PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / LITIGATION PRIVILEGE
GDPR COMPLIANCE PROGRAM BUILD — PHASE 1 KICK-OFF MEETING
Agenda and Minutes
CALDERWOOD & HARKNESS LLP One Broadgate, London EC2M 2QS
Right-click to update Table of Contents
1. ATTENDEES
1.1 Calderwood & Harkness LLP
1.2 Northgate Telecommunications PLC
1.3 Ashdown Consulting Group Ltd
1.4 Apologies
The following individuals were unable to attend the meeting but have been notified of the agenda and will receive a copy of these minutes:
• Rachel Bernstein — Billing Partner, Privacy & Data Security, Calderwood & Harkness LLP. Ms Bernstein was unable to attend due to a pre-existing travel conflict. She will be briefed separately on the outcomes of this meeting and will be actively involved in the engagement, particularly in connection with Phase 4 (International Transfer Mechanisms) and the preparation of the response to the DPC preliminary inquiry (IN-22-11-3). Ms Bernstein is a recognised specialist in cross-border data transfers and telecoms regulation.
• Marcus Engström — Head of EU Operations, Northgate Ireland Ltd, based in Dublin. Mr Engström will join the workstream at Phase 2 when work on the Records of Processing Activities and data mapping for EU subsidiary operations commences. He has been asked to provide written responses to data mapping questionnaires in advance.
• Anita Chakravarti — Lead Privacy Engineer, Ashdown Consulting Group Ltd. Ms Chakravarti was represented at this meeting by Robert Fairclough. She will lead the technical configuration of the Sundial Solutions platform and the execution of technical data flow scanning exercises.
2. AGENDA
The following agenda was circulated in advance by Sara Hendricks on 16 February 2023 and was confirmed at the opening of the meeting. All items were addressed during the meeting as set out in the minutes of discussion in Section 3 below.
2.1 Welcome and Introductions
Kevin Ostrowski to open the meeting; introductions around the table. Confirmation of the roles of each attendee in the engagement.
2.2 Engagement Scope and Objectives
Confirmation of the scope of the engagement per the engagement letter dated 13 February 2023 (Ref: SC/NTP/2023-0213/PDS), executed by Fiona Gallagher on behalf of Northgate Telecommunications PLC and by Kevin Ostrowski on behalf of Calderwood & Harkness LLP. The engagement encompasses a five-phase structure as follows:
• Phase 1: Assessment & Gap Analysis (fee cap: £185,000)
• Phase 2: ROPA & Data Mapping (fee cap: £210,000)
• Phase 3: Data Protection Impact Assessments (fee cap: £155,000)
• Phase 4: International Transfer Mechanisms (fee cap: £175,000)
• Phase 5: Policies, Training & Governance (fee cap: £125,000)
Total engagement fee cap: £850,000 plus estimated disbursements of £32,000 (primarily travel costs for on-site data mapping sessions at EU offices).
Target completion: Q3 2023, per the Board Audit & Risk Committee resolution of 8 December 2022.
2.3 Background and Regulatory Context
Overview of Northgate Telecommunications PLC's ("NTP") data processing activities and scale, including:
• Approximately 6.3 million consumer subscribers across UK fixed-line and mobile telecommunications services;
• Approximately 42,000 enterprise clients across B2B NorthCloud SaaS platform and managed network services;
• Approximately 11,400 employees globally, of which approximately 8,200 are based in the UK and EU.
Discussion of the regulatory context, including:
• Prior ICO Enforcement Notice ENF/2021/0934 (issued 15 September 2021) — £320,000 fine for inadequate consent mechanisms relating to direct marketing cookies on the NorthCloud customer portal; remediation completed March 2022;
• Active DPC (Ireland) preliminary inquiry IN-22-11-3 (opened November 2022) — examination of cross-border data transfers from Northgate Ireland Ltd to US-based processors in the wake of the CJEU judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18) ("Schrems II");
• Board Audit & Risk Committee directive dated 8 December 2022, mandating the commissioning of a comprehensive GDPR compliance program build with external counsel, to be completed by Q3 2023.
2.4 Phase 1 Detailed Work Plan
Detailed discussion of the Phase 1 work plan, including:
• Gap analysis methodology and the form and content of the gap analysis deliverable (target delivery: 31 March 2023);
• Design and distribution of the data mapping questionnaire to all NTP business units (target distribution: 1 March 2023);
• Review of all existing NTP data protection policies, procedures, privacy notices, and data processing agreements;
• Assessment across all UK and EU operations, covering all six NTP entities.
2.5 Data Mapping Approach and Ashdown Coordination
Discussion of the respective roles and responsibilities of Calderwood & Harkness LLP and Ashdown Consulting Group Ltd in the data mapping and analysis process, including:
• Ashdown's role in technical data mapping, data flow inventories, and the configuration and population of the Sundial Solutions platform;
• Calderwood & Harkness's role in legal analysis, lawful basis assessment, gap identification, and the preparation of all legal deliverables;
• Distribution of data mapping questionnaires to NTP business units;
• Coordination timeline between Ashdown's technical data flow outputs and Calderwood & Harkness's legal gap analysis.
2.6 NTP Entity and Operational Structure
Mapping of all NTP entities in scope for the engagement:
• Northgate Telecommunications PLC (UK parent; Company No. 04837291; ICO Registration No. ZA482917);
• Northgate Ireland Ltd (CRO: 587214; Dublin);
• Northgate GmbH (HRB 214503 B; Berlin);
• Northgate B.V. (KvK: 72841936; Amsterdam);
• Northgate France SAS (SIREN: 891 247 503; Paris);
• Northgate Iberia S.L. (CIF: B-91847263; Madrid).
Discussion of data centre locations, products and services in scope, and lead supervisory authorities.
2.7 Key Third-Party Processors and Sub-processors
Review of NTP's material third-party processor and sub-processor relationships, including:
• Caldwell Analytics Inc. (US; AI-driven network analytics);
• Pinnacle Cloud Services Ltd (UK; IaaS/PaaS hosting);
• Sunderland-Hayes Payroll Services Inc. (US; cross-border payroll);
• Moritaka Systems K.K. (Japan; IoT analytics);
• Discussion of data processing agreement review and remediation needs.
2.8 DPC Inquiry (IN-22-11-3) — Timeline Pressures
Status update and strategic discussion regarding the DPC preliminary inquiry opened November 2022, focused on cross-border transfers from Northgate Ireland Ltd to US-based processors post-Schrems II. Discussion of priorities for the DPC response and coordination with Phase 4 (International Transfer Mechanisms).
2.9 Governance and Project Communication
Agreement on governance structure and communication protocols for the engagement, including:
• Fortnightly status calls between Calderwood & Harkness and the NTP project team;
• Monthly written progress reports;
• Escalation protocols for material issues or regulatory developments;
• Designation of primary contacts on each side.
2.10 Document Request List
Presentation and discussion of a comprehensive list of documents and materials to be provided by NTP to Calderwood & Harkness (set out in full at Section 4 below).
2.11 Next Steps and Action Items
Confirmation of immediate next steps, action items, and deadlines (set out in full at Section 5 below).
2.12 Any Other Business
No items of other business were raised.
3. MINUTES OF DISCUSSION
The following minutes record the substantive discussions that took place during the meeting. They are prepared under the protection of legal professional privilege and are intended to be a comprehensive record of the matters discussed and decisions taken. These minutes should be read in conjunction with the action items set out in Section 5 and the document request list at Section 4.
3.1 Welcome and Introductions (10:00 – 10:15)
Kevin Ostrowski opened the meeting at 10:00 GMT, welcoming all attendees and thanking Northgate Telecommunications PLC for its confidence in engaging Calderwood & Harkness LLP to lead this important programme of work. Mr Ostrowski noted that this engagement represents one of the most comprehensive GDPR compliance program builds that Calderwood & Harkness has undertaken for a UK-headquartered telecommunications provider, and emphasised the firm's commitment to delivering high-quality, actionable legal work product within the agreed timeline and budget.
Mr Ostrowski introduced the Calderwood & Harkness team present at the meeting. He described his own role as Responsible Partner, noting that he would provide strategic oversight across all five phases and would be the primary partner-level point of contact for the engagement. He introduced Sara Hendricks as the Lead Associate who would manage the day-to-day conduct of the engagement and serve as the primary point of contact for operational matters. He introduced Priscilla Wynn as the Working Associate who would focus in particular on the development of Records of Processing Activities and the legal analysis component of the data mapping workstream.
Mr Ostrowski noted that Rachel Bernstein, the Billing Partner for the engagement and a specialist in cross-border data transfers and telecommunications regulation, sends her apologies for this meeting. Ms Bernstein was unable to attend due to a pre-existing travel conflict. Mr Ostrowski confirmed that Ms Bernstein will be briefed separately on the outcomes of this meeting and will be actively involved in the engagement from the outset, with a particular focus on Phase 4 (International Transfer Mechanisms) and the preparation of NTP's substantive response to the DPC preliminary inquiry (IN-22-11-3).
Fiona Gallagher, General Counsel and Company Secretary of Northgate Telecommunications PLC, then introduced the NTP attendees. Ms Gallagher described her role as the executive sponsor of the GDPR compliance programme within NTP and the primary strategic and legal decision-maker on the client side. She introduced Sanjay Mehta as the NTP Data Protection Officer who would serve as the internal project lead, managing day-to-day coordination on the NTP side. Ms Gallagher noted that Mr Mehta reports to her directly, with a dotted-line reporting relationship to the Audit & Risk Committee. She introduced Thomas Okoye as the Chief Information Security Officer, responsible for all technical and information security aspects of the programme. She introduced Laura Dearden as VP, Product & Engineering for the NorthCloud platform, who would be the key technical resource for NorthCloud-related processing activities. Finally, she introduced Philippa Crane as Head of People & HR, who would lead the HR data processing workstream within NTP.
Ms Gallagher also noted the apologies of Marcus Engström, Head of EU Operations at Northgate Ireland Ltd, who is based in Dublin and was unable to attend. Mr Engström will join the workstream at Phase 2 when the ROPA and data mapping work for EU subsidiary operations commences. Ms Gallagher confirmed that Mr Engström has been briefed on the scope of the engagement and is ready to engage when required.
Robert Fairclough, Managing Director of Ashdown Consulting Group Ltd, introduced himself and his organisation. He noted that Ashdown has an existing consulting relationship with NTP, having been retained by NTP's IT function to provide technical data mapping and Sundial Solutions platform implementation services. Mr Fairclough confirmed that Ashdown's engagement is separate from the Calderwood & Harkness engagement but closely coordinated, and that Ashdown would report to Sara Hendricks at Calderwood & Harkness on data mapping progress, with copies to Sanjay Mehta at NTP. Mr Fairclough noted that Anita Chakravarti, Ashdown's Lead Privacy Engineer, was unable to attend but is available to commence technical work immediately.
3.2 Engagement Scope and Objectives Confirmation (10:15 – 10:45)
Kevin Ostrowski walked the meeting through the five-phase structure of the engagement as set out in the engagement letter dated 13 February 2023 (Ref: SC/NTP/2023-0213/PDS). He summarised the scope of each phase as follows:
Phase 1 — Assessment & Gap Analysis (Fee Cap: £185,000) Comprehensive assessment of NTP's current state of compliance with the UK GDPR, the EU GDPR, the Data Protection Act 2018, and applicable implementing legislation in each EU jurisdiction in which NTP operates. The Phase 1 deliverable will be a detailed gap analysis report identifying areas of non-compliance or risk and providing prioritised recommendations. Target delivery date: 31 March 2023.
Phase 2 — ROPA & Data Mapping (Fee Cap: £210,000) Development of comprehensive Records of Processing Activities compliant with Article 30 of the UK GDPR and the EU GDPR for all NTP entities, informed by the data mapping exercises conducted in coordination with Ashdown Consulting Group Ltd. Target commencement: 3 April 2023.
Phase 3 — Data Protection Impact Assessments (Fee Cap: £155,000) Conduct of Data Protection Impact Assessments under Article 35 of the UK GDPR and the EU GDPR for all high-risk processing activities identified during Phases 1 and 2, including but not limited to the NorthCloud platform, the IoT connectivity platform, the Birmingham smart city pilot, the NorthPulse employee wellbeing platform, and biometric access control systems.
Phase 4 — International Transfer Mechanisms (Fee Cap: £175,000) Review, remediation, and implementation of compliant international data transfer mechanisms for all cross-border data flows identified during the data mapping process, with particular emphasis on transfers to the United States and other jurisdictions lacking an adequacy decision. This phase will include the preparation of NTP's substantive response to the DPC preliminary inquiry (IN-22-11-3).
Phase 5 — Policies, Training & Governance (Fee Cap: £125,000) Development of a comprehensive data protection policy framework, design and delivery of a training programme, and establishment of an ongoing governance framework for NTP's data protection compliance, including Audit & Risk Committee reporting and the integration of data protection into corporate governance processes.
Mr Ostrowski confirmed that the total engagement fee cap across all five phases is £850,000, exclusive of VAT. He noted that estimated disbursements of £32,000 sit outside the fee cap and relate primarily to travel costs for on-site data mapping sessions and interviews at NTP's offices in Dublin, Berlin, and Amsterdam. He confirmed that disbursements would be invoiced at cost and that any material variance from the estimate would be communicated in advance.
Mr Ostrowski confirmed the staffing model and blended hourly rates as set out in the engagement letter:
He confirmed that he would oversee all workstreams as Responsible Partner. Rachel Bernstein would lead on international transfers and the DPC inquiry response. Sara Hendricks would serve as the day-to-day lead across all phases. Priscilla Wynn would focus on ROPA development and the legal analysis component of data mapping.
Fiona Gallagher confirmed that the NTP Board Audit & Risk Committee, by resolution dated 8 December 2022, had mandated the commissioning of a comprehensive GDPR compliance programme build with external counsel, to be completed by Q3 2023. Ms Gallagher stated that the Board views this as a high-priority corporate governance matter, given the prior ICO enforcement action (ENF/2021/0934) and the active DPC preliminary inquiry (IN-22-11-3). She confirmed that the Audit & Risk Committee has approved the engagement budget of up to £850,000 in legal fees plus disbursements, and that the Committee will receive quarterly updates on progress.
Sanjay Mehta noted that he has been designated by Ms Gallagher as the internal project lead on the NTP side. He confirmed his reporting lines: he reports directly to Ms Gallagher in her capacity as General Counsel, with a dotted-line reporting relationship to the Audit & Risk Committee. Mr Mehta stated that he will be responsible for coordinating NTP's internal resources, ensuring timely production of documents and information, and serving as the day-to-day point of contact for Calderwood & Harkness and Ashdown Consulting Group.
No objections or amendments to the scope were raised. The engagement scope and objectives were confirmed as agreed.
3.3 Regulatory Context Discussion (10:45 – 11:15)
Sanjay Mehta provided background on the prior ICO enforcement action. On 15 September 2021, the ICO issued Enforcement Notice ENF/2021/0934 to Northgate Telecommunications PLC in respect of the NorthCloud customer portal. The enforcement notice identified inadequate consent mechanisms for direct marketing cookies deployed on the NorthCloud B2B customer portal. The ICO determined that NTP had failed to obtain valid, freely given, specific, informed, and unambiguous consent from data subjects for the placement of non-essential cookies, in breach of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) and in breach of Article 6(1)(a) of the UK GDPR in respect of subsequent processing of personal data collected via those cookies. The ICO imposed a fine of £320,000. Mr Mehta confirmed that NTP did not appeal the fine and implemented a comprehensive remediation programme, which was completed in March 2022. The remediation included the deployment of a new consent management platform (provided by a third-party vendor) and the redesign of the NorthCloud customer portal cookie banner and preference centre. Mr Mehta confirmed that there are no ongoing ICO monitoring requirements arising from the enforcement notice, but he noted that NTP should expect heightened scrutiny from the ICO in connection with any future complaints or investigations given the prior finding.
Fiona Gallagher then briefed the group on the DPC preliminary inquiry. In November 2022, the Data Protection Commission (Ireland), acting as the lead supervisory authority for NTP's EU operations by virtue of the establishment of Northgate Ireland Ltd in Dublin, opened a preliminary inquiry under reference IN-22-11-3. The inquiry is focused on cross-border transfers of personal data from Northgate Ireland Ltd to US-based processors, specifically in the context of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, judgment of 16 July 2020), which invalidated the EU-US Privacy Shield and imposed enhanced requirements for the use of Standard Contractual Clauses as a transfer mechanism.
Ms Gallagher confirmed that the primary US-based processor of concern is Caldwell Analytics Inc., a Delaware C-corporation headquartered in San Jose, California, which provides AI-driven network analytics and predictive maintenance services to NTP under a Master Services Agreement dated 1 June 2021. Caldwell processes subscriber metadata, location data, and device identifiers on behalf of NTP. Ms Gallagher noted that the existing contractual arrangements with Caldwell include a data processing addendum that pre-dates the Schrems II judgment and does not incorporate the new EU Standard Contractual Clauses adopted by the European Commission by implementing decision (EU) 2021/914 of 4 June 2021, nor does it incorporate a Transfer Impact Assessment.
Sanjay Mehta confirmed that NTP's existing transfer mechanisms for the Caldwell relationship were not updated following the Schrems II judgment. He acknowledged that this represents a significant compliance gap and stated that it is the specific focus of the DPC inquiry. Mr Mehta noted that NTP had, prior to the engagement of Calderwood & Harkness, been relying on the legacy Standard Contractual Clauses (Commission Decision 2010/87/EU), which expired as a valid transfer mechanism on 27 December 2022 under the European Commission's transitional provisions.
Kevin Ostrowski noted that while the formal work on international transfer mechanisms is scheduled for Phase 4, the DPC inquiry creates a timeline pressure that necessitates preparatory analysis during Phase 1. He proposed, and the group agreed, that the Calderwood & Harkness team should begin preliminary analysis of the Caldwell transfer during Phase 1 to inform the gap analysis report and to enable early engagement with Caldwell's external counsel, Hargrove Lister & Webb LLP (Natalie Prescott, Partner), regarding the negotiation and execution of updated SCCs and a UK International Data Transfer Agreement ("IDTA").
Thomas Okoye provided a technical security briefing relevant to the Caldwell data flows. He confirmed that NTP employs AES-256 encryption at rest and TLS 1.3 encryption in transit for all data transmitted to and processed by Caldwell Analytics Inc. He noted that these encryption standards will be relevant to the supplementary measures analysis required under the EDPB's Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. Mr Okoye confirmed that NTP maintains encryption key management in-house and that Caldwell does not hold the encryption keys, which may be a relevant factor in the Transfer Impact Assessment.
Kevin Ostrowski drew the group's attention to the scale of potential regulatory exposure. He noted that NTP's consolidated group revenue for FY 2022 was £2.47 billion and that, under Article 83(5) of the EU GDPR, the maximum fine for an infringement relating to the basic principles for processing or the conditions for consent is up to 4% of total worldwide annual turnover of the preceding financial year. This translates to a theoretical maximum fine of approximately £98.8 million. While Mr Ostrowski stressed that fines of this magnitude are rare and that the DPC would consider all relevant factors, including the nature and gravity of the infringement, the degree of responsibility, any action taken to mitigate damage, and the degree of cooperation with the supervisory authority, he emphasised that this context underscores the urgency and importance of the compliance programme and the need to respond to the DPC inquiry with a comprehensive and credible substantive submission.
Fiona Gallagher agreed that the potential regulatory exposure is a matter of significant concern at Board level and is one of the principal reasons the Audit & Risk Committee directed the engagement of external counsel.
3.4 Data Mapping Approach and Ashdown Coordination (11:15 – 11:45)
Robert Fairclough presented Ashdown Consulting Group's proposed data mapping methodology. He explained that Ashdown proposes a two-track approach:
(a) Business unit interviews: Ashdown will conduct structured interviews with representatives of each NTP business unit across all UK and EU offices. These interviews will be conducted using a standardised questionnaire template (to be finalised in conjunction with Calderwood & Harkness) and will cover all categories of personal data processed, the purposes of processing, the legal basis relied upon, data flows (internal and external), retention periods, and technical and organisational measures in place.
(b) Technical data flow scanning: Ashdown will deploy technical scanning tools to map data flows across NTP's IT infrastructure, including network traffic analysis, database schema analysis, and application-level data flow tracing. This technical approach will complement the interview-based approach by identifying data flows that may not be captured through manual processes.
Mr Fairclough confirmed that Ashdown will configure and populate the Sundial Solutions platform, which NTP has licensed for use as its data protection management solution. Anita Chakravarti, Ashdown's Lead Privacy Engineer, will lead the technical configuration work. The Sundial Solutions platform will serve as the repository for the Records of Processing Activities, the data mapping outputs, the DPIA register, and the data subject rights management workflow. Mr Fairclough noted that the Sundial Solutions instance has been provisioned but not yet configured, and that configuration work will begin immediately.
Priscilla Wynn confirmed that Calderwood & Harkness has prepared a standardised data mapping questionnaire template. The questionnaire is designed to capture the information required for Article 30 ROPA compliance, as well as additional detail necessary for the gap analysis, the identification of high-risk processing activities requiring DPIAs, and the mapping of international data transfers. Ms Wynn confirmed that the questionnaires will be distributed to all NTP business units across UK and EU operations by 1 March 2023, and that Sanjay Mehta will coordinate distribution and follow-up on the NTP side.
Laura Dearden raised a helpful point regarding the NorthCloud platform. She noted that the NorthCloud engineering team maintains its own internal data flow documentation, including detailed data architecture diagrams, API data flow specifications, and data lineage records. Ms Dearden offered to share this existing documentation with Ashdown and Calderwood & Harkness to accelerate the mapping of NorthCloud-related processing activities and to avoid duplication of effort. This offer was gratefully accepted, and Ms Dearden was asked to provide the documentation by 6 March 2023.
Philippa Crane noted that HR data processing is particularly complex within NTP. Employee personal data is processed across all six NTP entities, and the processing is subject to differing local employment law requirements in each jurisdiction. Ms Crane drew attention to two areas of particular sensitivity:
(i) NorthPulse employee wellbeing platform: This is an internally developed digital health and wellbeing platform available to all NTP employees. The platform processes special category data within the meaning of Article 9 of the UK GDPR and the EU GDPR, specifically health data, including self-reported stress levels, mental health assessments, and referral data for occupational health services. Ms Crane noted that the platform was developed in-house by the NorthCloud engineering team and that the lawful basis for processing has not been formally assessed since the platform's launch in 2021.
(ii) Cross-border HR data flows: Employee data flows between NTP entities for purposes including group-wide HR administration, talent management, and the administration of stock option plans and other compensation arrangements. These intra-group transfers include transfers to the UK parent from EU subsidiaries and vice versa, and are relevant to both UK-EU and intra-EU transfer mechanism analysis.
Thomas Okoye flagged an additional area involving special category data. NTP operates biometric access control systems at its data centres in London, Frankfurt, Amsterdam, and Dublin. These systems process fingerprint and facial recognition data, which constitute biometric data for the purpose of uniquely identifying a natural person and are therefore special category data under Article 9 of the UK GDPR and the EU GDPR. Mr Okoye noted that the lawful basis and conditions for processing under Article 9 have not been formally documented and that a DPIA has not been conducted for these systems.
Robert Fairclough confirmed that Ashdown's target is to complete initial data flow inventories by mid-March 2023, which will enable Calderwood & Harkness to incorporate the findings into the gap analysis report, the target delivery date for which is 31 March 2023. He acknowledged that this is an ambitious timeline and noted that close coordination between Ashdown, Calderwood & Harkness, and the NTP project team will be essential.
The division of responsibilities between Calderwood & Harkness and Ashdown was confirmed as follows:
• Ashdown Consulting Group Ltd: Technical data mapping, data flow inventories, technical scanning, Sundial Solutions platform configuration and population, and technical support for data flow analysis.
• Calderwood & Harkness LLP: Legal analysis, lawful basis assessment, gap identification, regulatory risk assessment, DPIA legal analysis, transfer mechanism analysis, and the preparation and delivery of all legal deliverables.
This division of responsibilities was agreed by all parties.
3.5 NTP Entity and Operational Structure Review (11:45 – 12:15)
Sara Hendricks led the group through a detailed review of NTP's entity structure, confirming all six entities in scope for the engagement. She presented a preliminary entity structure chart and invited corrections and additions from the NTP team.
The entities in scope were confirmed as follows:
Sanjay Mehta confirmed approximate employee headcounts for each entity:
Mr Mehta noted that the global headcount of approximately 11,400 includes approximately 3,200 employees in non-EU/EEA jurisdictions (primarily the United States and India) who are employed by the UK parent entity and seconded or assigned to overseas operations. The precise scope of these non-EU employees within the engagement will be determined during Phase 1 but will be relevant to the extent that they involve processing of EU/UK personal data.
The meeting discussed the controller versus processor characterisation of each entity. Ms Hendricks noted that, based on the preliminary information provided, all NTP entities appear to act primarily as controllers in their own right for their respective operational purposes. However, the intra-group data sharing arrangements need to be carefully mapped to determine whether any joint controller relationships exist between NTP entities or whether any entity is acting as a processor on behalf of another group entity. This analysis will form part of the Phase 1 gap analysis.
Ms Hendricks confirmed that Northgate Ireland Ltd acts as the controller for EU customer data processed through the NorthCloud platform. As the EU establishment making decisions about the purposes and means of processing EU customer data, Northgate Ireland Ltd is the "main establishment" for the purposes of the one-stop-shop mechanism under Article 56 of the EU GDPR. Accordingly, the Data Protection Commission (Ireland) is confirmed as the lead supervisory authority for EU GDPR purposes, and the Information Commissioner's Office (ICO) is the supervisory authority for UK GDPR purposes.
Data centre locations were confirmed as follows:
• London — hosting UK operations and the IoT connectivity platform
• Frankfurt — hosting EU NorthCloud operations and providing data residency for German and certain other EU customers
• Amsterdam — hosting NorthCloud EU operations and Dutch/Benelux customer data
• Dublin — hosting NorthCloud EU operations and serving as the primary EU data centre
All four data centres are operated via Pinnacle Cloud Services Ltd hosting arrangements. The specific contractual and data processing arrangements with Pinnacle will be reviewed in detail as part of the processor DPA review workstream.
The products and services in scope for the engagement were confirmed as follows:
• Fixed-line and mobile telecommunications services (UK consumer market; approximately 6.3 million subscribers)
• NorthCloud SaaS platform (B2B cloud services; operational across 14 EU/EEA member states from Dublin and Frankfurt data centres; approximately 42,000 enterprise clients)
• Managed network services (enterprise networking solutions for B2B clients)
• IoT connectivity platform (Internet of Things connectivity services; approximately 12,000 device endpoints; operating from the London data centre; includes a smart city pilot project in Birmingham)
Sara Hendricks noted that the Birmingham smart city pilot is likely to constitute high-risk processing requiring a DPIA, given the potential for systematic monitoring of publicly accessible areas and the processing of location data. This will be assessed during Phase 1 and addressed substantively in Phase 3.
Marcus Engström, who was absent from the meeting, has been asked by Sanjay Mehta to provide detailed operational information for the EU subsidiaries via written responses to the data mapping questionnaires. This information will be essential for Phase 2 and will also inform the Phase 1 gap analysis to the extent it is available within the Phase 1 timeline.
3.6 Key Third-Party Processor Discussion (12:15 – 12:45)
The meeting devoted substantial time to a detailed discussion of NTP's most significant third-party processor and sub-processor relationships. Kevin Ostrowski emphasised that the review and remediation of data processing agreements is a critical component of the compliance programme, given the volume and sensitivity of personal data shared with third-party processors and the regulatory focus on processor compliance, particularly in the context of cross-border transfers.
Caldwell Analytics Inc.
Caldwell Analytics Inc. is a Delaware C-Corporation with its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134, United States. Caldwell provides AI-driven network analytics and predictive maintenance services to NTP. These services involve the processing of subscriber metadata, location data, and device identifiers on behalf of NTP. The relationship is governed by a Master Services Agreement dated 1 June 2021 and an associated data processing addendum.
As discussed in Section 3.3 above, the Caldwell relationship is the primary focus of the DPC preliminary inquiry (IN-22-11-3). The existing data processing addendum does not incorporate the new EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and does not include a Transfer Impact Assessment. The remediation of this arrangement is a matter of urgency.
Sanjay Mehta confirmed that Caldwell's external counsel is Hargrove Lister & Webb LLP, and the designated contact partner is Natalie Prescott. Caldwell's internal data protection contact is Jennifer Huang, VP, Legal & Privacy. Ms Hendricks confirmed that Calderwood & Harkness will reach out to Hargrove Lister & Webb to initiate discussions regarding the negotiation and execution of updated SCCs (EU Module 2: Controller to Processor) and a UK International Data Transfer Agreement, as well as the preparation of a Transfer Impact Assessment.
Pinnacle Cloud Services Ltd
Pinnacle Cloud Services Ltd is a UK company (Company No. 09142837), registered at Apex House, 24 Victoria Embankment, London EC4Y 0DZ. Pinnacle provides Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) hosting for the NorthCloud platform and NTP's internal enterprise systems. Pinnacle operates the NTP data centres in London, Frankfurt, Amsterdam, Dublin, and Stockholm.
Thomas Okoye confirmed that the Pinnacle relationship is NTP's most significant processor engagement from a volume perspective, as substantially all of NTP's customer and operational data transits through or is stored on Pinnacle infrastructure. The existing data processing agreement with Pinnacle requires comprehensive update for GDPR Article 28 compliance.
A key concern is Pinnacle's sub-processor chain. Pinnacle utilises two sub-processors in third countries:
• Pinnacle India Pvt Ltd (Gurugram, India; CIN: U72200HR2016PTC065412) — provides infrastructure management and technical support services to Pinnacle, with access to NTP systems for maintenance and incident response purposes.
• Pinnacle APAC Pte Ltd (Singapore; UEN: 201824567K) — provides network operations centre services for the Asia-Pacific region, with potential access to NTP operational data.
Mr Okoye noted that Pinnacle's sub-processor arrangements were disclosed to NTP under the existing MSA but that no separate transfer mechanism or sub-processor DPA is in place specifically addressing the onward transfer of NTP personal data to these sub-processors. This will need to be remediated.
The primary contact at Pinnacle is Graham Alderton, Head of Legal, Cloud Services Division.
Sunderland-Hayes Payroll Services Inc.
Sunderland-Hayes Payroll Services Inc. is a Delaware corporation with its principal office at 1400 Broadway, Suite 2200, New York, New York 10018. Sunderland-Hayes provides cross-border payroll processing services for approximately 45 NTP expatriate employees based in the United States. This relationship involves the transfer of employee personal data (including financial data, tax identification numbers, and employment records) from the UK/EU to the United States for processing.
Philippa Crane confirmed that the Sunderland-Hayes relationship is managed by the HR function and that the existing contractual arrangements do not include a UK IDTA or EU SCCs. She noted that the volume of data subjects is relatively small but that the sensitivity of the data (payroll and financial information) means that the transfer mechanism must be robust.
Moritaka Systems K.K.
Moritaka Systems K.K. is a Japanese kabushiki kaisha (joint stock company) with its principal office at Shibuya Cross Tower 15F, Tokyo, Japan. Moritaka provides IoT analytics services in connection with NTP's connected-vehicle telemetry project. Approximately 12,000 device endpoints are connected through the partnership.
Kevin Ostrowski noted that the characterisation of the Moritaka relationship requires careful analysis. Depending on the degree to which Moritaka independently determines the purposes and means of processing, the relationship may constitute a joint controllership arrangement rather than a controller-processor arrangement. This characterisation will have significant implications for the applicable legal framework, including the need for a joint controller agreement under Article 26 of the UK GDPR and the EU GDPR.
Mr Ostrowski noted that the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419 of 23 January 2019) facilitates transfers of personal data from the EU to Japan without the need for additional safeguards, subject to the adequacy decision remaining in force and applicable. However, supplementary measures may still need to be assessed, particularly in light of the evolving regulatory landscape and the EDPB's recommendations on supplementary measures.
Discussion of Processor/Sub-Processor DPA Review Needs
Kevin Ostrowski summarised the processor DPA review workstream. He noted that, based on the discussion, at least four major processor relationships require DPA review and remediation, and that additional processor relationships are likely to be identified during the data mapping process. The DPA review will encompass compliance with Article 28 of the UK GDPR and the EU GDPR, transfer mechanism compliance, sub-processor management, and data breach notification obligations.
Fiona Gallagher raised an additional point. She noted that NTP's statutory auditors, Whitmore Kendall LLP (Engagement Partner: Eleanor Trask), may need to be consulted regarding GDPR compliance disclosures in NTP's annual report and accounts and in connection with internal controls attestations under the UK Corporate Governance Code. Ms Gallagher asked whether Calderwood & Harkness would be able to coordinate with Whitmore Kendall on these matters.
Kevin Ostrowski confirmed that Calderwood & Harkness would be pleased to liaise with Whitmore Kendall as needed, particularly during Phase 5 (Policies, Training & Governance) when the Audit & Risk Committee reporting framework is being developed. He noted that the gap analysis report and other Phase 1 deliverables may also be relevant to Whitmore Kendall's assessment of the adequacy of NTP's internal controls relating to data protection. Ms Gallagher agreed to confirm the coordination arrangements with Whitmore Kendall and to designate a point of contact.
3.7 DPC Inquiry — Detailed Timeline and Strategy Discussion (12:45 – 13:00)
Fiona Gallagher emphasised that the DPC preliminary inquiry (IN-22-11-3) is the single most time-sensitive element of the engagement. She stated that the Audit & Risk Committee has specifically identified the DPC inquiry as a priority risk item and has requested regular updates on the development of the response strategy.
Sanjay Mehta provided a status update on the DPC inquiry. He confirmed that the DPC opened the preliminary inquiry in November 2022 and that NTP, through Mr Mehta's office, acknowledged receipt of the DPC's correspondence and provided an initial holding response. The holding response confirmed NTP's willingness to cooperate fully with the inquiry and indicated that NTP had engaged external counsel and was undertaking a comprehensive review of its transfer mechanisms. Mr Mehta confirmed that no substantive response has yet been submitted.
Mr Mehta noted that the DPC has not set a formal statutory deadline for the substantive response but has requested a comprehensive response "at the earliest opportunity." He expressed the view that the DPC expects a response within a reasonable timeframe and that prolonged delay could be viewed unfavourably by the regulator. He also confirmed that, to the best of his knowledge, no further correspondence has been received from the DPC since the initial holding response was submitted.
Kevin Ostrowski proposed the following approach, which was agreed by all attendees:
1. While the formal Transfer Mechanisms work is scheduled for Phase 4 of the engagement, the Calderwood & Harkness team will begin preliminary analysis of the Caldwell transfer arrangement during Phase 1. This preliminary analysis will serve two purposes: (a) it will inform the gap analysis report by identifying the specific compliance gaps in the Caldwell transfer mechanism; and (b) it will enable early engagement with Hargrove Lister & Webb LLP (Natalie Prescott, Partner), Caldwell's external counsel, regarding the negotiation and execution of updated EU Standard Contractual Clauses (Module 2: Controller to Processor) and a UK International Data Transfer Agreement ("IDTA").
2. Rachel Bernstein, who has specific expertise in cross-border data transfers and telecommunications regulation, will lead the DPC inquiry response workstream and the Caldwell SCC negotiation. She will be briefed on the outcomes of this meeting by 22 February 2023 and will begin substantive work immediately.
3. The target is for the updated EU SCCs and UK IDTA with Caldwell to be negotiated, executed, and implemented before the substantive response to the DPC inquiry is submitted, so that NTP can present the DPC with a fully remediated position.
4. The substantive DPC response is to be prepared and submitted before the close of the engagement (i.e., by Q3 2023 at the latest), and ideally significantly earlier.
Fiona Gallagher confirmed that she is content with this approach. She asked that Calderwood & Harkness keep her informed of any developments in the DPC inquiry, including any further communications from the DPC, on an immediate basis.
Sanjay Mehta confirmed that he will serve as the primary contact with the DPC. All communications with the DPC will be coordinated through Mr Mehta's office, and Calderwood & Harkness will prepare all substantive response documentation for Mr Mehta's and Ms Gallagher's review before submission.
Sara Hendricks confirmed that she will prepare a regulatory risk assessment memorandum as part of the Phase 1 deliverables, specifically analysing NTP's enforcement exposure with both the ICO and the DPC. This memorandum will be privileged and confidential and will include an assessment of the likelihood and potential severity of regulatory action, taking into account the prior ICO enforcement notice, the active DPC inquiry, and any additional compliance gaps identified during the Phase 1 assessment.
3.8 Governance, Communication, and Reporting (13:00 – 13:10)
The meeting agreed the following governance and communication arrangements for the duration of the engagement:
Fortnightly Status Calls
Fortnightly 60-minute status calls will be held every other Tuesday at 14:00 GMT, commencing on Tuesday, 7 March 2023. The standing attendees for these calls will be:
• From Calderwood & Harkness: Sara Hendricks and Priscilla Wynn (Kevin Ostrowski to attend monthly)
• From NTP: Sanjay Mehta and Thomas Okoye
• From Ashdown: Robert Fairclough or Anita Chakravarti (as applicable)
Additional NTP representatives (Laura Dearden, Philippa Crane) will be invited to join specific calls where matters within their areas of responsibility are on the agenda.
Monthly Written Progress Reports
Calderwood & Harkness will prepare and deliver monthly written progress reports from Kevin Ostrowski to Fiona Gallagher. These reports will summarise work completed during the preceding month, work planned for the coming month, any issues or risks identified, the status of key deliverables, and fee expenditure against the fee cap for each phase.
Primary Contacts
Escalation Protocol
Material issues, including material compliance risks identified during the assessment, regulatory communications received from the ICO or the DPC, and any matters requiring strategic decision-making, will be escalated immediately to Kevin Ostrowski and Fiona Gallagher. Mr Ostrowski confirmed that Calderwood & Harkness will not wait for scheduled status calls to raise material issues.
Deliverable Review Process
All Calderwood & Harkness deliverables will be submitted in draft to Sanjay Mehta and Thomas Okoye for initial review and comment before being finalised and submitted to Fiona Gallagher. This process is intended to ensure that the deliverables accurately reflect NTP's operational reality and to identify any factual inaccuracies before finalisation.
Ashdown Reporting
Robert Fairclough confirmed that Ashdown Consulting Group will report to Sara Hendricks at Calderwood & Harkness on data mapping progress, with copies of all written reporting to Sanjay Mehta at NTP. Day-to-day coordination between Ashdown and Calderwood & Harkness will be managed by Sara Hendricks and Anita Chakravarti.
3.9 Any Other Business