggregate, anonymised data. Individual-level tracking is not necessary for these purposes and introduces disproportionate privacy risks.
•  Personalised wellbeing recommendations do require individual-level data processing, but this purpose can only justify the collection and processing of the minimum data necessary to generate such recommendations, and only for employees who have voluntarily opted to receive them.
•  The wearable device integration collects granular biometric-adjacent health data that is not strictly necessary for the wellbeing assessment purposes. The same wellbeing insights can be obtained from self-reported survey data alone.
Accordingly, while the processing is necessary for certain elements of the stated purpose (particularly the provision of personalised wellbeing support to voluntarily participating employees), the current scope of data collection and processing exceeds what is strictly necessary, and the data minimisation measures recommended in Section 7.3 are required to bring the processing within the bounds of necessity.
4.2 Proportionality
The proportionality assessment requires balancing the employer's legitimate interest in supporting employee wellbeing against the fundamental right to privacy and data protection of the employees whose data is processed. This balancing exercise is particularly complex in the employment context due to the inherent power imbalance in the employer-employee relationship.
The power imbalance between employer and employee is a well-recognised concern in data protection law, extensively addressed in the guidance of both the ICO and the European Data Protection Board. The EDPB's Opinion 2/2017 on Data Processing at Work emphasised that employees are rarely in a position to freely give, refuse, or revoke consent, given the dependency inherent in the employment relationship. The ICO's Employment Practices Code — Monitoring at Work similarly acknowledges that the imbalance of power may affect the voluntariness of any consent provided by employees and that employers must be especially cautious when processing employee data.
In the context of NorthPulse, this power imbalance manifests in several ways:
(a) Employees may feel that non-participation in the Platform will be perceived negatively by management, even if the Company states that participation is voluntary. The fear of implicit consequences — such as being viewed as disengaged, unsupportive of corporate initiatives, or having something to hide — may effectively coerce participation.
(b) The integration of NorthPulse with NTP's HR systems creates a risk that employees will perceive a link between their wellbeing data and employment decisions, even where no such link is intended or permitted.
(c) The generation of individual-level wellbeing and burnout risk scores creates a risk that employees will be profiled and assessed on the basis of their health data, potentially to their detriment.
The proportionality assessment further considers the nature and sensitivity of the data involved. Self-reported mental health indicators, stress levels, and data from wearable health devices are among the most sensitive categories of personal data, and their processing in the employment context requires the most compelling justification and the most robust safeguards.
Wearable device integration has been assessed as disproportionate for any mandatory deployment. The collection of granular biometric-adjacent data from wearable devices (including heart rate variability and continuous sleep monitoring) goes significantly beyond what is necessary for organisational wellbeing monitoring and represents a level of intrusion into the employee's private life that is difficult to justify in the employment context. Wearable integration is acceptable only on the basis of strictly voluntary, informed, and granular consent, and with the scope of data collection restricted as set out in Section 7.3.
Predictive burnout modelling at the individual level has been assessed as disproportionate. The generation of individual-level predictive burnout risk scores amounts to profiling within the meaning of Article 4(4) of the GDPR and creates a material risk of adverse consequences for the data subject, including the potential for discriminatory treatment based on health-related predictions. The recommendation is that predictive burnout modelling be limited to anonymised cohort-level analysis, which can provide meaningful organisational insights without the privacy risks associated with individual-level prediction.
4.3 Purpose Limitation
A significant risk identified in this assessment is the risk of function creep: the gradual expansion of the purposes for which NorthPulse data is used beyond the originally stated wellbeing purposes, potentially to the detriment of data subjects.
The specific function creep risks identified include:
(a) Performance management: Wellbeing data could be used to assess whether an employee is performing below expectations due to stress or mental health difficulties, and this assessment could influence performance review outcomes.
(b) Disciplinary decisions: An employee's wellbeing profile could be considered as a factor in disciplinary proceedings, for example where low engagement scores or declining wellbeing metrics are interpreted as indicators of disengagement or poor attitude.
(c) Redundancy selection: In a redundancy exercise, wellbeing data could be used as a criterion (explicitly or implicitly) for selecting employees for redundancy, particularly where burnout risk scores are perceived as indicators of reduced future productivity.
(d) Insurance assessments: Wellbeing data could be shared with group insurance providers as part of underwriting assessments or claims management processes, potentially affecting employees' insurance terms or eligibility.
Each of these secondary uses would represent a fundamental departure from the stated purpose of the processing and would cause significant harm to data subjects. Strict purpose limitation safeguards — implemented through both technical controls and contractual restrictions — are required to prevent function creep and are detailed in Section 7.4.
The principle of purpose limitation under Article 5(1)(b) of the GDPR requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. NorthPulse data must not be used for any employment decision to the detriment of the data subject, and this prohibition must be enforced through binding policy, technical access controls, and ongoing governance oversight.
5. Lawful Basis Analysis
5.1 Article 6 Lawful Basis — Processing of Personal Data
The identification of an appropriate lawful basis under Article 6(1) of the GDPR is a prerequisite for all processing of personal data through the NorthPulse Platform. The following analysis considers the available lawful bases and identifies the basis most appropriate for the processing activities in question.
Legitimate interest — Article 6(1)(f). NTP has a legitimate interest in supporting the wellbeing of its employees, meeting its duty of care obligations, reducing absenteeism and attrition, and maintaining an engaged and productive workforce. These interests are real, current, and directly connected to the processing activities conducted through NorthPulse. A legitimate interest assessment ("LIA") has been conducted using the LIA template developed during Phase 2 of the compliance programme, and a summary is provided at Annex C.
However, legitimate interest under Article 6(1)(f) cannot serve as the lawful basis for the processing of special category data under Article 9 — a separate condition must be identified and satisfied under Article 9(2). Even in respect of non-special-category data processed through NorthPulse, the balancing test required by Article 6(1)(f) is challenging in the employment context. The legitimate interest of the employer must be weighed against the interests, rights, and freedoms of the employees, taking into account the power imbalance, the sensitivity of the data (even where it does not reach the threshold of special category data), and the reasonable expectations of the data subjects. Across NTP's operations as a whole, legitimate interest was identified as the lawful basis for 64 of the Company's 147 catalogued processing activities (approximately 43.5%), but particular scrutiny is warranted in the employment wellbeing monitoring context.
The LIA concluded that the employer's legitimate interest outweighs the impact on data subjects for the non-special-category elements of NorthPulse processing (identification data, employment data, and platform engagement metrics), subject to the implementation of the safeguards described in this DPIA. The balancing test is satisfied on the basis that the processing is conducted with robust transparency, data minimisation, purpose limitation, and access control measures, and that employees are provided with a genuine and effective right to object.
Consent — Article 6(1)(a). Consent is a problematic lawful basis in the employment context. Both the European Data Protection Board (in Opinion 2/2017 and subsequent guidance) and the ICO (in its Employment Practices Code) have consistently stated that consent is rarely freely given by employees, owing to the power imbalance inherent in the employment relationship. An employee may feel unable to refuse consent or to withdraw it without fear of adverse consequences, even where the employer states that no such consequences will follow.
If consent is relied upon as the Article 6 lawful basis, it must be genuinely voluntary with no adverse consequences for refusal, specific to each element of processing, informed through clear and accessible information, and unambiguous. The burden is on the controller to demonstrate that these requirements are satisfied, and the controller must accept that consent may be withdrawn at any time without detriment to the data subject.
Given the inherent difficulties with consent in the employment context, consent should not be the sole Article 6 lawful basis for NorthPulse processing. Reliance on consent as the primary Article 6 basis creates a fragile compliance position, as any challenge to the validity of the consent would undermine the lawful basis for the entire processing activity.
Recommendation. Article 6(1)(f) (legitimate interest) is recommended as the primary lawful basis for the non-special-category processing elements of NorthPulse, subject to the completion of a robust LIA (summarised at Annex C) and the implementation of all safeguards and mitigation measures detailed in this DPIA. Consent under Article 6(1)(a) should not be relied upon as the sole Article 6 basis due to the power imbalance concerns described above.
5.2 Article 9 Condition — Special Category Data (Health Data)
The processing of health data through NorthPulse constitutes processing of special categories of personal data within the meaning of Article 9(1) of the GDPR. Such processing is prohibited unless one of the conditions set out in Article 9(2) is satisfied. The following conditions have been considered:
Explicit consent — Article 9(2)(a). Explicit consent requires a freely given, specific, informed, and unambiguous indication of the data subject's wishes by which, by a statement or by a clear affirmative action, the data subject signifies agreement to the processing of their personal data. In the employment context, the requirement that consent be "freely given" is the principal challenge, for the reasons discussed in Section 5.1 above.
However, the EDPB and the ICO have acknowledged that consent in the employment context is not automatically invalid — rather, it requires particular care and safeguards to ensure that it is genuinely voluntary. Where the employer can demonstrate that participation is truly optional, that no adverse consequences follow from refusal, and that employees are fully informed of their rights, explicit consent may be a valid condition for processing special category data.
The implementation of the voluntary participation model recommended in Section 7.1 — including clear communication that non-participation will not affect employment status, promotion prospects, or any other employment decision; separate granular consent for each data collection element; and the ability to withdraw consent at any time without detriment — is designed to create the conditions in which explicit consent can be genuinely and freely given.
Employment, social security, and social protection law — Article 9(2)(b). This condition permits the processing of special category data where it is necessary for the purposes of carrying out obligations and exercising specific rights of the controller or the data subject in the field of employment, social security, and social protection law, insofar as it is authorised by Union or Member State law providing for appropriate safeguards.
This condition may apply to the extent that NorthPulse processing is necessary for the purposes of NTP's obligations under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999, which require employers to assess and manage risks to the health of their employees, including psychosocial risks and work-related stress. However, the scope of these statutory obligations is narrower than the full range of processing activities conducted through NorthPulse. The statutory duty of care requires employers to take reasonable steps to identify and mitigate workplace health risks, but it does not require the implementation of a comprehensive individual-level wellbeing monitoring platform with wearable device integration and predictive burnout modelling. Accordingly, Article 9(2)(b) can support only a narrow subset of the NorthPulse processing — specifically, processing directly related to the identification and management of occupational health risks that fall within the scope of the employer's statutory obligations.
Substantial public interest — Article 9(2)(g) / DPA 2018 Schedule 1. This condition permits the processing of special category data where it is necessary for reasons of substantial public interest, on the basis of Union or Member State law which is proportionate to the aim pursued. In the UK, the relevant implementing provision is Schedule 1 to the Data Protection Act 2018, which sets out specific substantial public interest conditions. Condition 18 of Schedule 1 (safeguarding of economic well-being of individuals) has been considered as a potential basis, but its applicability to employer-operated wellbeing monitoring platforms is uncertain, and reliance on this condition would require the preparation and maintenance of an appropriate policy document under Schedule 1, Part 4.
Recommendation. Explicit consent under Article 9(2)(a) is recommended as the primary condition for the processing of special category data through NorthPulse, supported by the implementation of the genuinely voluntary participation model detailed in Section 7.1. This recommendation is made on the basis that the voluntary participation model, if properly implemented and maintained, can create the conditions in which explicit consent is genuinely and freely given, notwithstanding the employment context. Article 9(2)(b) is recommended as a supplementary condition, but only for the narrowly-scoped processing activities that are directly required by the employer's statutory occupational health obligations under UK employment and health and safety law.
5.3 UK-Specific Considerations
The UK GDPR applies to the processing activities of NTP PLC in respect of its UK operations. The ICO is the competent supervisory authority, and NTP is registered with the ICO under Registration Number ZA482917.
Where special category data is processed in the UK in reliance on an Article 9(2) condition, the Data Protection Act 2018 imposes additional requirements. In particular, where processing is based on explicit consent (Schedule 1, Condition 1 — consent of the data subject), the controller must prepare and maintain an appropriate policy document in accordance with Schedule 1, Part 4. The appropriate policy document must set out the controller's procedures for ensuring compliance with the data protection principles, explain the controller's policies regarding the retention and erasure of personal data processed in reliance on the relevant condition, and be reviewed and updated at regular intervals. A summary of the required appropriate policy document is provided at Annex D.
The ICO's guidance on employee monitoring (the Employment Practices Code — Monitoring at Work), although predating the GDPR, remains relevant and has been taken into account in this assessment. The ICO's guidance emphasises the need for proportionality, transparency, and accountability in all employee monitoring activities, and cautions against the collection of health data in the employment context absent a compelling justification and robust safeguards.
5.4 EU Jurisdiction-Specific Considerations
The deployment of NorthPulse across NTP's EU subsidiary operations requires consideration of jurisdiction-specific requirements in each Member State where the Platform is deployed.
Germany (Northgate GmbH, Berlin). The Federal Data Protection Act (Bundesdatenschutzgesetz — "BDSG"), specifically Section 26 (Processing of Personal Data in the Employment Context), provides the legal framework for the processing of employee data in Germany. Section 26(1) BDSG permits the processing of employee data where it is necessary for the purposes of the employment relationship, including for decisions relating to the establishment, performance, or termination of the employment relationship. Section 26(3) BDSG addresses the processing of special category data in the employment context, requiring that the data subject's interests in the exclusion of processing do not override the employer's justified interests. In addition, the works council (Betriebsrat) of Northgate GmbH has co-determination rights under Section 87(1)(6) of the Works Constitution Act (Betriebsverfassungsgesetz — "BetrVG") in respect of the introduction and application of technical devices designed to monitor employee behaviour or performance. NorthPulse falls within the scope of this provision, and deployment at Northgate GmbH is therefore contingent upon the satisfactory completion of the works council co-determination process. The consultation was initiated on 12 June 2023 and is ongoing.
France (Northgate France SAS, Paris). The Commission Nationale de l'Informatique et des Libertés (CNIL) has issued specific guidance on employee monitoring, emphasising the requirements of proportionality, transparency, and employee consultation. The French Labour Code (Code du travail) imposes additional requirements, including the obligation to inform and consult the Comité Social et Économique (CSE) prior to the introduction of any technology that permits the monitoring of employee activity. The proportionality of the monitoring must be assessed in light of the objective pursued, and the monitoring must not disproportionately intrude on employees' fundamental rights and freedoms. Consultation with the CSE of Northgate France SAS was initiated on 19 June 2023.
Ireland (Northgate Ireland Ltd, Dublin). The Data Protection Commission (DPC) is the competent supervisory authority for Northgate Ireland Ltd and serves as the lead supervisory authority for NTP's cross-border EU processing activities under the GDPR's one-stop-shop mechanism. The deployment of NorthPulse at Northgate Ireland Ltd must be undertaken with particular care given the active DPC preliminary inquiry IN-22-11-3, which creates a context of heightened regulatory scrutiny in which any new processing activity — particularly one involving special category data — will be subject to close examination.
Netherlands (Northgate B.V., Amsterdam). The Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) implements the GDPR in the Netherlands and includes specific provisions relevant to the processing of special category data. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has issued guidance on employee monitoring that emphasises the proportionality principle and the need for clear communication with employees.
Spain (Northgate Iberia S.L., Madrid). The Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) implements the GDPR in Spain and includes specific provisions relevant to the processing of employee data, including the right to digital disconnection and the employer's obligation to develop a policy governing the use of digital devices in the workplace.
6. Risk Identification and Assessment
6.1 Risk Matrix
The following risk matrix sets out the methodology applied to the identification and assessment of risks arising from the NorthPulse processing activities. Each risk has been assessed on two dimensions: likelihood of the risk materialising (rated as HIGH, MEDIUM, or LOW) and severity of impact on data subjects if the risk materialises (rated as HIGH, MEDIUM, or LOW). The inherent risk rating is determined by the combination of likelihood and severity, using the following matrix:
Each identified risk is accompanied by a description of the risk, the inherent risk rating (befo

DATA PROTECTION IMPACT ASSESSMENT

DPIA-003

Record

Parties

Dates

Amounts