[slide 1]
GDPR & UK GDPR Board Training — Northgate Telecommunications PLC
GDPR & UK GDPR Board Training — Northgate Telecommunications PLC
Delivered: 22 August 2023
Location: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN
Prepared by: Kevin Ostrowski, Responsible Partner, and Sara Hendricks, Lead Associate — Privacy & Data Security, Calderwood & Harkness LLP
Engagement Reference: SC/NTP/2023-0213/PDS
PRIVILEGED & CONFIDENTIAL — For Board Use Only
[slide 2]
Agenda
1. Why GDPR Matters to the Board — Regulatory Landscape & Financial Exposure
2. NTP's Data Processing Footprint — Scale and Scope
3. Regulatory History — ICO Enforcement & DPC Inquiry
4. Overview of the GDPR Compliance Program (Phases 1–5)
5. ROPA Framework — Records of Processing Activities
6. DPIA Outcomes — Key Findings and Board Decisions
7. International Data Transfers — Post-Schrems II Framework
8. Governance Structure — Roles, Responsibilities & Accountability
9. Key Policies Delivered
10. Ongoing Obligations & Next Steps
11. Q&A
[slide 3]
Why GDPR Matters to the Board
GDPR (EU) and UK GDPR (Data Protection Act 2018) impose direct accountability on organisations and their leadership
Maximum administrative fines: up to €20 million / £17.5 million or 4% of annual global turnover — whichever is higher
For NTP (FY 2022 revenue: £2.47 billion), theoretical maximum fine exposure is approximately £98.8 million
Board members and senior management bear personal responsibility for fostering a culture of compliance
Reputational risk: telecoms and SaaS providers are high-profile regulatory targets given volume and sensitivity of personal data processed
Litigation risk: GDPR provides private right of action for data subjects (Article 82)
[slide 4]
UK GDPR vs. EU GDPR — Key Divergence Points
Post-Brexit, NTP operates under two parallel data protection regimes: UK GDPR (retained EU law under DPA 2018) and EU GDPR
UK regulator: Information Commissioner's Office (ICO) — NTP registration number ZA482917
EU lead supervisory authority: Data Protection Commission (Ireland) — due to NTP's EU establishment via Northgate Ireland Ltd in Dublin
International transfer mechanisms differ: UK uses the UK IDTA; EU uses Standard Contractual Clauses (SCCs)
UK Addendum to EU SCCs bridges both regimes for dual-coverage transfers
Anticipated UK Data Protection and Digital Information Bill may create further divergence — requires monitoring
[slide 5]
NTP's Data Processing Footprint
Approximately 6.3 million consumer subscribers across UK and EU
Approximately 42,000 enterprise clients
Approximately 11,400 employees globally (~8,200 UK/EU) plus ~28,000 contractors, temporary workers, job applicants, and website visitors
Total estimated data subjects: approximately 6.38 million
Operations across 6 entities in 6 jurisdictions: NTP PLC (UK), Northgate Ireland Ltd, Northgate GmbH (Germany), Northgate B.V. (Netherlands), Northgate France SAS, Northgate Iberia S.L. (Spain)
Data centres in London, Frankfurt, Amsterdam, and Dublin
Key platforms: NorthCloud (B2B SaaS, 14 EU/EEA member states), IoT connectivity, managed network services
[slide 6]
Regulatory History — Lessons Learned
ICO Enforcement Notice (ENF/2021/0934) — 15 September 2021: Inadequate consent mechanisms for direct marketing cookies on NorthCloud customer portal
Fine imposed: £320,000 (paid). Remediation completed March 2022
DPC (Ireland) preliminary inquiry (IN-22-11-3) — opened November 2022: Cross-border data transfers from Northgate Ireland Ltd to US-based processors post-Schrems II
DPC inquiry remains active — NTP submitted comprehensive response on 4 September 2023; DPC acknowledged receipt; no further action to date
Board Audit & Risk Committee resolution (8 December 2022) mandated this comprehensive GDPR program build in response to the above
[slide 7]
GDPR Compliance Program — Overview of Phases
Phase 1: Assessment & Gap Analysis (Feb–Mar 2023) — Baseline assessment, data mapping, gap identification
Phase 2: ROPA & Data Mapping (Apr–May 2023) — 147 processing activities catalogued across UK and EU
Phase 3: Data Protection Impact Assessments (May–Jul 2023) — 11 DPIAs completed, 5 classified high-risk
Phase 4: International Data Transfer Mechanisms (Jul–Aug 2023) — SCCs, UK IDTA, TIAs for 6 transfer relationships
Phase 5: Policies, Training & Governance (Aug–Sep 2023) — Policy suite, Board training, DPC response
Engagement duration: 13 February 2023 to 8 September 2023 (207 calendar days)
Technical data mapping and Sundial Solutions implementation supported by Ashdown Consulting Group Ltd
[slide 8]
Records of Processing Activities (ROPA) — Key Findings
Total processing activities catalogued: 147 (UK operations: 89; EU operations: 58)
EU breakdown: Ireland 18, Germany 16, Netherlands 11, France 8, Spain 5
Lawful bases relied upon across all 147 activities:
| — Legitimate interest: 64 activities (43.5%) | Contract performance: 49 (33.3%) | ||
| — Legal obligation: 22 (15.0%) | Consent: 9 (6.1%) | Public interest: 2 (1.4%) | Vital interests: 1 (0.7%) |
14 activities involve special category data (employee health data, trade union membership, biometric access controls)
Legitimate Interest Assessments (LIAs) required for all 64 LI-basis activities — template and methodology delivered
[slide 9]
Data Protection Impact Assessments — Summary
11 DPIAs completed (Phase 3: 22 May – 7 July 2023)
5 classified as high-risk requiring mitigation plans:
— DPIA-001: NorthCloud AI-driven customer churn prediction (automated decision-making, profiling at scale)
— DPIA-003: NorthPulse employee wellbeing monitoring (special category data, power imbalance)
— DPIA-007: Marketing profiling & targeted advertising on NorthCloud freemium tier (cross-device tracking)
— DPIA-008: CCTV & facial recognition pilot at London HQ (biometric data — RECOMMENDED DISCONTINUATION)
— DPIA-011: Caldwell Analytics network performance data transfer to US (large-scale cross-border transfer)
Board accepted DPIA-008 discontinuation recommendation on 14 June 2023
[slide 10]
International Data Transfers — Post-Schrems II Framework
Post-Schrems II, transfers outside the UK/EEA require a valid transfer mechanism and supplementary measures where necessary
EU SCCs (Module 2 & Module 3): 7 transfers
UK Addendum to EU SCCs: 4 transfers (dual UK/EU regime coverage)
EU adequacy decisions relied upon: 2 transfers (Japan — Moritaka Systems K.K.; Canada)
6 Transfer Impact Assessments (TIAs) completed covering transfers to US, India, Singapore, and Japan
Key executions: Caldwell Analytics EU SCCs & UK IDTA (17 July 2023); Pinnacle DPA amendment (28 June 2023)
[slide 11]
Key Third-Party Processor Relationships
Caldwell Analytics Inc. (San Jose, CA, USA) — AI-driven network analytics; processes subscriber metadata, location data, device identifiers. EU SCCs & UK IDTA executed 17 July 2023
Pinnacle Cloud Services Ltd (London, UK) — Cloud IaaS/PaaS hosting for NorthCloud. Amended DPA executed 28 June 2023. Sub-processors: Pinnacle India Pvt Ltd (Gurugram) and Pinnacle APAC Pte Ltd (Singapore)
Sunderland-Hayes Payroll Services Inc. (New York, USA) — Expatriate payroll for ~45 US-assigned employees
Moritaka Systems K.K. (Tokyo, Japan) — IoT analytics for connected-vehicle telemetry (~12,000 device endpoints); potential joint controller arrangement under review
All processor agreements now incorporate Article 28 GDPR requirements, audit rights, breach notification, and sub-processor controls
[slide 12]
Governance Structure — Roles & Responsibilities
Data Protection Officer (DPO): Sanjay Mehta — reports to General Counsel with dotted line to Audit & Risk Committee. CIPP/E certified. Appointed March 2019
General Counsel & Company Secretary: Fiona Gallagher — oversight of legal, regulatory, and compliance functions
Chief Information Security Officer (CISO): Thomas Okoye — cybersecurity and technical data protection controls; reports to CTO
VP, Product & Engineering: Laura Dearden — privacy-by-design integration for NorthCloud platform
Head of EU Operations: Marcus Engström (Dublin) — EU subsidiary coordination and DPC liaison
Head of People & HR: Philippa Crane — employee data processing oversight
Business unit data stewards appointed across all UK and EU operations — responsible for ROPA accuracy and processing change notifications
[slide 13]
Key Policies Delivered
Group Data Protection Policy — overarching group-wide policy covering all UK and EU entities; approved by the Board
Data Subject Rights Procedure — one calendar month DSAR response SLA (extendable by two months for complex requests), identity verification, escalation framework
Data Breach Notification Procedure — internal escalation chain (CISO → DPO → GC), 72-hour notification to ICO/DPC, data subject notification thresholds
Data Retention Schedule — comprehensive schedule by data category, purpose, lawful basis, and deletion/anonymisation protocols
International Transfers Policy & Mechanism Selection Guidance — decision tree for transfer mechanism selection, TIA requirements
Revised Privacy Notice — Consumer Subscribers (NorthCloud) — GDPR Articles 13/14 compliant transparency notice
ROPA Methodology & Guidance Note — ongoing maintenance procedures
[slide 14]
DPC Inquiry — Current Status
DPC preliminary inquiry (IN-22-11-3) opened November 2022 — concerns cross-border data transfers from Northgate Ireland Ltd to US-based processors post-Schrems II
Comprehensive response submitted 4 September 2023, signed by Sanjay Mehta as DPO
Response demonstrates transfer mechanisms now in place: EU SCCs with Caldwell (17 July 2023), amended Pinnacle DPA (28 June 2023), TIAs completed, supplementary measures implemented
DPC acknowledged receipt — inquiry remains open; no further action taken to date
Calderwood & Harkness prepared the response (Rachel Bernstein and Sara Hendricks led drafting)
Board should be prepared for potential follow-up questions or on-site assessment by DPC
[slide 15]
Ongoing Obligations & Recommended Next Steps
Annual ROPA review cycle — all 147 processing activities to be reviewed and updated; new activities added as they arise
Annual DPIA reviews — all 11 DPIAs to be reassessed; new DPIAs required for new high-risk processing
TIA reassessments — transfer impact assessments must be re-evaluated if destination country laws change
Training refresher cycles — Board and staff training to be repeated annually at minimum
Monitor legislative developments: UK Data Protection and Digital Information Bill; EU AI Act implications for NorthCloud
DPC inquiry (IN-22-11-3) — ongoing monitoring and readiness to respond to further information requests
Whitmore Kendall LLP (statutory auditors) engagement on GDPR-related risk disclosures in annual report
Calderwood & Harkness recommends annual external review engagement
[slide 16]
Financial Summary — Engagement Overview
Total engagement fee cap: £850,000 (across five phase-based caps)
Phase 1 (Assessment & Gap Analysis): £185,000 cap
Phase 2 (ROPA & Data Mapping): £210,000 cap
Phase 3 (DPIAs): £155,000 cap
Phase 4 (Transfer Mechanisms): £175,000 cap
Phase 5 (Policies, Training & Governance): £125,000 cap
Final billed fees: £817,450 — under cap by £32,550
Estimated disbursements and travel: £32,000 (not subject to fee cap)
[slide 17]
Board Responsibilities — Summary Checklist
Ensure the DPO (Sanjay Mehta) has adequate resources, independence, and direct Board access
Review and approve DPIAs for high-risk processing (as with DPIA-008 facial recognition discontinuation)
Receive regular reporting on data protection risks via the Audit & Risk Committee
Approve the Group Data Protection Policy and material updates
Ensure data protection is embedded in strategic decisions (new products, M&A, market entry)
Oversee regulatory engagement — ICO, DPC, and other supervisory authorities
Maintain Board-level training — annual refresher at minimum
Allocate appropriate budget for ongoing compliance maintenance
[slide 18]
Questions & Discussion
Questions on any aspect of the GDPR compliance programme
Specific concerns regarding ongoing regulatory exposure (DPC inquiry, ICO)
Strategic questions: upcoming product launches, international expansion, M&A considerations
Contact: Kevin Ostrowski (kevin.ostrowski@calderwoodharkness.com) and Sara Hendricks (sara.hendricks@calderwoodharkness.com) — Calderwood & Harkness LLP, One Moorgate Square, London EC2R 6AN
Internal contacts: Sanjay Mehta (DPO), Fiona Gallagher (General Counsel), Thomas Okoye (CISO)