PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
Project Plan & Phasing Memorandum
GDPR Compliance Program Build for Northgate Telecommunications PLC
Engagement Reference: SC/NTP/2023-0213/PDS
17 February 2023
Prepared by: Sara Hendricks, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
Reviewed by: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP
Distribution: Internal Calderwood & Harkness LLP engagement team only
Kevin Ostrowski, Responsible Partner Rachel Bernstein, Billing Partner Sara Hendricks, Lead Associate Priscilla Wynn, Working Associate
Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN United Kingdom
Right-click to update Table of Contents
1. Executive Summary
This memorandum sets out the internal project plan governing the execution of the comprehensive GDPR and UK GDPR compliance program build for Northgate Telecommunications PLC ("NTP" or the "Client"), a company incorporated in England and Wales under Company Number 04837291. The memorandum is prepared for the exclusive use of the Calderwood & Harkness LLP ("C&H") engagement team and is subject to attorney work product privilege. It is not intended for distribution to the Client or any third party.
The engagement was formally opened on 13 February 2023, upon execution of the engagement letter between C&H and NTP. The target completion date for all deliverables and engagement closing is 8 September 2023, yielding a total engagement window of approximately 207 calendar days. This timeline has been established in direct response to the NTP Board Audit & Risk Committee resolution of 8 December 2022, which mandated the completion of a comprehensive GDPR compliance program build by the end of Q3 2023.
NTP is a UK-headquartered public limited company operating telecommunications infrastructure and software-as-a-service platforms—principally through its NorthCloud product—across the United Kingdom and fourteen EU/EEA member states. The group reported consolidated revenue of £2.47 billion for the financial year ended 31 December 2022 and employs approximately 11,400 individuals globally, of whom approximately 8,200 are based in the United Kingdom and the European Union. NTP's processing activities encompass a substantial data estate: approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients, and approximately 11,400 employees (together with contractors, temporary workers, applicants, and website visitors totalling approximately 6.38 million data subjects).
The engagement is structured across five sequential phases, each with defined deliverables, timelines, and fee caps, supplemented by a post-delivery phase addressing the pending DPC inquiry response and engagement closing. The total engagement fee cap across all five principal phases is £850,000, with estimated disbursements and travel costs of approximately £32,000 (not subject to the fee cap).
Three regulatory and corporate governance drivers create urgency for this engagement and inform the phasing and prioritisation decisions set out in this memorandum:
(a) The NTP Board Audit & Risk Committee adopted a formal resolution on 8 December 2022 mandating the completion of a comprehensive GDPR compliance program by the end of Q3 2023. This resolution followed a series of internal compliance reviews that identified material gaps in the group's data protection framework.
(b) The Data Protection Commission of Ireland ("DPC") opened a preliminary inquiry under reference IN-22-11-3 in November 2022 concerning cross-border data transfers from Northgate Ireland Ltd (NTP's EU establishment in Dublin) to US-based data processors, with particular reference to the post-Schrems II transfer mechanism landscape. This inquiry remains active as at the date of this memorandum and creates particular urgency for Phase 4 (International Data Transfer Mechanisms) of this engagement.
(c) NTP was the subject of an ICO Enforcement Notice (reference ENF/2021/0934) dated 15 September 2021, which imposed a fine of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud portal. While remediation of the specific matters addressed in the Enforcement Notice was completed in March 2022, the enforcement history creates a reasonable expectation of heightened ICO scrutiny of NTP's broader data protection compliance posture.
The primary client contacts for this engagement are Fiona Gallagher (General Counsel & Company Secretary), Sanjay Mehta (Data Protection Officer, CIPP/E), and Thomas Okoye (Chief Information Security Officer). Day-to-day coordination will be managed by Sara Hendricks in conjunction with Sanjay Mehta, with Kevin Ostrowski providing strategic oversight and maintaining the partner-level relationship with Fiona Gallagher.
2. Client Overview and Scope Context
2.1 NTP Group Structure
Northgate Telecommunications PLC is the parent company of the NTP Group. It is incorporated in England and Wales, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office and operational headquarters at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP holds a current registration with the UK Information Commissioner's Office under Registration Number ZA482917.
By virtue of NTP's EU establishment through Northgate Ireland Ltd, its principal office in the European Union for the purposes of the GDPR is located in Dublin. The lead EU supervisory authority for cross-border processing activities is therefore the Data Protection Commission of Ireland (the "DPC").
The NTP Group operates through its UK parent entity and five EU subsidiaries, all of which fall within the scope of this engagement. Each subsidiary has been assessed as a data controller in its own right for certain processing activities, while also processing personal data as a data processor on behalf of NTP PLC in respect of group-wide functions. The five EU subsidiaries in scope are as follows:
Northgate Ireland Ltd
Registered Office: Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland Company Registration Office Number: 587214 Staff: Approximately 340 employees Function: EU operational headquarters; hosts NorthCloud EU customer data; sales; customer support; engineering Data Centre: Dublin (collocated with Pinnacle Cloud Services infrastructure)
Northgate Ireland Ltd is of particular significance to this engagement as it serves as the NTP Group's EU operational headquarters and is the entity directly subject to the DPC's preliminary inquiry under reference IN-22-11-3. Its processing activities include the hosting and management of NorthCloud EU customer data, which involves cross-border transfers to US-based processors that are the focus of the DPC inquiry.
Northgate GmbH
Registered Office: Friedrichstraße 91, 10117 Berlin, Germany Commercial Register: HRB 214503 B (Amtsgericht Charlottenburg) Staff: Approximately 185 employees Function: Sales, engineering, data centre operations Data Centre: Frankfurt
Northgate B.V.
Registered Office: Herikerbergweg 44, 1101 CM Amsterdam, Netherlands KvK Number: 72841936 Staff: Approximately 120 employees Function: Data centre operations and network operations centre Data Centre: Amsterdam
Northgate France SAS
Registered Office: 27 Rue de Berri, 75008 Paris, France SIREN: 891 247 503 Staff: Approximately 95 employees Function: Sales and customer support
Northgate Iberia S.L.
Registered Office: Calle de Serrano 41, 28001 Madrid, Spain CIF: B-91847263 Staff: Approximately 70 employees Function: Sales and managed services
The NTP Group operates four data centres that are relevant to this engagement, located in London, Frankfurt, Amsterdam, and Dublin. The physical security, access controls, and data processing activities at each data centre will be assessed during Phase 1 and documented in the ROPA during Phase 2.
2.2 Key Third-Party Processors in Scope
The engagement scope encompasses a review and, where necessary, remediation of the contractual and compliance frameworks governing NTP's relationships with its principal third-party data processors. Four third-party processors have been identified as requiring substantive attention within the scope of this engagement. These are described in detail below.
2.2.1 Caldwell Analytics Inc.
Caldwell Analytics Inc. ("Caldwell") is a Delaware C-corporation with its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134, United States. Caldwell provides AI-driven network analytics and predictive maintenance services to NTP under a Master Services Agreement dated 1 June 2021 (the "Caldwell MSA"). In the performance of these services, Caldwell acts as a data processor on behalf of NTP and processes pseudonymised subscriber analytics data, including subscriber metadata, location data, and device identifiers. Caldwell is a US-based sub-processor, and the transfer of personal data from NTP (and from Northgate Ireland Ltd and Northgate GmbH) to Caldwell in the United States is a primary focus of Phase 4 of this engagement and a direct subject of the DPC inquiry IN-22-11-3.
Caldwell is represented by Hargrove Lister & Webb LLP ("HLW"), with the relationship partner being Natalie Prescott. HLW's principal office is located at 555 Mission Street, Suite 3100, San Francisco, California 94105, with a London office at 30 Fenchurch Street, London EC3M 3BD. Negotiations on EU Standard Contractual Clauses and the UK International Data Transfer Agreement will be conducted with Ms. Prescott and her team.
2.2.2 Pinnacle Cloud Services Ltd
Pinnacle Cloud Services Ltd ("Pinnacle") is a company incorporated in England and Wales under Company Number 09142837, with its registered office at Apex House, 24 Victoria Embankment, London EC4Y 0DZ. Pinnacle provides IaaS and PaaS services for the NorthCloud platform and NTP's enterprise systems, acting as a key data processor for the NTP Group. The primary contact at Pinnacle is Graham Alderton, Head of Legal for the Cloud Services Division.
Pinnacle itself engages sub-processors located outside the European Economic Area, creating onward transfer obligations that must be addressed within this engagement. Two sub-processors are of particular relevance:
(a) Pinnacle India Pvt Ltd — Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India; Corporate Identification Number (CIN): U72200HR2016PTC065412; approximately 600 employees. Pinnacle India provides infrastructure management, technical support, and data processing services on behalf of Pinnacle.
(b) Pinnacle APAC Pte Ltd — 8 Marina View, #32-01 Asia Square Tower 1, Singapore 018960; Unique Entity Number (UEN): 201824567K; approximately 180 employees. Pinnacle APAC provides infrastructure monitoring and network operations services.
The existing Data Processing Agreement between NTP and Pinnacle requires amendment to address, among other things, sub-processor oversight mechanisms, breach notification timelines, audit rights, and the adequacy of transfer mechanisms for onward transfers to Pinnacle India and Pinnacle APAC. Due to the urgency created by the DPC inquiry, the Pinnacle DPA amendment will be fast-tracked and is targeted for execution on 28 June 2023, during the Phase 3 period, ahead of the formal commencement of Phase 4.
2.2.3 Sunderland-Hayes Payroll Services Inc.
Sunderland-Hayes Payroll Services Inc. ("Sunderland-Hayes") is a Delaware corporation with its principal office at 1400 Broadway, Suite 2200, New York, New York 10018. Sunderland-Hayes provides cross-border payroll processing services for approximately 45 NTP expatriate employees based in the United States. While the volume of data subjects is relatively modest, the processing involves the transfer of employee personal data—including financial and tax data—to the United States, requiring an appropriate transfer mechanism and a Transfer Impact Assessment. The engagement scope for Sunderland-Hayes is limited to the preparation of template contractual provisions and guidance; full negotiation of the processor agreement with Sunderland-Hayes falls outside the scope of this engagement.
2.2.4 Moritaka Systems K.K.
Moritaka Systems K.K. ("Moritaka") is a Japanese corporation with its principal office at Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan. Moritaka is NTP's IoT analytics partner and processes data from approximately 12,000 IoT device endpoints, primarily connected-vehicle telemetry data. A preliminary assessment is required to determine whether Moritaka acts as a data processor or as a joint controller with NTP in respect of this processing. This determination will be made during Phase 1 and will inform the contractual approach to be adopted. Japan benefits from an EU adequacy decision, which simplifies the transfer mechanism requirements, though supplementary measures may nonetheless be warranted. As with Sunderland-Hayes, the engagement scope for Moritaka is limited to template provisions and guidance rather than full negotiation of the processor agreement.
2.3 Regulatory Context and Urgency Drivers
The regulatory environment in which this engagement is conducted is characterised by three distinct but interrelated factors that inform the phasing, prioritisation, and urgency of the work.
ICO Enforcement Notice ENF/2021/0934. On 15 September 2021, the UK Information Commissioner's Office issued Enforcement Notice ENF/2021/0934 against NTP, imposing a monetary penalty of £320,000 for inadequate consent mechanisms for direct marketing cookies on the NorthCloud portal. The Enforcement Notice identified failures in the design and implementation of cookie consent banners, including the use of pre-ticked consent boxes, the bundling of consent for analytics and marketing purposes, and the absence of a granular consent mechanism permitting users to accept or reject individual categories of cookies. NTP completed remediation of the specific matters addressed in the Enforcement Notice by March 2022, including the deployment of a revised consent management platform. However, the enforcement history places NTP within a category of organisations that may reasonably expect heightened ICO scrutiny across its broader data protection compliance posture. This factor underscores the importance of demonstrating a comprehensive and proactive approach to compliance through this engagement.
DPC Preliminary Inquiry IN-22-11-3. In November 2022, the DPC opened a preliminary inquiry under reference IN-22-11-3 concerning cross-border data transfers from Northgate Ireland Ltd to US-based data processors. The inquiry is understood to focus on the adequacy of transfer mechanisms employed by Northgate Ireland Ltd in light of the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II") and the requirements for supplementary measures set out in EDPB Recommendations 01/2020. As at the date of this memorandum, the inquiry remains at a preliminary stage, and no formal decision or enforcement action has been taken. However, the inquiry creates significant urgency for the transfer mechanism workstream (Phase 4) and has influenced the decision to fast-track the Pinnacle DPA amendment to 28 June 2023. The DPC inquiry response will be prepared during Phase 6, drawing on the transfer mechanisms, TIAs, and supplementary measures developed during Phases 3 and 4.
Board Audit & Risk Committee Resolution. The NTP Board Audit & Risk Committee adopted a resolution on 8 December 2022 mandating the completion of a comprehensive GDPR compliance program by Q3 2023. This resolution reflects the Board's recognition of the material regulatory, reputational, and financial risks associated with the current state of NTP's data protection compliance posture, including the potential for administrative fines of up to 4% of annual global turnover (approximately £98.8 million based on FY 2022 revenue) under both the GDPR and the UK GDPR. The resolution provides the corporate governance mandate for this engagement and establishes the Board-level accountability framework that will be reinforced through the governance deliverables in Phase 5.
3. Engagement Team and Staffing Allocations
3.1 Calderwood & Harkness LLP Team
The engagement will be staffed by a core team of four C&H lawyers from the Privacy & Data Security practice group. The team has been assembled to balance deep subject matter expertise with cost efficiency, ensuring that the engagement can be delivered within the agreed fee cap. The team composition, hourly rates, estimated allocations, and primary responsibilities are set out in the table below.
Kevin Ostrowski will serve as the Responsible Partner for the engagement, providing strategic direction, supervising the quality of all deliverables, and maintaining the partner-level relationship with Fiona Gallagher. His time allocation is deliberately kept to approximately 15% across all phases to manage costs within the fee cap, with more intensive involvement during Phase 1 (to set the strategic direction), the DPIA-008 Board presentation in Phase 3, and the Board training session and governance deliverables in Phase 5.
Rachel Bernstein brings specialist expertise in international data transfers, including extensive experience with EU Standard Contractual Clauses, UK International Data Transfer Agreements, and Transfer Impact Assessments. She will lead Phase 4 and will be the primary author of the DPC inquiry response in Phase 6. Rachel also serves as the billing partner and will be responsible for monitoring fee burn rates against phase caps, conducting the mid-engagement budget review after Phase 2, and managing monthly invoicing.
Sara Hendricks will serve as the day-to-day project lead, with an estimated allocation of approximately 60% across all phases. She will be the primary point of contact for the C&H engagement team's coordination with Sanjay Mehta (NTP DPO) and Anita Chakravarti (Ashdown Consulting Group). Sara will lead Phase 3 (DPIAs), co-lead Phase 1 (Gap Analysis), and take primary responsibility for drafting the policy suite in Phase 5 and the Board training materials.
Priscilla Wynn, as the most junior member of the team, will be allocated the highest proportion of hours (approximately 70%) and will be deployed primarily on data mapping, ROPA development, and routine policy drafting, where her lower hourly rate (£475/hour) will enable the engagement to maximise staffing efficiency against the fee cap. She will lead Phase 2 (ROPA) and provide substantial support throughout Phase 1 and Phase 5.
3.2 NTP Client Contacts and Coordination Points
The following NTP personnel have been identified as the primary client contacts for this engagement. Clear lines of coordination and responsibility have been established with each individual to ensure efficient information flow and timely decision-making.
Fiona Gallagher serves as the primary client contact and will be the ultimate decision-maker on behalf of NTP for all engagement-related matters, including Board-level approvals and signoff on the DPC inquiry response. Kevin Ostrowski will maintain the partner-level relationship with Ms. Gallagher through bi-weekly steering committee meetings and ad hoc communications as required.
Sanjay Mehta, as NTP's designated Data Protection Officer, will serve as the day-to-day operational contact and will work closely with Sara Hendricks throughout the engagement. Mr. Mehta will be responsible for coordinating internal NTP resources, validating ROPA entries, providing DPO consultation on all DPIAs, and co-signing the DPC inquiry response in his capacity as DPO. He maintains a reporting line to the NTP Board Audit & Risk Committee, which will be the governance mechanism through which the compliance program is reported to the Board.
Thomas Okoye, as CISO, will provide critical technical input on security measures, encryption standards, and technical controls documentation. His input will be particularly important for the technical annexes of SCCs and DPAs (Phase 4), the DPIAs relating to biometric access controls (DPIA-005), CCTV and facial recognition (DPIA-008), and lawful intercept systems (DPIA-010), and the data breach notification procedure (Phase 5).
Laura Dearden, Marcus Engström, and Philippa Crane will each provide subject matter input in their respective domains as set out in the table above. Their availability and responsiveness will be critical to maintaining the engagement timeline, particularly during the data mapping and ROPA phases.
3.3 External Consultant — Ashdown Consulting Group Ltd
Ashdown Consulting Group Ltd ("Ashdown"), Company Number 11293847, with offices at 15 Bedford Row, London WC1R 4BU, has been separately engaged by NTP to provide privacy engineering, data mapping, data flow inventory, and Sundial Solutions platform configuration services. Ashdown's engagement with NTP is separately contracted and funded; the C&H engagement scope does not include Sundial Solutions licensing, platform implementation costs, or management of the Ashdown engagement.
The key contacts at Ashdown are Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer). Ms. Chakravarti will be the primary operational contact for the C&H team.
There are significant dependencies between the C&H engagement and Ashdown's workstream. In particular:
(a) Ashdown's data flow inventory and data mapping outputs are a prerequisite for the development of the ROPA in Phase 2. Ashdown is targeted to deliver the data flow inventory by mid-April 2023, and any delay in this deliverable will have a direct impact on Phase 2 timelines.
(b) Ashdown is responsible for configuring the Sundial Solutions platform to host and automate the ROPA. Sundial Solutions platform configuration is targeted for completion by the end of Phase 2 (19 May 2023), such that the ROPA can be loaded into the platform as a living document.
(c) Integration of the policy suite into the Sundial Solutions platform will be coordinated during Phase 5, with Ashdown providing the technical platform configuration.
To manage these dependencies, Sara Hendricks will hold weekly coordination calls with Anita Chakravarti every Wednesday at 11:00 GMT/BST. Robert Fairclough will attend the monthly steering committee meetings with Kevin Ostrowski and the NTP client contacts. Any material delays or issues arising from the Ashdown workstream will be escalated promptly through the governance framework described in Section 9.
3.4 Coordination with Statutory Auditors — Whitmore Kendall LLP
NTP's statutory auditors are Whitmore Kendall LLP ("WK"), with the engagement partner being Eleanor Trask (Audit & Assurance), based at WK's offices at 50 Broadwick Street, London W1F 7AQ. WK's role in the context of this engagement is limited to consultation on the alignment of the GDPR governance framework with NTP's audit reporting requirements, including:
(a) The Audit & Risk Committee reporting framework, to ensure that the compliance program outputs are presented in a format consistent with the Committee's existing reporting structure and governance expectations.
(b) GDPR compliance disclosures in NTP's annual report, including risk disclosures and internal controls attestations relating to data protection.
The touchpoint with WK is anticipated to arise primarily during Phase 5, when the governance framework and Board training materials are being finalised. Sara Hendricks will coordinate with Eleanor Trask at the appropriate time, with Kevin Ostrowski available for partner-level discussions as needed.
4. Phase Structure, Deliverables, and Fee Caps
This Section sets out the detailed structure, deliverables, key activities, dependencies, and milestones for each of the five principal phases of the engagement, together with the fee cap allocated to each phase. The engagement has been designed as a sequential phased structure, with each phase building upon the outputs of the preceding phase. However, certain activities—most notably the fast-tracked Pinnacle DPA amendment—will be conducted in parallel across phase boundaries where dictated by urgency considerations.
4.1 Phase 1 — Assessment & Gap Analysis
Timeline: 20 February 2023 – 31 March 2023 (approximately 6 weeks)
Fee Cap: £185,000
Lead: Sara Hendricks; supported by Priscilla Wynn
Partner Oversight: Kevin Ostrowski
4.1.1 Deliverables. Phase 1 will produce the following four deliverables:
1. Data Mapping Questionnaire Template. A comprehensive questionnaire designed to capture the full range of personal data processing activities across all NTP business units in the UK and EU operations. The questionnaire will cover, for each processing activity: the description and purpose of the processing; the categories of data subjects; the categories of personal data (including any special category data); the lawful basis for processing; the source of the data; the recipients or categories of recipients; any transfers to third countries or international organisations; the retention period; and the technical and organisational security measures applied. The questionnaire will be distributed to all NTP business units across the UK and the five EU subsidiaries by 1 March 2023.
2. GDPR Gap Analysis Report. A comprehensive assessment of NTP's current state of GDPR and UK GDPR compliance measured against the full requirements of both regulatory frameworks. The report will identify areas of compliance, areas of partial compliance, and material gaps, and will provide prioritised recommendations for remediation. The gap analysis will cover, at a minimum: data protection governance and accountability; lawful basis for processing; data subject rights mechanisms; privacy notices and transparency; data processing agreements; international data transfer mechanisms; data protection impact assessments; data breach notification procedures; data retention and deletion; privacy by design and default; records of processing activities; and DPO function and reporting. The report will be delivered to Fiona Gallagher and Sanjay Mehta by 31 March 2023.
3. Regulatory Risk Assessment Memorandum. A focused analysis of NTP's regulatory risk exposure, with particular reference to: the ICO Enforcement Notice ENF/2021/0934 and its implications for heightened regulatory scrutiny; the DPC preliminary inquiry IN-22-11-3 and the specific risks associated with that inquiry, including potential enforcement outcomes; and a broader assessment of supervisory authority priorities and enforcement trends in the telecommunications sector across the UK and the relevant EU member states.
4. Memorandum on UK GDPR vs. EU GDPR Divergence. A detailed analysis of the post-Brexit divergence between the UK GDPR (as amended by the Data Protection Act 2018 and retained EU law) and the EU GDPR, with particular focus on areas of practical significance for NTP's operations, including: differences in international transfer mechanisms (UK IDTA vs. EU SCCs); the supervisory authority split between the ICO and the DPC (and other EU supervisory authorities); differences in adequacy decisions; any divergence in enforcement approach or guidance; and the potential impact of the UK Data Protection and Digital Information Bill, which is currently before Parliament.
4.1.2 Key Activities
The principal activities to be undertaken during Phase 1 are as follows:
(a) Phase 1 Kickoff Meeting. The engagement kickoff meeting will be held on 20 February 2023 at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. Attendees will include Kevin Ostrowski, Sara Hendricks, and Priscilla Wynn from C&H; Fiona Gallagher, Sanjay Mehta, Thomas Okoye, Laura Dearden, and Philippa Crane from NTP; and Robert Fairclough from Ashdown Consulting Group. The meeting will serve to align expectations on the engagement scope, timeline, and phasing; confirm the coordination framework and reporting structure; identify immediate priorities and potential obstacles; and establish working-level relationships between the C&H and NTP teams.
(b) Distribution of Data Mapping Questionnaires. Following the kickoff meeting, Priscilla Wynn will finalise the data mapping questionnaire template and coordinate its distribution to all NTP business units across the UK and the five EU subsidiaries. The questionnaires are targeted for distribution by 1 March 2023. A covering memorandum from Sanjay Mehta (in his capacity as DPO) will accompany the questionnaires, emphasising the importance of timely and complete responses and establishing a firm deadline of 20 March 2023 for return.
(c) Interviews with NTP Business Unit Leads and Data Stewards. Sara Hendricks and Priscilla Wynn will conduct structured interviews with NTP business unit leads and designated data stewards across the UK and EU operations. These interviews will supplement the questionnaire responses and provide qualitative insight into processing activities, data flows, and compliance challenges. Interviews will be conducted via videoconference where in-person meetings are not practicable, particularly for EU subsidiary personnel.
(d) Review of Existing Privacy Documentation. The C&H team will undertake a comprehensive review of NTP's existing privacy documentation, including (without limitation): current privacy notices; cookie consent mechanisms and consent management platform configuration; existing data processing agreements with third-party processors; data retention schedules and policies; information security policies and procedures; data breach notification procedures; DSAR handling procedures; and any previous gap analysis or compliance assessment reports.
(e) Assessment of Special Category Data Processing Activities. The team will conduct a focused assessment of the 14 processing activities identified as involving special category data within the meaning of Article 9 GDPR. These activities are understood to include employee health data processing, trade union membership records, and biometric access control systems at NTP data centres. The assessment will determine the lawful basis for each special category processing activity (including the applicable Article 9(2) condition) and identify any activities that may require a Data Protection Impact Assessment.
(f) Identification of Processing Activities Requiring DPIAs. Based on the gap analysis, the data mapping questionnaire responses, and the interview programme, the team will identify all processing activities that are likely to result in a high risk to the rights and freedoms of natural persons and therefore require a DPIA under Article 35 GDPR. This assessment will inform the scope of Phase 3 and will be included in the Gap Analysis Report.
4.1.3 Dependencies. The successful completion of Phase 1 within the established timeline is dependent on the following:
• NTP business units across the UK and all five EU subsidiaries must complete and return data mapping questionnaire responses by 20 March 2023. The risk of delay in this area is assessed as Medium (see Section 8.1) and will be mitigated through Sanjay Mehta's internal escalation and Sara Hendricks' weekly progress reports.
• Ashdown Consulting Group must commence its parallel data flow mapping exercise during Phase 1, such that its outputs are available for consolidation with the questionnaire responses at the commencement of Phase 2.
• Thomas Okoye must provide existing information security policies and technical controls documentation to the C&H team in a timely manner to enable the gap analysis to incorporate an assessment of technical and organisational measures.
4.1.4 Milestone. Gap analysis report delivered to Fiona Gallagher and Sanjay Mehta: 31 March 2023.
4.2 Phase 2 — Records of Processing Activities (ROPA) & Data Mapping
Timeline: 3 April 2023 – 19 May 2023 (approximately 7 weeks)
Fee Cap: £210,000
Lead: Priscilla Wynn; supported by Sara Hendricks
Partner Oversight: Kevin Ostrowski
4.2.1 Deliverables. Phase 2 will produce the following four deliverables:
1. ROPA — Controller Activities (NTP PLC, UK Operations). A comprehensive Article 30 register documenting all processing activities carried out by NTP PLC in its capacity as a data controller in respect of its UK operations. The ROPA is targeted to document 89 individual processing activities. For each activity, the register will record: the name and contact details of the controller and DPO; the purposes of the processing; the categories of data subjects; the categories of personal data; the lawful basis for processing (including, where applicable, the legitimate interest relied upon); the categories of recipients to whom personal data have been or will be disclosed; any transfers to third countries or international organisations, together with the identification of the transfer mechanism; the envisaged retention period for each category of data (or the criteria used to determine the retention period); and a general description of the technical and organisational security measures in place.
2. ROPA — Controller Activities (EU Subsidiaries). An Article 30 register documenting all processing activities carried out by each of the five EU subsidiaries in their capacity as data controllers. The ROPA is targeted to document 58 individual processing activities across the five entities, distributed as follows: Northgate Ireland Ltd (18 activities); Northgate GmbH (16 activities); Northgate B.V. (11 activities); Northgate France SAS (8 activities); and Northgate Iberia S.L. (5 activities). The same data fields as described above for the UK ROPA will be captured for each EU subsidiary activity.
3. ROPA Methodology & Guidance Note. An internal NTP guidance document setting out the methodology for maintaining and updating the ROPA on an ongoing basis. This document will provide practical guidance for NTP data stewards and the DPO function on: how to identify new processing activities that require ROPA registration; how to update existing ROPA entries when processing activities change; the frequency of scheduled ROPA reviews; the governance process for ROPA amendments; and integration with the Sundial Solutions platform for automated ROPA management.
4. Legitimate Interest Assessment (LIA) Template. A structured template for conducting legitimate interest assessments in respect of the 64 processing activities that rely on legitimate interest as the lawful basis for processing. The template will implement the three-part balancing test comprising: (i) identification of the legitimate interest pursued by the controller or a third party; (ii) assessment of whether the processing is necessary for the purpose of that legitimate interest (the "necessity test"); and (iii) a balancing of the legitimate interest against the interests or fundamental rights and freedoms of the data subject (the "balancing test"). The template will include a worked example based on NTP's network optimisation processing activity, demonstrating the application of the three-part test to a concrete use case.
4.2.2 Key Activities
The principal activities to be undertaken during Phase 2 are as follows:
(a) Consolidation and Validation of Data Mapping Outputs. Priscilla Wynn will consolidate the data mapping questionnaire responses received during Phase 1 with the data flow inventory outputs prepared by Ashdown Consulting Group. A validation exercise will be conducted to reconcile the two data sets, identify any inconsistencies or gaps, and resolve discrepancies through follow-up enquiries with the relevant NTP business unit leads.
(b) Cataloguing of All Processing Activities. The team will systematically catalogue all processing activities across the NTP Group, with a target of 147 total processing activities (89 UK, 58 EU). Each activity will be classified by type, assessed for lawful basis, and documented in the ROPA format.
(c) Lawful Basis Analysis. For each of the 147 processing activities, the team will determine and document the lawful basis for processing. Based on preliminary assessments from Phase 1, the anticipated lawful basis distribution across all activities is as follows:
• Legitimate interest (Article 6(1)(f)): 64 activities (43.5%)
• Contract performance (Article 6(1)(b)): 49 activities (33.3%)
• Legal obligation (Article 6(1)(c)): 22 activities (15.0%)
• Consent (Article 6(1)(a)): 9 activities (6.1%)
• Public interest (Article 6(1)(e)): 2 activities (1.4%)
• Vital interests (Article 6(1)(d)): 1 activity (0.7%)
(d) Data Subject Population Analysis. The ROPA will document the total population of data subjects across all processing activities. The estimated total data subject population is approximately 6.38 million, comprising: approximately 6.3 million consumer subscribers; approximately 42,000 enterprise clients; approximately 11,400 employees; and approximately 28,000 contractors, temporary workers, job applicants, and website visitors.
(e) Sundial Solutions Platform Configuration. Priscilla Wynn and Sara Hendricks will coordinate with Anita Chakravarti at Ashdown to configure the Sundial Solutions platform to host and automate the ROPA. This will involve defining the data model and field structure within Sundial Solutions, uploading the ROPA data, establishing workflow rules for ROPA updates and approvals, and testing the platform to ensure it accurately reflects the documented processing activities.
(f) LIA Template Development. Sara Hendricks will develop the LIA template, incorporating guidance from the ICO's legitimate interest guidance note and the EDPB's Opinion 06/2014 on the notion of legitimate interests. The worked example will be based on NTP's network optimisation processing activity, which processes subscriber metadata (including traffic data and approximate location data) for the purpose of optimising network capacity and performance. This activity has been selected as the worked example because it presents a representative balancing analysis involving subscriber data, a clear and articulable legitimate interest, and meaningful considerations on the data subject side (including the reasonable expectations of subscribers and the availability of pseudonymisation as a safeguard).
(g) Business Unit Validation Sessions. Priscilla Wynn will conduct validation sessions with each NTP business unit to confirm the accuracy and completeness of the ROPA entries. Marcus Engström (Dublin) will coordinate the EU subsidiary validation sessions, ensuring that designated contacts at Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L. are available and engaged.
4.2.3 Dependencies.
• Ashdown data flow inventory delivery by mid-April 2023 is critical to Phase 2 timelines. Any delay in this deliverable will directly impact the consolidation and validation exercise and may cascade to delay ROPA v1.0 completion.
• Business unit validation sessions require the availability and cooperation of NTP personnel across the UK and all five EU subsidiaries. Marcus Engström (Dublin) will be responsible for coordinating EU subsidiary inputs.
• The Sundial Solutions platform configuration is dependent on Ashdown's technical implementation work, which is separately contracted by NTP.
4.2.4 Milestone. ROPA v1.0 delivered: 19 May 2023.
4.3 Phase 3 — Data Protection Impact Assessments (DPIAs)
Timeline: 22 May 2023 – 7 July 2023 (approximately 7 weeks)
Fee Cap: £155,000
Lead: Sara Hendricks; supported by Priscilla Wynn
Partner Oversight: Kevin Ostrowski
4.3.1 Deliverables. Phase 3 will produce 11 individual Data Protection Impact Assessments and a summary register, as follows:
1. DPIA-001: NorthCloud AI-Driven Customer Churn Prediction Model. This DPIA addresses NTP's deployment of an AI-driven predictive model that analyses subscriber behaviour data to identify customers at risk of churn. The processing is classified as high-risk on the basis that it involves automated decision-making, profiling, and processing of personal data at scale. The DPIA will assess the necessity and proportionality of the processing, evaluate the risks to data subjects' rights (including risks of inaccurate profiling, lack of transparency, and potential adverse effects on subscriber access to services), and identify appropriate mitigation measures (including human-in-the-loop review, transparency mechanisms, and the right to object).
2. DPIA-002: Network Traffic Analysis and Anomaly Detection. This DPIA addresses the processing of subscriber metadata for network traffic analysis and anomaly detection purposes. The processing involves large-scale analysis of communications metadata, including traffic patterns, session data, and approximate location data, for the purpose of identifying network anomalies, detecting potential security threats, and optimising network performance.
3. DPIA-003: Employee Wellbeing Monitoring Platform "NorthPulse". This DPIA addresses the NorthPulse platform, an employee wellbeing monitoring tool that collects and processes employee health and wellbeing data. The processing is classified as high-risk on the basis that it involves special category data (health data), systematic monitoring of employees, and the inherent power imbalance in the employment relationship that may undermine the voluntariness of consent. The DPIA will give particular attention to the lawful basis for processing (including whether consent can be freely given in the employment context), data minimisation, and the effectiveness of pseudonymisation and aggregation measures.
4. DPIA-004: IoT Device Telemetry Processing (Smart City Pilot, Birmingham). This DPIA addresses the processing of data from IoT device endpoints as part of NTP's smart city pilot in Birmingham. The processing involves the collection and analysis of telemetry data from approximately 12,000 IoT device endpoints, including connected-vehicle telemetry, environmental sensors, and traffic management systems.
5. DPIA-005: Biometric Access Control System (Data Centres). This DPIA addresses the biometric access control systems deployed at NTP's data centres in London, Frankfurt, Amsterdam, and Dublin. The processing involves the collection and processing of biometric data (fingerprint and/or palm geometry scans) for the purpose of access control and security.
6. DPIA-006: Customer Credit Scoring and Fraud Detection. This DPIA addresses NTP's customer credit scoring processes, which are used to assess the creditworthiness of new and existing subscribers, and its fraud detection systems, which analyse transaction and usage patterns to identify potentially fraudulent activity.
7. DPIA-007: Marketing Profiling and Targeted Advertising, NorthCloud Freemium Tier. This DPIA addresses the profiling and targeted advertising activities conducted in connection with the NorthCloud freemium tier offering. The processing is classified as high-risk on the basis that it involves profiling, large-scale processing of subscriber data, and the potential for discriminatory targeting based on inferred characteristics. The DPIA will assess the transparency of profiling practices, the adequacy of opt-out mechanisms, and the risks of discriminatory outcomes.
8. DPIA-008: CCTV and Facial Recognition Pilot, London HQ. This DPIA addresses the pilot deployment of CCTV with facial recognition technology at NTP's London headquarters at Northgate Tower. The processing is classified as high-risk on the basis that it involves biometric data (which constitutes special category data when processed for the purpose of uniquely identifying a natural person), systematic monitoring of a publicly accessible area, and the use of innovative technology. This DPIA is expected to recommend the discontinuation of the facial recognition pilot on the basis that the processing cannot be demonstrated to be necessary and proportionate for the stated purposes, given the availability of less intrusive alternatives. Kevin Ostrowski will present this recommendation to Fiona Gallagher by 12 June 2023 for consideration at the NTP Board meeting on 14 June 2023.
9. DPIA-009: Cross-Border HR Analytics and Workforce Planning. This DPIA addresses the processing of employee personal data for cross-border HR analytics and workforce planning purposes, including analysis of workforce demographics, performance data, attrition patterns, and succession planning across the NTP Group's UK and EU operations.
10. DPIA-010: Lawful Intercept and Communications Data Retention. This DPIA addresses NTP's obligations in respect of lawful interception of communications and communications data retention under the Regulation of Investigatory Powers Act 2000 ("RIPA") and the Investigatory Powers Act 2016 ("IPA"). This DPIA will assess the intersection of statutory obligations with data protection requirements, the proportionality of data retention periods, access controls, and oversight mechanisms.
11. DPIA-011: Caldwell Analytics Network Performance Data Transfer to US. This DPIA addresses the transfer of pseudonymised subscriber analytics data from NTP (and from Northgate Ireland Ltd and Northgate GmbH) to Caldwell Analytics Inc. in the United States for AI-driven network analytics and predictive maintenance. The processing is classified as high-risk on the basis that it involves large-scale third-country transfer to a jurisdiction without an adequacy decision (at the time of the Caldwell MSA), US surveillance risks (FISA Section 702, EO 12333), and profiling. This DPIA will be closely coordinated with TIA-001 in Phase 4, and the supplementary measures identified in the DPIA will inform the TIA analysis.
12. DPIA Summary Register & Board Report. An executive summary document consolidating the findings, risk assessments, and recommendations from all 11 DPIAs, prepared for presentation to the NTP Board Audit & Risk Committee. The Board Report will provide a high-level overview of the identified risks, the mitigation measures recommended, and any residual risks requiring Board-level attention.
4.3.2 Key Activities
(a) DPIA Methodology. Each DPIA will follow a consistent methodology comprising: (i) a systematic description of the processing operation, including its nature, scope, context, and purposes; (ii) an assessment of the necessity and proportionality of the processing in relation to the purposes; (iii) an identification and assessment of the risks to the rights and freedoms of data subjects; and (iv) the identification of measures to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data and to demonstrate compliance.
(b) Stakeholder Consultation. Each DPIA will involve consultation with the relevant NTP stakeholders, as follows: Laura Dearden (DPIA-001 and DPIA-007, NorthCloud platform); Philippa Crane (DPIA-003 and DPIA-009, employee data); Thomas Okoye (DPIA-005, DPIA-008, and DPIA-010, security systems and lawful intercept); and Sanjay Mehta (all DPIAs, in his capacity as DPO). The DPO's views will be documented within each DPIA in accordance with Article 35(2) GDPR.
(c) High-Risk DPIA Detailed Mitigation Plans. Five of the 11 DPIAs have been classified as high-risk and will require detailed mitigation plans: DPIA-001 (AI churn prediction), DPIA-003 (NorthPulse employee wellbeing), DPIA-007 (marketing profiling), DPIA-008 (facial recognition), and DPIA-011 (Caldwell US transfer). The mitigation plans will identify specific technical and organisational measures to reduce the identified risks to an acceptable level, or (in the case of DPIA-008) will recommend that the processing should not proceed.
(d) DPIA-008 Board Recommendation. As noted above, DPIA-008 is expected to recommend the discontinuation of the facial recognition pilot at Northgate Tower. This is a significant recommendation with operational and strategic implications, and it requires Board-level consideration. Kevin Ostrowski will present the recommendation and supporting analysis to Fiona Gallagher by 12 June 2023, in advance of the NTP Board meeting on 14 June 2023, to allow for Board discussion and decision.
(e) Coordination of DPIA-011 and TIA-001. DPIA-011 (Caldwell Analytics transfer) and TIA-001 (Transfer Impact Assessment for the same transfer) are closely interrelated. The risk assessment and supplementary measures analysis in DPIA-011 will directly inform TIA-001 in Phase 4. Sara Hendricks will coordinate with Rachel Bernstein to ensure consistency and to avoid duplication of effort across the two workstreams.
4.3.3 Dependencies.
• ROPA v1.0 completion is a prerequisite for DPIA scoping, as the ROPA provides the comprehensive inventory of processing activities from which DPIA-eligible activities are identified and prioritised.
• Thomas Okoye must provide technical controls documentation for biometric access control and CCTV systems to enable the preparation of DPIA-005 and DPIA-008. This documentation is requested by 29 May 2023.
• Laura Dearden must provide NorthCloud AI model documentation—including model architecture, training data descriptions, decision logic, and output interpretability—to enable the preparation of DPIA-001. This documentation is requested by 29 May 2023.
4.3.4 Milestones.
• DPIA-008 recommendation presented to NTP Board: 14 June 2023
• All 11 DPIAs completed: 7 July 2023
4.4 Phase 4 — International Data Transfer Mechanisms
Timeline: 10 July 2023 – 4 August 2023 (approximately 4 weeks)
Fee Cap: £175,000
Lead: Rachel Bernstein; supported by Sara Hendricks
Partner Oversight: Kevin Ostrowski
4.4.1 Deliverables. Phase 4 will produce the following deliverables:
1. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. A set of EU Standard Contractual Clauses adopted pursuant to the European Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), governing the transfer of pseudonymised subscriber analytics data from NTP (and Northgate Ireland Ltd) to Caldwell Analytics Inc. in the United States. The SCCs will include completed Annexes I (list of parties, description of transfer, competent supervisory authority), II (technical and organisational measures), and III (list of sub-processors). Target execution date: 17 July 2023.
2. UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics Inc. A UK International Data Transfer Agreement in the form approved by the ICO, governing the transfer of personal data from NTP PLC (as a UK controller) to Caldwell Analytics Inc. in the United States. The IDTA will be executed alongside the EU SCCs to provide coverage for transfers subject to the UK GDPR. Target execution date: 17 July 2023.
3. Transfer Impact Assessment (TIA-001): NTP → Caldwell Analytics Inc. (US). A comprehensive Transfer Impact Assessment evaluating the laws and practices of the United States that may affect the protection of personal data transferred to Caldwell. The assessment will address: the Foreign intelligence Surveillance Act (FISA), including Section 702; Executive Order 12333; the Clarifying Lawful Overseas Use of Data (CLOUD) Act; the EU-US Data Privacy Framework (adopted by the European Commission on 10 July 2023); US Constitutional protections; and judicial and administrative redress mechanisms. The TIA will assess the effectiveness of the supplementary measures identified in the SCCs and DPIA-011, including encryption at rest (AES-256), encryption in transit (TLS 1.3), pseudonymisation of direct identifiers, and contractual audit rights.
4. Transfer Impact Assessment (TIA-002): Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd. A Transfer Impact Assessment evaluating the laws and practices of India that may affect the protection of personal data transferred from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd. The assessment will address: the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011; government surveillance powers under Indian law; judicial oversight mechanisms; and the adequacy of supplementary measures.
5. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd. An amended and restated Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd, addressing: the sub-processor approval mechanism (prior specific authorisation or general written authorisation with objection right); breach notification obligations (within 36 hours of becoming aware); audit rights (including the right to conduct on-site audits and to appoint third-party auditors); data deletion and return obligations on termination; and the adequacy of transfer mechanisms for onward transfers to Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd. Note: this deliverable will be fast-tracked for execution during Phase 3, with a target execution date of 28 June 2023, to address the urgency created by the DPC inquiry.
6. UK Addendum to EU SCCs — Template. A template UK Addendum to the EU Standard Contractual Clauses in the form approved by the ICO, for use in respect of the four transfers that are subject to both the UK GDPR and the EU GDPR. The template will be pre-populated with NTP-specific information and accompanied by drafting guidance notes.
7. International Transfers Policy & Mechanism Selection Guidance. An internal NTP policy document governing the identification, assessment, and management of international data transfers. The policy will include: a decision tree for mechanism selection (adequacy decision, EU SCCs, UK IDTA, UK Addendum to EU SCCs, binding corporate rules, or derogations); TIA requirements and methodology; supplementary measures guidance; ongoing monitoring obligations; and roles and responsibilities for transfer compliance.
4.4.2 Additional Transfer Impact Assessments
In addition to TIA-001 and TIA-002, four further Transfer Impact Assessments will be completed during Phase 4:
TIA-003: Pinnacle Cloud Services Ltd → Pinnacle APAC Pte Ltd (Singapore). Assessment of the Singapore legal framework, including the Personal Data Protection Act 2012 (PDPA), government access powers, and judicial oversight, in respect of infrastructure monitoring services provided by Pinnacle APAC.
TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (US). Assessment of the US legal framework in the context of expatriate payroll processing for approximately 45 NTP employees. While this TIA will share common ground with TIA-001 in its assessment of US law, it will address the specific characteristics of the payroll data transfer, including the limited volume of data subjects and the categories of personal data involved (financial and tax data).
TIA-005: Northgate GmbH → Caldwell Analytics Inc. (US). Assessment of the transfer of German subscriber analytics data from Northgate GmbH to Caldwell Analytics Inc. This TIA will address any additional requirements arising from the German Federal Data Protection Act (Bundesdatenschutzgesetz) and the guidance of the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).
TIA-006: NTP → Moritaka Systems K.K. (Japan). Assessment of the transfer of IoT platform analytics data to Moritaka Systems K.K. in Japan. Japan benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2019/419 of 23 January 2019), and Canada benefits from a partial adequacy decision under PIPEDA. The TIA will assess the continued adequacy of the Japanese framework and identify any supplementary measures that may be warranted.
A total of six TIAs will therefore be completed during Phase 4.
4.4.3 Key Activities
(a) Transfer Mechanism Implementation. The following transfer mechanisms will be implemented across the NTP Group's international data transfers during Phase 4:
• UK IDTA: Three transfers to the United States, India, and Singapore respectively.
• EU SCCs Module 2 (Controller to Processor) and Module 3 (Processor to Sub-Processor): Seven transfers, covering the direct controller-to-processor transfers (NTP/Northgate Ireland Ltd to Caldwell, NTP to Sunderland-Hayes) and the processor-to-sub-processor transfers (Pinnacle to Pinnacle India, Pinnacle to Pinnacle APAC).
• UK Addendum to EU SCCs: Four transfers that are subject to both the UK GDPR and the EU GDPR.
• Adequacy Decisions: Two transfers — Japan (under the EU adequacy decision) and Canada (under the PIPEDA partial adequacy decision).
(b) Supplementary Measures. Supplementary measures will be assessed and documented for each transfer that is not covered by an adequacy decision. The supplementary measures to be considered and, where appropriate, implemented include: encryption at rest using AES-256; encryption in transit using TLS 1.3; pseudonymisation of direct identifiers prior to transfer; contractual audit rights enabling NTP (or an appointed third-party auditor) to conduct inspections of the data importer's processing environment; and data localisation for certain categories of particularly sensitive data where feasible.
(c) Negotiation of SCCs with Caldwell Analytics. Rachel Bernstein will lead the negotiation of the EU SCCs and UK IDTA with Caldwell Analytics Inc., through Caldwell's external counsel at Hargrove Lister & Webb LLP (Natalie Prescott). Draft SCCs and IDTA will be circulated to HLW by end of June 2023, with an anticipated 10 business day review period. The principal negotiation points are expected to include: audit rights (scope, frequency, and cost allocation); sub-processor replacement notification obligations; liability allocation between the parties; mutual confidentiality obligations; and the scope and specificity of SCC Annex II (technical and organisational measures). Rachel Bernstein will seek to conclude negotiations and achieve execution by 17 July 2023.
(d) Negotiation of Amended DPA with Pinnacle. Rachel Bernstein will lead the negotiation of the amended DPA with Pinnacle Cloud Services Ltd, through Pinnacle's Head of Legal, Graham Alderton. The key terms to be negotiated include: the sub-processor approval mechanism (C&H will recommend prior specific authorisation for sub-processors located outside the EEA, with general written authorisation and an objection right for EEA-based sub-processors); breach notification within 36 hours of Pinnacle becoming aware of a personal data breach; audit rights (including on-site inspection rights and the right to appoint third-party auditors); and data deletion and return obligations on termination or expiry of the agreement. The Pinnacle DPA amendment is being fast-tracked ahead of the Phase 4 formal start date to address the urgency created by the DPC inquiry, with a target execution date of 28 June 2023 (during the Phase 3 period).
(e) Coordination with External Parties. The following inputs are required from external parties during Phase 4: Jennifer Huang and Derek Rawlings at Caldwell Analytics Inc. are to provide security documentation for completion of SCC Annex II (technical and organisational measures); Graham Alderton at Pinnacle Cloud Services Ltd is to provide the current sub-processor list and security measures documentation; and Thomas Okoye at NTP is to confirm the encryption and pseudonymisation standards that NTP will commit to implementing as supplementary measures.