DATA BREACH NOTIFICATION PROCEDURE
NORTHGATE TELECOMMUNICATIONS PLC
CONFIDENTIAL — INTERNAL USE ONLY
DOCUMENT CONTROL PAGE
Version History
1. INTRODUCTION AND PURPOSE
1.1 Background
Northgate Telecommunications PLC ("NTP" or the "Company") is a United Kingdom-headquartered public limited company incorporated under the Companies Act 2006 with registered number 04837291. NTP's registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office is situated at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP is a provider of fixed-line and mobile telecommunications infrastructure, managed network services, Internet of Things ("IoT") connectivity platforms, and cloud-based unified communications solutions, operating across the United Kingdom and the European Union.
NTP processes personal data in connection with the provision of its services and the conduct of its business operations. The Company's data processing activities encompass a significant volume and diversity of personal data. As of the date of this Procedure, NTP processes personal data relating to the following approximate categories and volumes of data subjects:
(a) approximately 6.3 million consumer subscribers to NTP's fixed-line and mobile telecommunications services in the United Kingdom;
(b) approximately 42,000 enterprise clients, including their authorised users and administrative contacts, principally in connection with the NorthCloud cloud-based unified communications platform, which is sold on a business-to-business basis across 14 EU/EEA member states;
(c) approximately 11,400 employees of NTP PLC and its subsidiaries;
(d) approximately 28,000 additional data subjects, comprising contractors, temporary workers, job applicants, and visitors to NTP's websites and premises; and
(e) a total data subject population of approximately 6.38 million individuals.
NTP conducts its EU operations through the following wholly-owned subsidiary entities:
(a) Northgate Ireland Ltd, incorporated in Ireland, with its registered office in Dublin, serving as NTP's main establishment in the European Union for the purposes of the EU General Data Protection Regulation;
(b) Northgate GmbH, incorporated in Germany, with its registered office in Berlin;
(c) Northgate B.V., incorporated in the Netherlands, with its registered office in Amsterdam;
(d) Northgate France SAS, incorporated in France, with its registered office in Paris; and
(e) Northgate Iberia S.L., incorporated in Spain, with its registered office in Madrid.
NTP's technical infrastructure includes data centres located in London, Frankfurt, Amsterdam, and Dublin. These data centres support the full range of NTP's processing activities, including the hosting of the NorthCloud platform, telecommunications network management systems, customer relationship management databases, human resources information systems, and IoT connectivity platforms.
NTP's data processing activities are extensive and have been catalogued across the NTP Group. As of the date of this Procedure, NTP maintains a record of 147 catalogued processing activities, of which 89 are conducted under the UK GDPR and 58 are conducted under the EU GDPR. Of these processing activities, 14 involve the processing of special category data as defined in Article 9 of the GDPR, including employee health data, trade union membership records, and biometric data used for physical access controls at NTP's data centres and secure facilities.
1.2 Purpose
The purpose of this Data Breach Notification Procedure (the "Procedure") is to establish NTP's internal processes for identifying, assessing, escalating, notifying, documenting, and reviewing personal data breaches. This Procedure is designed to ensure that NTP complies with its obligations under applicable data protection legislation, including:
(a) the UK General Data Protection Regulation (the "UK GDPR"), as retained EU law under the European Union (Withdrawal) Act 2018 and as supplemented by the Data Protection Act 2018 (the "DPA 2018"), and in particular Articles 33 and 34 thereof, which impose obligations on controllers to notify the competent supervisory authority and, in certain circumstances, affected data subjects of personal data breaches;
(b) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), and in particular Articles 33 and 34 thereof, which apply to the processing activities of NTP's EU subsidiaries and to the processing of personal data of data subjects in the European Economic Area;
(c) the Privacy and Electronic Communications Regulations 2003 (the "PECR"), and in particular Regulation 5A thereof, which imposes specific breach notification obligations on providers of public electronic communications services, applicable to NTP in its capacity as a provider of fixed-line and mobile telecommunications services in the United Kingdom; and
(d) applicable sector-specific obligations under the Communications Act 2003, including requirements relating to the security of electronic communications networks and services.
This Procedure is issued in the context of NTP's broader programme of data protection compliance and governance. In this regard, the following matters are of particular relevance and underscore the critical importance of robust breach management within the NTP Group:
(a) On 15 September 2021, the Information Commissioner's Office ("ICO") issued Enforcement Notice ENF/2021/0934 against NTP PLC, together with a monetary penalty of £320,000, in connection with the Company's failure to implement adequate consent mechanisms for direct marketing communications to consumer subscribers. The Enforcement Notice identified deficiencies in NTP's internal governance and compliance processes, including record-keeping and accountability measures, which bear directly on the Company's ability to manage and respond to personal data breaches effectively.
(b) In November 2022, the Data Protection Commission ("DPC") in Ireland opened a preliminary inquiry under reference IN-22-11-3 concerning the processing activities of Northgate Ireland Ltd in connection with the NorthCloud platform. That inquiry remains active as of the date of this Procedure.
(c) On 8 December 2022, the NTP Board Audit & Risk Committee passed a resolution mandating a comprehensive GDPR compliance programme build across the NTP Group. This Procedure is a component of that programme, which also includes the NTP Group Data Protection Policy, the Data Subject Rights Procedure, the International Transfers Policy, and the implementation of technical and organisational measures across the Group.
1.3 Scope
This Procedure applies to all personal data processed by NTP PLC and each of its EU subsidiaries, namely Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L. (together, the "NTP Group").
This Procedure covers personal data breaches occurring:
(a) in NTP's own systems, networks, databases, and premises, whether at the Company's principal office, registered office, data centre locations (London, Frankfurt, Amsterdam, and Dublin), or any other NTP facility;
(b) at data processors engaged by NTP or its subsidiaries, including but not limited to Pinnacle Cloud Services Ltd, Caldwell Analytics Inc., Sunderland-Hayes Payroll Services Inc., and Moritaka Systems K.K.; and
(c) at sub-processors engaged by NTP's data processors, including but not limited to Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd.
This Procedure applies to all NTP Group employees, contractors, temporary workers, and any third parties who process personal data on behalf of NTP or who become aware of a suspected or actual personal data breach involving NTP personal data.
This Procedure covers all NTP services and platforms, including the provision of fixed-line and mobile telecommunications services in the United Kingdom, the NorthCloud cloud-based unified communications platform across 14 EU/EEA member states, managed network services, and the IoT connectivity platform.
1.4 Relationship to Other NTP Policies
This Procedure is part of NTP's integrated data protection governance framework and should be read in conjunction with the following NTP Group policies and procedures:
(a) NTP Group Data Protection Policy (Document Reference: NTP-DPP-GDP-2023-001), which sets out the overarching principles, governance structures, and accountability mechanisms for data protection across the NTP Group;
(b) Data Subject Rights Procedure (Document Reference: NTP-DPP-DSR-2023-001), which establishes the process for receiving, validating, and responding to data subject access requests and other rights requests under the GDPR, and which may be engaged where a data breach triggers data subject inquiries;
(c) NTP Information Security Incident Response Plan, maintained by the Chief Information Security Officer, Thomas Okoye, which addresses the technical and operational response to information security incidents, including those that may or may not constitute personal data breaches;
(d) NTP Data Retention Schedule, which governs the retention and deletion of personal data across the NTP Group and informs the assessment of the volume and nature of data potentially affected by a breach; and
(e) International Transfers Policy & Mechanism Selection Guidance, which governs the transfer of personal data outside the United Kingdom and the European Economic Area and identifies applicable transfer mechanisms, supplementary measures, and transfer impact assessments relevant to breach risk assessment.
Where a security incident is detected, the NTP Information Security Incident Response Plan governs the initial technical response. This Procedure is engaged at the point at which the CISO or DPO determines, or has reasonable grounds to suspect, that the security incident involves the compromise, loss, destruction, alteration, unauthorised disclosure of, or access to personal data. The two instruments operate in parallel, and the respective responsibilities of the CISO and DPO are coordinated in accordance with the escalation timelines set out in Section 4 of this Procedure.
2. DEFINITIONS
2.1 Key Definitions
For the purposes of this Procedure, the following terms shall have the meanings set out below, unless the context requires otherwise. Where terms are defined in the UK GDPR, the EU GDPR, or the DPA 2018, those statutory definitions shall apply and the definitions below are provided for convenience and operational clarity.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed, as defined in Article 4(12) of the UK GDPR and Article 4(12) of the EU GDPR. For the avoidance of doubt, a personal data breach encompasses any of the following categories of incident:
(a) Confidentiality breach: an unauthorised or accidental disclosure of, or access to, personal data, such as the misdirection of an email containing customer records, unauthorised access to a database by an internal user without a legitimate business need, or the exfiltration of personal data by an external threat actor;
(b) Integrity breach: an unauthorised or accidental alteration of personal data, such as the corruption of customer billing records through a software defect or the deliberate modification of employee records by an unauthorised party; and
(c) Availability breach: an accidental or unauthorised loss of access to, or destruction of, personal data, such as the permanent loss of data due to a ransomware attack, the accidental deletion of a customer database without a viable backup, or a prolonged outage of a system containing personal data where access cannot be restored within a reasonable timeframe.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In the context of this Procedure, the Controller is NTP PLC and/or the relevant NTP subsidiary entity (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, or Northgate Iberia S.L.) that determines the purposes and means of the relevant processing activity.
"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller. In the context of this Procedure, NTP's key Processors include, but are not limited to:
(a) Pinnacle Cloud Services Ltd (Company Number: 09142837), which provides cloud infrastructure and hosting services for NTP's NorthCloud platform;
(b) Caldwell Analytics Inc. (Delaware C-Corporation), which provides data analytics services in connection with NTP's customer and network data;
(c) Sunderland-Hayes Payroll Services Inc. (principal office: New York, USA), which processes expatriate payroll data for NTP employees; and
(d) Moritaka Systems K.K. (principal office: Tokyo, Japan), which provides IoT analytics services in connection with NTP's IoT connectivity platform.
"Sub-processor" means an entity engaged by a Processor to carry out specific processing activities on behalf of the Controller. In the context of this Procedure, Sub-processors include Pinnacle India Pvt Ltd (CIN: U72200HR2016PTC065412) and Pinnacle APAC Pte Ltd (UEN: 201824567K), each of which is engaged by Pinnacle Cloud Services Ltd.
"Supervisory Authority" means an independent public authority established by a member state or, in the case of the United Kingdom, the authority designated under the DPA 2018, which is responsible for monitoring the application of data protection legislation. For NTP:
(a) The Information Commissioner's Office ("ICO") is the competent supervisory authority for UK GDPR matters. NTP's ICO registration number is ZA482917.
(b) The Data Protection Commission ("DPC") of Ireland is the lead supervisory authority for EU GDPR matters, by virtue of NTP's main establishment in the European Union being Northgate Ireland Ltd, incorporated in Dublin.
"Concerned Supervisory Authority" means a supervisory authority which is concerned by the processing of personal data because the controller or processor is established on the territory of the member state of that supervisory authority, data subjects residing in the member state of that supervisory authority are substantially affected or likely to be substantially affected by the processing, or a complaint has been lodged with that supervisory authority. In the context of this Procedure, Concerned Supervisory Authorities may include, among others:
(a) the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit ("BfDI"), Germany, in respect of Northgate GmbH;
(b) the Autoriteit Persoonsgegevens ("AP"), the Netherlands, in respect of Northgate B.V.;
(c) the Commission Nationale de l'Informatique et des Libertés ("CNIL"), France, in respect of Northgate France SAS; and
(d) the Agencia Española de Protección de Datos ("AEPD"), Spain, in respect of Northgate Iberia S.L.
"High Risk to Rights and Freedoms" means the threshold at which a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, thereby triggering the obligation to communicate the breach to affected data subjects under Article 34 of the UK GDPR and Article 34 of the EU GDPR. The assessment of whether a breach gives rise to a high risk to rights and freedoms is addressed in Section 6 of this Procedure.
"Breach Response Team" or "BRT" means the designated internal team responsible for managing the response to personal data breaches, as defined in Section 4.1 of this Procedure.
"NorthCloud" means NTP's cloud-based unified communications platform, sold on a business-to-business basis to enterprise clients across 14 EU/EEA member states.
"PECR" means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), as amended.
"DPA 2018" means the Data Protection Act 2018.
"Sundial Solutions" means the Sundial Solutions privacy management platform, as deployed by NTP for the purposes of maintaining the Company's data breach register, records of processing activities, and other data protection compliance documentation.
3. BREACH IDENTIFICATION AND CLASSIFICATION
3.1 Sources of Breach Detection
Personal data breaches may be detected through range internal and external channels. It is essential that all potential sources of breach intelligence are monitored and that mechanisms exist for the rapid escalation of suspected incidents.
Internal Detection. The following internal channels may give rise to the detection of a personal data breach:
(a) Security monitoring systems: NTP's Security Operations Centre ("SOC"), operating under the direction of the CISO, Thomas Okoye, maintains continuous monitoring of NTP's network infrastructure, endpoints, and cloud environments. Security information and event management ("SIEM") tools, intrusion detection systems, data loss prevention systems, and anomaly detection algorithms may identify suspicious activity indicative of a breach.
(b) IT helpdesk reports: NTP's IT helpdesk may receive reports from employees or contractors concerning suspected system compromises, unusual account activity, lost or stolen devices containing personal data, or other incidents that may constitute or indicate a personal data breach.
(c) Employee reports: Any NTP employee or contractor who becomes aware of, or suspects, a personal data breach is required to report it immediately in accordance with Section 3.2 of this Procedure. This obligation is communicated through mandatory annual training and is reinforced through NTP's Group Data Protection Policy.
(d) Internal audit findings: NTP's internal audit function, and any external audit activity conducted by Whitmore Kendall LLP or other appointed auditors, may identify vulnerabilities, control failures, or incidents that constitute or may have resulted in personal data breaches.
(e) CISO team monitoring: The CISO's information security team conducts proactive threat hunting, vulnerability assessments, and penetration testing, which may uncover evidence of past or ongoing breaches.
External Detection. The following external channels may give rise to the detection of a personal data breach:
(a) Data subject complaints: Data subjects (including consumer subscribers, enterprise client contacts, employees, and other individuals) may contact NTP to report suspected unauthorised use of their data, receipt of suspicious communications, or other indications of a breach.
(b) Regulatory inquiries: The ICO, the DPC, or any other supervisory authority may contact NTP in connection with a complaint, an inquiry, or intelligence suggesting that a breach has occurred.
(c) Processor and sub-processor notifications: NTP's data processors and their sub-processors are contractually obligated to notify NTP of personal data breaches in accordance with the terms of their respective data processing agreements. The specific contractual notification obligations of NTP's key processors are summarised in Appendix C to this Procedure.
(d) Media reports: Public reporting or media coverage may bring to NTP's attention a breach affecting its systems, data, or processors.
(e) Threat intelligence feeds: NTP subscribes to and monitors commercial and governmental threat intelligence services, which may provide indicators of compromise or notifications of data exposure relevant to NTP's systems or data.
Processor Notifications. NTP's contractual arrangements with its key data processors include mandatory breach notification provisions. The following are of particular note:
(a) The amended Data Processing Agreement with Pinnacle Cloud Services Ltd (executed 28 June 2023) requires Pinnacle to notify NTP of any personal data breach without undue delay and in any event within 36 hours of becoming aware of the breach. The notification must include the information specified in Article 33(3) of the GDPR. This obligation extends to breaches occurring at Pinnacle's sub-processors, Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd, with breach notifications flowing from the sub-processor through Pinnacle to NTP.
(b) The EU Standard Contractual Clauses (Module 2: Controller to Processor) and the UK International Data Transfer Agreement executed with Caldwell Analytics Inc. (each dated 17 July 2023) contain equivalent breach notification obligations, requiring Caldwell to notify NTP without undue delay in accordance with SCC Clause 9.2.
(c) All current and future data processor contracts must include mandatory breach notification clauses, as specified in NTP's standard data processing agreement template. The DPO and General Counsel are responsible for ensuring that such clauses are included in all new and renewed processor agreements.
3.2 Initial Assessment
The following initial assessment process applies to all suspected or actual personal data breaches.
Immediate Reporting Obligation. Any NTP employee, contractor, or temporary worker who becomes aware of a suspected or actual personal data breach must report the incident immediately and without delay. The report must be made:
(a) to the individual's line manager; and
(b) to the Information Security team, under the direction of the CISO, Thomas Okoye, via the designated security incident reporting mailbox (security.incidents@northgatetelecom.co.uk) or by telephone to the SOC emergency line.
Where the suspected breach involves a processor or sub-processor, the relevant processor relationship manager within NTP must also be notified.
Initial Triage by Information Security. Upon receipt of a report of a suspected or actual personal data breach, the CISO's Information Security team shall conduct an initial triage assessment within two (2) hours of notification. The purpose of the initial triage is to establish, on a preliminary basis:
(a) the nature of the incident and whether it is confirmed, suspected, or unsubstantiated;
(b) the date and time of the incident's occurrence (if known) and the date and time of its discovery;
(c) the systems, networks, databases, applications, and physical locations affected;
(d) the categories and estimated volume of personal data affected;
(e) the estimated number of data subjects affected;
(f) whether special category data is involved, having regard to NTP's 14 identified processing activities involving special category data (including employee health data, trade union membership, and biometric access controls);
(g) whether the breach is ongoing or has been contained; and
(h) any immediate containment measures that have been implemented or that should be implemented without delay.
The initial triage assessment shall be documented in writing by the Information Security team and recorded in the security incident management system. Where the initial triage confirms or raises a reasonable suspicion that personal data has been compromised, the CISO shall immediately escalate the matter to the DPO, Sanjay Mehta, in accordance with the escalation timelines set out in Section 4.2.
3.3 Breach Classification Matrix
Upon confirmation or reasonable suspicion that a security incident constitutes a personal data breach, the Breach Response Team shall classify the breach using the following Severity Classification Matrix. The classification determines the escalation pathway, notification requirements, and resource allocation for the breach response.
Severity Level 1 — Critical
A Severity Level 1 breach is one that meets any of the following criteria:
(a) The breach affects, or is reasonably likely to affect, more than 10,000 data subjects.
(b) The breach involves special category data, as defined in Article 9 of the GDPR, including but not limited to employee health data, trade union membership, or biometric data.
(c) The breach involves financial data, including payment card data, bank account details, or billing information that could be used to facilitate financial fraud.
(d) The breach involves data used in automated decision-making processes, including profiling, where the breach could result in decisions having legal or similarly significant effects on data subjects.
(e) The breach gives rise to a significant potential for harm to data subjects, including identity fraud, financial loss, discrimination, reputational damage, or physical harm.
(f) The breach involves personal data that has been transferred internationally to NTP's processors or sub-processors, including Caldwell Analytics Inc. (USA), Pinnacle India Pvt Ltd (India), Pinnacle APAC Pte Ltd (Singapore), or Moritaka Systems K.K. (Japan), where the breach may engage transfer mechanism obligations or supplementary measure requirements.
Severity Level 1 breaches require immediate engagement of external counsel (Calderwood & Harkness LLP) and notification to the CEO and Audit & Risk Committee within the timelines specified in Section 4.
Severity Level 2 — High
A Severity Level 2 breach is one that meets any of the following criteria:
(a) The breach affects, or is reasonably likely to affect, between 1,000 and 10,000 data subjects.
(b) The breach involves sensitive personal data that does not constitute special category data but is nevertheless of a nature that increases the risk of harm to data subjects, such as detailed employment records, salary information, or performance review data.
(c) The breach gives rise to a potential for moderate harm to data subjects, including unwanted direct marketing, embarrassment, or inconvenience that is more than trivial.
Severity Level 2 breaches require engagement of external counsel (Calderwood & Harkness LLP) and notification to the CEO within the timelines specified in Section 4.
Severity Level 3 — Medium
A Severity Level 3 breach is one that meets all of the following criteria:
(a) The breach affects, or is reasonably likely to affect, between 100 and 1,000 data subjects.
(b) The breach involves limited categories of personal data, such as names and business email addresses, and does not involve special category data, financial data, or data that could facilitate identity fraud.
(c) The breach gives rise to a low risk of harm to data subjects.
Severity Level 3 breaches are managed internally by the BRT without the mandatory engagement of external counsel, unless the DPO or General Counsel considers it advisable. Severity Level 3 breaches are included in the DPO's quarterly breach report to the Audit & Risk Committee.
Severity Level 4 — Low
A Severity Level 4 breach is one that meets all of the following criteria:
(a) The breach affects, or is reasonably likely to affect, fewer than 100 data subjects.
(b) The breach involves non-sensitive personal data, such as names and business contact information.
(c) The breach gives rise to minimal or no risk of harm to data subjects.
(d) The breach was an accidental internal disclosure that was immediately identified and contained, with no evidence that the data was accessed, copied, or further disseminated by any unauthorised party.
Severity Level 4 breaches are recorded in the breach register and included in the DPO's quarterly report, but do not ordinarily require supervisory authority notification, data subject notification, or engagement of external counsel.
The classification of a breach may be revised as further information becomes available during the course of the investigation. Any reclassification must be documented in the breach register with the reasons for the change and must be communicated to all members of the BRT.
An expanded classification matrix with examples specific to NTP's operations is provided at Appendix D.
4. INTERNAL ESCALATION CHAIN
4.1 Breach Response Team (BRT) — Composition
NTP has established a standing Breach Response Team with designated members drawn from key functions across the organisation. The BRT is convened by the DPO upon confirmation or reasonable suspicion of a personal data breach. The composition of the BRT is as follows:
Chief Information Security Officer — Thomas Okoye (NTP PLC)
Thomas Okoye reports to the Chief Technology Officer and serves as the first point of escalation for all security incidents, including suspected personal data breaches. The CISO is responsible for the technical containment of breaches, the commissioning and oversight of forensic investigations, the coordination of the technical response with NTP's SOC and IT operations teams, and the preservation of forensic evidence. The CISO also oversees NTP's cybersecurity programme, information governance framework, and technical data protection controls.
Data Protection Officer — Sanjay Mehta (NTP PLC)
Sanjay Mehta was appointed as NTP's Data Protection Officer in March 2019 and holds the CIPP/E certification. The DPO reports to the General Counsel with a dotted-line reporting relationship to the Audit & Risk Committee, ensuring the independence required by Article 38 of the GDPR. The DPO is responsible for conducting the regulatory risk assessment of each breach, making the determination as to whether supervisory authority and/or data subject notification is required, preparing and submitting notifications to the ICO, DPC, and any other relevant supervisory authority, and maintaining the central breach register. The DPO also serves as NTP's primary point of contact for the ICO and the DPC in relation to breach matters.
General Counsel & Company Secretary — Fiona Gallagher (NTP PLC)
Fiona Gallagher reports to the CEO and is responsible for all legal matters within the NTP Group, including the management of legal professional privilege in the context of breach investigations, the assessment of litigation risk arising from breaches, the engagement of external counsel, and the preparation of Board briefing materials. Ms Gallagher was called to the Bar (Lincoln's Inn) in 2001 and served as a partner at Pemberton Hale LLP before joining NTP. As Company Secretary, she is responsible for ensuring that breach-related matters are properly escalated to the Board and Audit & Risk Committee in accordance with NTP's governance framework.
Head of People & HR — Philippa Crane (NTP PLC)
Philippa Crane is engaged as a member of the BRT in all cases where a breach involves the personal data of NTP employees, contractors, or temporary workers, including any special category data processed in the context of HR operations (e.g., health data, trade union membership, disciplinary records).
VP, Product & Engineering (NorthCloud) — Laura Dearden (NTP PLC)
Laura Dearden is engaged as a member of the BRT in all cases where a breach involves the NorthCloud cloud-based unified communications platform or the personal data of NorthCloud enterprise client users. Ms Dearden is responsible for coordinating the technical response within the NorthCloud engineering team and for conducting privacy-by-design reviews following any breach affecting the platform.
Head of EU Operations — Marcus Engström (Northgate Ireland Ltd)
Marcus Engström is based at the offices of Northgate Ireland Ltd in Dublin and is engaged as a member of the BRT in all cases where a breach affects the personal data processed by any NTP EU subsidiary or where the breach requires notification to the DPC as lead supervisory authority under the EU GDPR. Mr Engström is responsible for coordinating the breach response across NTP's EU subsidiary entities and for liaising with local data protection leads and legal counsel in Germany, the Netherlands, France, and Spain.
External Counsel — Calderwood & Harkness LLP
Calderwood & Harkness LLP (One Moorgate Square, London EC2R 6AN) is NTP's external legal adviser on privacy and data security matters. The following individuals are designated as NTP's external counsel contacts for breach response purposes:
• Kevin Ostrowski, Responsible Partner, Privacy & Data Security: Engaged for all Severity Level 1 and Severity Level 2 breaches, providing strategic legal advice on regulatory risk, notification obligations, and supervisory authority interface.
• Rachel Bernstein, Billing Partner, Privacy & Data Security: Engaged for breaches involving cross-border data transfers and for advice on telecommunications-specific regulatory obligations.
• Sara Hendricks, Lead Associate, Privacy & Data Security: Provides operational breach support, including the drafting of supervisory authority notifications and data subject communications.
External counsel is engaged for all Severity Level 1 and Severity Level 2 breaches, and for any breach requiring notification to a supervisory authority, regardless of severity classification. External counsel may also be engaged at the discretion of the DPO or General Counsel for breaches of any severity level where specialist legal advice is required.
4.2 Escalation Timelines
The following escalation timelines apply from the moment a suspected or actual personal data breach is first reported. All times are measured from T+0, being the point at which the suspected breach is first reported to the CISO or, if reported to a line manager, the point at which the line manager forwards the report to the CISO.
T+0 — Discovery and Initial Report
The incident is reported to the relevant line manager and to the CISO (Thomas Okoye) via the designated security incident reporting channels. The clock for all subsequent deadlines begins at this point.
T+2 hours — Initial Triage by CISO
The CISO completes the initial triage assessment described in Section 3.2. If the triage confirms or raises a reasonable suspicion that a personal data breach has occurred or is occurring, the CISO provides immediate notification to the DPO (Sanjay Mehta), including the preliminary triage assessment and all available information.
T+4 hours — BRT Convened by DPO
Upon receipt of notification from the CISO, the DPO convenes the Breach Response Team. The BRT may meet virtually (via secure video conferencing) or in person at Northgate Tower, London, or at the relevant subsidiary office (e.g., Northgate Ireland Ltd, Dublin, for EU-related breaches). The DPO determines the appropriate BRT composition based on the nature of the breach (e.g., whether employee data, NorthCloud data, or EU subsidiary data is involved) and issues invitations to the relevant BRT members.
T+6 hours — Initial Risk Assessment
The BRT conducts an initial risk assessment using the Breach Classification Matrix set out in Section 3.3. The BRT makes a preliminary determination as to the severity classification of the breach and whether notification to a supervisory authority is likely to be required. The preliminary risk assessment is documented in the breach register.
T+12 hours — Confirmed Classification and Senior Escalation
The BRT confirms the severity classification of the breach based on all available information. For breaches classified at Severity Level 1 or Severity Level 2:
(a) The General Counsel (Fiona Gallagher) is formally notified and engaged in the breach response, if not already involved.
(b) External counsel (Calderwood & Harkness LLP) is engaged by the General Counsel, and a preliminary briefing is provided to the responsible partner (Kevin Ostrowski).
(c) For Severity Level 1 breaches: the CEO (Damian Whitford) is notified by the General Counsel and/or the DPO.
T+24 hours — Draft Notification and Senior Briefing
Where supervisory authority notification is required or likely to be required:
(a) The DPO, with the support of external counsel, prepares a draft notification to the relevant supervisory authority (ICO and/or DPC).
(b) An internal briefing note is prepared by the DPO and/or General Counsel for the CEO (Damian Whitford) and the chair of the Audit & Risk Committee, summarising the nature and scope of the breach, the classification, the preliminary risk assessment, and the proposed notification strategy.
(c) For Severity Level 1 breaches: the Audit & Risk Committee is briefed within this timeframe, either by written report or by convening an extraordinary meeting.
T+48 hours — Final Notification Preparation and Approval
The DPO finalises the notification to the supervisory authority, incorporating any additional information obtained during the investigation and any comments from external counsel. The final notification is reviewed and approved by the DPO and the General Counsel. Where the breach affects both UK and EU personal data, separate notifications are prepared for the ICO and the DPC respectively.
T+72 hours — Notification Deadline
The notification is submitted to the relevant supervisory authority or authorities (ICO and/or DPC) in accordance with Articles 33(1) of the UK GDPR and EU GDPR. This represents the hard deadline imposed by the GDPR for notification without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. Where NTP is unable to provide all required information within the 72-hour window, the notification is submitted with all available information, and supplementary information is provided in phases without undue further delay, in accordance with Article 33(4).
Where the notification is not made within 72 hours, the notification must be accompanied by reasons for the delay. The DPO is responsible for documenting the reasons for any delay and for ensuring that the delay is justified and proportionate in the circumstances.
Compressed Timelines for Processor-Originated Breaches. Where a breach originates at a data processor (e.g., Pinnacle Cloud Services Ltd) or sub-processor (e.g., Pinnacle India Pvt Ltd), the processor's contractual notification window (e.g., 36 hours under the Pinnacle DPA) falls within NTP's 72-hour notification window. In such cases, NTP's internal escalation timelines may be compressed, and the BRT must account for the possibility that a significant portion of the 72-hour window may have elapsed before NTP receives notification from the processor. The DPO and CISO must ensure that contingency plans are in place to enable rapid internal escalation and notification preparation in compressed-timeline scenarios.
4.3 Escalation to Board
The following rules govern the escalation of breach information to NTP's senior leadership and Board:
Severity Level 1 (Critical) Breaches:
(a) The CEO (Damian Whitford) is notified within 12 hours of breach confirmation (T+12).
(b) The Audit & Risk Committee is briefed within 24 hours of breach confirmation (T+24), either by written report from the DPO and/or General Counsel, or by convening an extraordinary committee meeting at the request of the Committee chair.
(c) The General Counsel prepares a Board briefing if the breach is of a nature or scale that warrants full Board awareness, including where the breach may give rise to material litigation risk, regulatory enforcement action, or reputational harm to the Company.
Severity Level 2 (High) Breaches:
(a) The CEO (Damian Whitford) is notified within 24 hours of breach confirmation.
(b) The Audit & Risk Committee is briefed at its next scheduled meeting, or by written report within 5 business days of breach confirmation, whichever is sooner.
Severity Level 3 (Medium) and Severity Level 4 (Low) Breaches: