DATA SUBJECT RIGHTS PROCEDURE

DATA SUBJECT RIGHTS PROCEDURE
NORTHGATE TELECOMMUNICATIONS PLC
Document Reference: NTP-DPR-PROC-001
Version 1.0
Effective Date: 1 September 2023
INTERNAL — CONFIDENTIAL This document is the property of Northgate Telecommunications PLC and has been prepared by Calderwood & Harkness LLP for the sole benefit of Northgate Telecommunications PLC and its group entities. It contains confidential and proprietary information. Unauthorised reproduction, distribution, or disclosure of this document or any part thereof is strictly prohibited.
DOCUMENT CONTROL
DOCUMENT CONTROL AND VERSION HISTORY
Version History.  
Distribution List.  This procedure has been distributed to the following individuals and groups within the Northgate Telecommunications PLC group:
All recipients are responsible for ensuring that relevant members of their teams are made aware of the contents of this procedure and for implementing the requirements set out herein within their respective areas of responsibility.
Right-click to update Table of Contents
1. INTRODUCTION AND PURPOSE
1.1 Purpose
This Data Subject Rights Procedure (this "Procedure") establishes the comprehensive framework by which Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries (collectively, the "NTP Group") shall receive, assess, process, and respond to data subject rights requests made pursuant to the United Kingdom General Data Protection Regulation (the "UK GDPR"), as supplemented by the Data Protection Act 2018 (the "DPA 2018"), and the General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR") (together, the "GDPR").
The primary objectives of this Procedure are as follows:
1.  To ensure the consistent, timely, and lawful handling of all data subject rights requests across NTP's operations in the United Kingdom and the European Union/European Economic Area, regardless of the channel through which such requests are received or the NTP entity to which they are directed.
2.  To establish clear roles, responsibilities, escalation pathways, and internal service-level targets that enable NTP to comply with the statutory response deadlines prescribed by Article 12 of the UK GDPR and EU GDPR.
3.  To provide detailed, step-by-step procedural guidance for each category of data subject right recognised under Chapter III of the UK GDPR and EU GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, objection, and rights relating to automated decision-making and profiling.
4.  To support NTP's accountability obligations under Articles 5(2) and 24 of the UK GDPR and EU GDPR by demonstrating that the NTP Group has implemented appropriate technical and organisational measures to ensure and be able to demonstrate compliance with data protection legislation.
5.  To document the processes for the application of exemptions and restrictions, ensuring that any reliance on exemptions is assessed on a case-by-case basis, documented with full reasoning, and applied narrowly and proportionately.
This Procedure has been developed as part of the comprehensive GDPR compliance programme build undertaken by Calderwood & Harkness LLP for NTP under engagement reference SC/NTP/2023-0213/PDS. It forms part of a suite of compliance deliverables including, among others, the NTP Group Data Protection Policy (NTP-DP-POL-001), the Data Breach Notification Procedure, the International Transfers Policy, the Data Retention Schedule, and updated Records of Processing Activities.
1.2 Background and Regulatory Context
NTP is a United Kingdom-headquartered public limited company, incorporated in England and Wales under Company Number 04837291, with its registered office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP operates telecommunications infrastructure services, including fixed-line, mobile, and fibre broadband networks, as well as enterprise Software-as-a-Service ("SaaS") solutions through its NorthCloud platform. NTP's operations extend across the United Kingdom and fourteen EU/EEA member states.
The scale and nature of NTP's operations result in the processing of personal data relating to a substantial population of data subjects. As at the date of this Procedure, NTP processes personal data relating to approximately:
•  6.3 million consumer subscribers across its telecommunications and NorthCloud SaaS services;
•  42,000 enterprise clients and their respective authorised users and administrators;
•  11,400 employees across all NTP Group entities;
•  28,000 contractors, temporary workers, job applicants, and website visitors (approximate aggregate figure).
The total population of data subjects whose personal data is processed by NTP is therefore approximately 6.38 million individuals, spanning multiple jurisdictions and data subject categories.
United Kingdom Regulatory Position. NTP's lead supervisory authority for UK operations is the Information Commissioner's Office ("ICO"). NTP is registered with the ICO under Registration Number ZA482917. NTP received an ICO Enforcement Notice (reference ENF/2021/0934) dated 15 September 2021 in respect of deficiencies in NTP's consent mechanisms for marketing communications and the collection of cookie consent on the NorthCloud platform. NTP undertook a comprehensive remediation programme, which was completed in March 2022, and the ICO confirmed satisfactory compliance. This regulatory history underscores the critical importance of maintaining robust data subject rights processes and demonstrates the heightened scrutiny to which NTP's data protection practices may be subject.
European Union Regulatory Position. NTP's lead supervisory authority for EU operations is the Data Protection Commission ("DPC"), Ireland, by virtue of NTP's main establishment in the European Union being Northgate Ireland Ltd (Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland; Companies Registration Office Number 587214). The DPC opened a preliminary inquiry (reference IN-22-11-3) in November 2022 concerning cross-border data transfers from Northgate Ireland Ltd to processors and sub-processors located outside the European Economic Area. This inquiry remains active as at the date of this Procedure and further heightens the need for NTP to demonstrate rigorous compliance with all data subject rights provisions, including in respect of personal data that has been transferred internationally.
1.3 Scope
This Procedure applies to all entities within the Northgate Telecommunications PLC group, namely:
(a) Northgate Telecommunications PLC — incorporated in England and Wales; registered office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom;
(b) Northgate Ireland Ltd — incorporated in Ireland; registered office at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland; Companies Registration Office Number 587214;
(c) Northgate GmbH — incorporated in Germany; registered at Friedrichstraße 91, 10117 Berlin, Germany; registered with the Amtsgericht Charlottenburg under HRB 214503 B;
(d) Northgate B.V. — incorporated in the Netherlands; registered at Herikerbergweg 44, 1101 CM Amsterdam, the Netherlands; Kamer van Koophandel Number 72841936;
(e) Northgate France SAS — incorporated in France; registered at 27 Rue de Berri, 75008 Paris, France; SIREN Number 891 247 503; and
(f) Northgate Iberia S.L. — incorporated in Spain; registered at Calle de Serrano 41, 28001 Madrid, Spain; CIF B-91847263.
This Procedure covers all processing activities catalogued in NTP's Records of Processing Activities ("ROPA"), comprising 147 processing activities in total (89 processing activities within UK operations and 58 processing activities within EU operations).
This Procedure applies to all categories of data subjects whose personal data is processed by NTP, including but not limited to: consumer subscribers, enterprise clients and their authorised users, employees, contractors, temporary workers, job applicants, and website visitors.
This Procedure applies to rights requests received through all channels, including email, postal correspondence, telephone, in-person at NTP offices or data centres, the NorthCloud platform self-service privacy dashboard, and submissions made by third-party authorised agents or representatives.
1.4 Applicable Legislation
This Procedure has been developed to ensure compliance with the following legislation and regulatory instruments:
(a) The UK GDPR (as retained EU law under the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) and the Data Protection Act 2018;
(b) The EU GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016);
(c) Relevant national implementing legislation in each jurisdiction where NTP operates, including:
(i) Germany: Bundesdatenschutzgesetz ("BDSG");
(ii) Netherlands: Uitvoeringswet Algemene Verordening Gegevensbescherming ("UAVG");
(iii) France: Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés ("Loi Informatique et Libertés"), as amended;
(iv) Spain: Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD"); and
(v) Ireland: Data Protection Act 2018 (Ireland).
Where there is any conflict between this Procedure and applicable legislation, the legislation shall prevail.
2. DEFINITIONS
For the purposes of this Procedure, the following terms shall have the meanings set out below. Terms defined in the UK GDPR or EU GDPR and not otherwise defined in this Section shall have the meanings given to them in the UK GDPR or EU GDPR (as applicable).
"Controller" means Northgate Telecommunications PLC or the relevant NTP Group subsidiary acting as controller for the processing activity or activities to which a particular Rights Request relates. Where more than one NTP Group entity acts as controller in respect of the relevant processing, each such entity is a Controller for the purposes of this Procedure, and the obligations set out herein apply to each Controller in respect of its own processing activities, coordinated centrally by the DPO.
"Data Subject" means any identified or identifiable natural person whose personal data is processed by NTP, including (without limitation) consumer subscribers, enterprise clients and their authorised users, employees, contractors, temporary workers, job applicants, and website visitors.
"DPO" means Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC. The DPO holds CIPP/E (Certified Information Privacy Professional/Europe) certification issued by the International Association of Privacy Professionals. The DPO reports to the General Counsel (Fiona Gallagher) and maintains an independent dotted-line reporting relationship to the Audit & Risk Committee of the Board of Directors of Northgate Telecommunications PLC.
"DSAR" means a Data Subject Access Request made under Article 15 of the UK GDPR or EU GDPR, being a request by a Data Subject to obtain confirmation of whether personal data concerning them is being processed and, where that is the case, access to the personal data and specified supplementary information.
"Rights Request" means any request by a Data Subject to exercise any right under Chapter III of the UK GDPR or EU GDPR, including (without limitation) the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), and rights relating to automated decision-making and profiling (Article 22). A Rights Request also encompasses requests to withdraw consent pursuant to Article 7(3).
"Request Handler" means the designated individual within the relevant business unit or NTP entity who is responsible for the initial triage of a Rights Request. Request Handlers are typically business unit data stewards or members of the DPO office, assigned on the basis of the data subject category and the nature of the request.
"Response Deadline" means the period of one calendar month from the receipt of a valid Rights Request within which NTP must respond to the Data Subject, as prescribed by Article 12(3) of the UK GDPR and EU GDPR. The Response Deadline may be extended by a further two calendar months (to a maximum total of three calendar months) where the request is complex or where NTP has received a large number of requests from the same Data Subject, subject to the requirements of Article 12(3).
"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, as defined in Article 9(1) of the UK GDPR and EU GDPR. NTP has identified fourteen (14) processing activities involving Special Category Data (primarily employee health data, trade union membership records, and biometric access control data).
"Processor" means any third party that processes personal data on behalf of NTP as controller, pursuant to a written Data Processing Agreement. NTP's current Processors include (without limitation): Caldwell Analytics Inc., Pinnacle Cloud Services Ltd (including its sub-processors Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd), Sunderland-Hayes Payroll Services Inc., and Moritaka Systems K.K.
"Sundial Solutions" means the Sundial Solutions privacy management platform, as implemented by Ashdown Consulting Group Ltd (15 Bedford Row, London WC1R 4BU, United Kingdom; Company Number 11293847) and configured for NTP's DSAR workflow management, request logging, exemption documentation, and reporting. Sundial Solutions was configured under the supervision of Robert Fairclough (Managing Director, Ashdown Consulting Group Ltd) and Anita Chakravarti (Lead Privacy Engineer, Ashdown Consulting Group Ltd).
"ROPA" means NTP's Records of Processing Activities maintained pursuant to Article 30 of the UK GDPR and EU GDPR, cataloguing 147 processing activities (89 UK, 58 EU) as at the date of this Procedure.
"DPIA" means a Data Protection Impact Assessment conducted pursuant to Article 35 of the UK GDPR or EU GDPR.
"ICO" means the Information Commissioner's Office, being the supervisory authority for data protection in the United Kingdom.
"DPC" means the Data Protection Commission, being the supervisory authority for data protection in Ireland.
"IPA" means the Investigatory Powers Act 2016.
3. DATA SUBJECT RIGHTS — OVERVIEW
This Section provides an overview of each data subject right recognised under Chapter III of the UK GDPR and EU GDPR, together with NTP-specific considerations. Detailed procedural steps for the exercise of each right are set out in Section 10.
3.1 Right of Access (Article 15)
Data Subjects have the right to obtain from NTP confirmation as to whether or not personal data concerning them is being processed. Where such personal data is being processed, the Data Subject has the right to access the personal data and the following supplementary information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request rectification, erasure, restriction of processing, or to object to processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the Data Subject, any available information as to their source; and
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.
The right of access applies across all 147 catalogued processing activities in NTP's ROPA. NTP must provide a copy of the personal data undergoing processing in a commonly used electronic format (such as CSV or PDF), unless the Data Subject specifically requests an alternative format. Where the Data Subject makes the request by electronic means, and unless otherwise requested by the Data Subject, the information shall be provided in a commonly used electronic form.
3.2 Right to Rectification (Article 16)
Data Subjects have the right to obtain from NTP, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, Data Subjects also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Where NTP has disclosed the personal data in question to recipients, NTP is required to communicate any rectification to each recipient unless this proves impossible or involves disproportionate effort (Article 19).
3.3 Right to Erasure ("Right to be Forgotten") (Article 17)
Data Subjects have the right to obtain from NTP the erasure of personal data concerning them without undue delay, and NTP is obliged to erase personal data without undue delay, where one of the following grounds applies:
(a) the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
(b) the Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
(c) the Data Subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the Data Subject objects to the processing pursuant to Article 21(2);
(d) the personal data has been unlawfully processed;
(e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which NTP is subject; or
(f) the personal data has been collected in relation to the offer of information society services to a child as referred to in Article 8(1).
The right to erasure is subject to the exemptions set out in Article 17(3), which include: (i) the exercise of the right of freedom of expression and information; (ii) compliance with a legal obligation which requires processing by Union or Member State law to which NTP is subject; (iii) reasons of public interest in the area of public health; (iv) archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; and (v) the establishment, exercise, or defence of legal claims.
NTP-Specific Considerations: Particular care must be taken in respect of telecommunications data subject to mandatory retention obligations under the Investigatory Powers Act 2016 ("IPA"). Processing activity DPIA-010 (Lawful Intercept and Communications Data Retention) relates to the retention of communications data pursuant to a retention notice issued under Part 4 of the IPA. Personal data retained pursuant to such a notice may not be erased during the mandatory retention period, notwithstanding a Data Subject's erasure request. In such circumstances, the Data Subject must be informed of the legal basis for continued retention, to the extent that NTP is legally permitted to disclose the existence and basis of such retention.
3.4 Right to Restriction of Processing (Article 18)
Data Subjects have the right to obtain from NTP restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by the Data Subject, for a period enabling NTP to verify the accuracy of the personal data;
(b) the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of its use instead;
(c) NTP no longer needs the personal data for the purposes of the processing, but the personal data is required by the Data Subject for the establishment, exercise, or defence of legal claims; or
(d) the Data Subject has objected to processing pursuant to Article 21(1) pending the verification of whether the legitimate grounds of NTP override those of the Data Subject.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the Data Subject's consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. NTP must inform the Data Subject before any restriction of processing is lifted.
3.5 Right to Data Portability (Article 20)
Data Subjects have the right to receive the personal data concerning them, which they have provided to NTP, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance from NTP, where:
(a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b); and
(b) the processing is carried out by automated means.
In exercising the right to data portability, the Data Subject has the right to have the personal data transmitted directly from NTP to another controller, where technically feasible.
NTP-Specific Considerations: The right to data portability is particularly relevant to consumer subscriber data on the NorthCloud SaaS platform, where processing is based on contract performance (Article 6(1)(b)). The NorthCloud self-service privacy dashboard provides automated data export functionality in JSON and CSV formats, enabling Data Subjects to exercise this right directly. Laura Dearden's engineering team is responsible for maintaining and enhancing this functionality.
3.6 Right to Object (Article 21)
Data Subjects have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) (public interest) or Article 6(1)(f) (legitimate interest), including profiling based on those provisions. Upon receipt of such an objection, NTP shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject or for the establishment, exercise, or defence of legal claims.
Direct Marketing Objection: Where personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. This right is absolute and NTP must cease processing immediately upon receipt of such an objection, without any balancing test or assessment of overriding grounds.
NTP-Specific Considerations: As at the date of this Procedure, NTP relies on legitimate interest as the lawful basis for 64 of its 147 catalogued processing activities and on public interest for 2 processing activities. These 66 processing activities are potentially subject to objection under Article 21(1). Upon receipt of an objection, a documented balancing test is required, utilising NTP's Legitimate Interest Assessment template.
3.7 Rights Relating to Automated Decision-Making and Profiling (Article 22)
Data Subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right is of critical importance for NTP given the following processing activities:
(a) DPIA-001: NorthCloud AI-driven customer churn prediction model — this model uses automated processing to predict the likelihood of customer churn and may trigger automated actions including targeted retention offers, which may have similarly significant effects on Data Subjects;
(b) DPIA-006: Customer credit scoring and fraud detection — this activity involves automated decision-making that may affect a customer's access to NTP services or credit terms; and
(c) DPIA-007: Marketing profiling and targeted advertising on NorthCloud freemium tier — this activity involves profiling to deliver targeted advertising, which may produce similarly significant effects on certain Data Subjects.
Where a Data Subject exercises their rights under Article 22, NTP must provide human intervention (a human-in-the-loop review as specified in the mitigation measures identified in DPIA-001), allow the Data Subject to express their point of view, and enable the Data Subject to contest the decision.
Where automated decision-making is permitted under Article 22(2) — namely, where it is necessary for entry into or performance of a contract, authorised by Union or Member State law, or based on the Data Subject's explicit consent — NTP must implement suitable measures to safeguard the Data Subject's rights, freedoms, and legitimate interests, including at least the right to obtain human intervention, to express their point of view, and to contest the decision.
3.8 Right to Withdraw Consent (Article 7(3))
Where processing is based on consent, Data Subjects have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the Data Subject shall be informed thereof.
NTP has identified nine (9) of its 147 catalogued processing activities for which consent is relied upon as the lawful basis for processing. Where a Data Subject withdraws consent in respect of any such processing activity, NTP must immediately cease the relevant processing and assess whether an alternative lawful basis is available. If no alternative lawful basis applies, the personal data must be deleted or anonymised.
It shall be as easy to withdraw consent as to give it. NTP has implemented withdrawal mechanisms including one-click unsubscribe links in marketing communications and a consent management toggle within the NorthCloud privacy dashboard.
3.9 Right to Lodge a Complaint with a Supervisory Authority (Article 77)
Without prejudice to any other administrative or judicial remedy, every Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the Data Subject considers that the processing of personal data relating to them infringes the UK GDPR or EU GDPR.
NTP must inform Data Subjects of their right to lodge a complaint in all responses to Rights Requests and in its privacy notices. The relevant supervisory authorities are:
•  United Kingdom: Information Commissioner's Office (ICO);
•  Ireland: Data Protection Commission (DPC);
•  Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and/or the relevant State (Landes) Data Protection Authority;
•  Netherlands: Autoriteit Persoonsgegevens (AP);
•  France: Commission Nationale de l'Informatique et des Libertés (CNIL); and
•  Spain: Agencia Española de Protección de Datos (AEPD).
Full contact details for each supervisory authority are set out in Annex H.
4. ROLES AND RESPONSIBILITIES
4.1 Data Protection Officer — Sanjay Mehta
The DPO has overall accountability for the oversight of the data subject rights process across the NTP Group. The DPO's specific responsibilities under this Procedure include:
(a) acting as the final decision-maker on complex requests, the application of exemptions, and the refusal of Rights Requests (in whole or in part);
(b) serving as the escalation point for Rights Requests involving Special Category Data, requests requiring cross-entity coordination, and requests with potential regulatory implications (including any request that may be relevant to the DPC inquiry IN-22-11-3);
(c) maintaining the central register of all Rights Requests and outcomes in Sundial Solutions;
(d) providing quarterly summary reports on Rights Request handling to the Audit & Risk Committee of the Board of Directors of NTP;
(e) reporting to Fiona Gallagher (General Counsel & Company Secretary) in a direct reporting line, and maintaining a dotted-line reporting relationship to the Audit & Risk Committee to ensure appropriate independence;
(f) liaising with supervisory authorities in respect of data subject rights matters; and
(g) overseeing the training programme for staff involved in Rights Request handling.
The DPO holds CIPP/E certification and was appointed to the role in March 2019.
4.2 General Counsel — Fiona Gallagher
The General Counsel is consulted on Rights Requests involving the following:
(a) matters of legal professional privilege, including where the disclosure of personal data in response to a DSAR may reveal legally privileged communications;
(b) litigation holds, where NTP has imposed or may need to impose a litigation hold on data that is the subject of a Rights Request;
(c) potential regulatory impact, including where a Rights Request may give rise to enforcement risk or may relate to or have implications for the DPC inquiry (IN-22-11-3) or any other pending or anticipated regulatory proceedings; and
(d) the engagement of external counsel, whether Calderwood & Harkness LLP or another firm, for complex, novel, or high-risk Rights Requests.
4.3 Chief Information Security Officer — Thomas Okoye
The CISO is responsible for the following aspects of the data subject rights process:
(a) the design, implementation, and ongoing adequacy of identity verification procedures to prevent the unauthorised disclosure of personal data in response to Rights Requests;
(b) coordinating the technical extraction of personal data from NTP's information systems in response to DSARs, including queries across NTP's CRM, network management systems, CCTV records, marketing databases, IoT platforms, and other data repositories;
(c) ensuring that data retrieval processes maintain appropriate security controls, including access logging, encryption in transit and at rest, and the principle of least privilege; and
(d) overseeing the secure transmission of personal data to Data Subjects, including the provision of secure download links and encrypted email where appropriate.
4.4 Head of People & HR — Philippa Crane
The Head of People & HR is the primary handler for all Rights Requests received from or relating to employees, contractors, temporary workers, and job applicants. Specific responsibilities include:
(a) acting as the designated Request Handler for employment-related Rights Requests;
(b) coordinating with HR systems teams for the extraction of personal data from employee records, performance management systems, and workforce analytics platforms (including the NorthPulse platform);
(c) coordinating with Sunderland-Hayes Payroll Services Inc. for the retrieval of payroll data relating to approximately 45 expatriate employees whose payroll is processed by that entity; and
(d) ensuring that employment-related Rights Requests involving Special Category Data (such as health data, trade union membership, and diversity monitoring data) are escalated to the DPO.
4.5 VP, Product & Engineering (NorthCloud) — Laura Dearden
The VP, Product & Engineering is the primary handler for Rights Requests received from or relating to consumer subscribers and enterprise client administrators in respect of data processed through the NorthCloud SaaS platform. Specific responsibilities include:
(a) ensuring that the NorthCloud platform includes and maintains a self-service privacy dashboard enabling Data Subjects to exercise certain rights directly, including rights of access, data portability, and deletion;
(b) coordinating with engineering teams for the development and maintenance of automated data export and deletion functionality;
(c) acting as the designated Request Handler for NorthCloud-related Rights Requests that cannot be fulfilled through the self-service dashboard; and
(d) ensuring that the NorthCloud platform's data architecture supports efficient and complete data retrieval in response to DSARs.
4.6 Head of EU Operations — Marcus Engström
The Head of EU Operations coordinates Rights Requests received by, or relating to the processing activities of, NTP's EU subsidiary operations, including Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L. Specific responsibilities include:
(a) acting as the central coordinator for Rights Requests involving EU subsidiary data, ensuring consistent handling across jurisdictions;
(b) ensuring that local-language response capabilities are available for Data Subjects in each EU jurisdiction in which NTP operates;
(c) advising the DPO on the application of national implementing legislation and member state derogations relevant to specific Rights Requests;
(d) serving as the liaison with local supervisory authorities where direct engagement is required; and
(e) coordinating with local legal counsel and data stewards in each EU jurisdiction.
4.7 Business Unit Data Stewards
Each business unit within the NTP Group has designated one or more business unit data stewards who are responsible for:
(a) the initial receipt and logging of Rights Requests received within their business unit;
(b) first-level triage and routing of Rights Requests to the DPO office or the appropriate Request Handler;
(c) assisting Request Handlers with the identification and retrieval of personal data from business unit systems; and
(d) ensuring that business unit staff are trained on the identification and categorisation of Rights Requests, in accordance with the training programme described in Section 14.
Business unit data stewards are designated through the business unit data steward appointment process and receive role-specific training. A current list of all appointed data stewards is maintained by the DPO office.
4.8 Processors and Third-Party Coordination
NTP's Processors are contractually required, under their respective Data Processing Agreements ("DPAs"), to assist NTP in fulfilling its obligations in respect of data subject rights. The principal Processors and their contractual obligations are as follows:
(a) Caldwell Analytics Inc. — Data analytics services; located at 2700 Technology Drive, Suite 400, San Jose, CA 95134, United States of America. Processor assistance obligations are set out in the EU Standard Contractual Clauses executed with Caldwell Analytics Inc. on 17 July 2023. NTP's designated contact at Caldwell is Jennifer Huang, VP, Legal & Privacy.
(b) Pinnacle Cloud Services Ltd — Cloud infrastructure and managed services; located at Apex House, 24 Victoria Embankment, London EC4Y 0DZ. Processor assistance obligations are set out in the amended DPA executed with Pinnacle Cloud Services Ltd on 28 June 2023. NTP's designated contact at Pinnacle is Graham Alderton, Head of Legal, Cloud Services Division. Pinnacle's sub-processors, Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd, are also subject to these obligations through the sub-processing arrangements approved by NTP.
(c) Sunderland-Hayes Payroll Services Inc. — Payroll processing for expatriate employees; located at 1400 Broadway, Suite 2200, New York, NY 10018, United States of America. Processor assistance obligations are set out in the relevant DPA and EU Standard Contractual Clauses.
(d) Moritaka Systems K.K. — IoT platform analytics services; located at Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan. Processor assistance obligations are set out in the relevant DPA.
All Processors are required to respond to NTP's requests for assistance in fulfilling data subject rights obligations within the timeframes specified in their respective DPAs and as set out in the internal processing milestones in Section 8.3 of this Procedure.
5. REQUEST RECEIPT AND LOGGING
5.1 Channels for Receiving Requests
NTP accepts Rights Requests through the following channels:
Email. Data Subjects may submit Rights Requests by email to the DPO office at dpo@northgate-telecom.co.uk. This email address is monitored continuously by the DPO office during business hours and is checked at least twice daily outside of business hours, including weekends and public holidays.
Post. Data Subjects may submit Rights Requests by post to:
Data Protection Officer Northgate Telecommunications PLC Northgate Tower 88 Canary Wharf Boulevard London E14 5HN United Kingdom
Postal requests received at any NTP office are forwarded to the DPO office by the receiving location within one business day of receipt. The date of receipt for postal requests is the date the request is received at the NTP office, not the date it is forwarded to the DPO office.
NorthCloud Platform Portal. Consumer subscribers and enterprise client administrators may submit certain Rights Requests through the self-service privacy dashboard within the NorthCloud platform. The dashboard enables Data Subjects to exercise rights of access, data portability, and account deletion directly. Requests submitted through the portal are automatically logged in Sundial Solutions.
Telephone. Data Subjects may submit Rights Requests via NTP's dedicated privacy helpline. Calls to the privacy helpline are routed to the DPO office. The receiving staff member shall create a written record of the verbal request immediately, capturing the essential details of the request, and log the request in Sundial Solutions.
In-Person. Rights Requests may be made in person at any NTP office or data centre reception. All reception staff are trained to recognise Rights Requests and to direct the Data Subject's request to the DPO office. A written record of any in-person request must be created immediately by the receiving staff member.
Third-Party Agents. Rights Requests may be submitted by authorised representatives acting on behalf of Data Subjects, including solicitors, parents or legal guardians, or holders of a power of attorney. Such requests are subject to additional identity and authority verification requirements as set out in Section 6.2.
EU Subsidiary Channels. Each EU subsidiary maintains local-language contact details for data subject rights on its website and in its privacy notices. All Rights Requests received by EU subsidiaries are routed to the central DPO office, with local coordination managed by Marcus Engström (Head of EU Operations).
5.2 Recognition of Requests
Rights Requests need not use specific or formal terminology to be valid. Any communication from a Data Subject (or their authorised representative) that expresses a desire to exercise any data subject right must be treated as a valid Rights Request and processed in accordance with this Procedure. For example, a Data Subject need not use the phrase "data subject access request" or cite specific GDPR articles for their communication to be treated as a DSAR.
NTP has implemented a staff training programme to ensure that all customer-facing, HR, and IT staff can recognise and promptly escalate potential Rights Requests. This training covers common forms that Rights Requests may take, including informal or colloquial language, requests made as part of broader complaints or enquiries, and requests made verbally.
Where a Rights Request is made verbally (whether in person or by telephone), the receiving staff member must immediately create a written record capturing: the date and time of the request, the identity of the Data Subject (or such identifying information as is provided), the nature of the right being exercised, and any other relevant details communicated by the Data Subject. This written record is then logged in Sundial Solutions in accordance with Section 5.3.
5.3 Logging in Sundial Solutions
All Rights Requests must be logged in the Sundial Solutions DSAR Management Module within one (1) business day of receipt, regardless of the channel through which the request was received. Sundial Solutions was implemented and configured for NTP's DSAR workflow management by Ashdown Consulting Group Ltd, under the supervision of Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer).
Each log entry in Sundial Solutions must include the following information:
(a) date and time of receipt of the Rights Request;
(b) the channel through which the request was received (email, post, telephone, in-person, NorthCloud portal, or third-party agent);
(c) the name of the Data Subject (or such identifying information as has been provided);
(d) the type of right being exercised (access, rectification, erasure, restriction, portability, objection, automated decision-making, consent withdrawal, or other);
(e) the NTP entity or entities to which the request is directed or which appears to hold the relevant data;
(f) the assigned Request Handler; and
(g) the current status of the request (e.g., received, identity verification pending, triage in progress, data retrieval in progress, response in draft, response issued, closed).
Upon logging, Sundial Solutions automatically generates a unique reference number in the format NTP-DSR-YYYY-NNNNN (where YYYY is the calendar year and NNNNN is a sequential five-digit number). This reference number is used in all subsequent correspondence with the Data Subject and in internal tracking.
5.4 Determination of Receipt Date
The "receipt date" for the purposes of calculating the Response Deadline is the date on which NTP has received sufficient information to:
(i) identify the Data Subject (or to initiate reasonable identity verification steps);
(ii) understand the nature of the right or rights being exercised; and
(iii) locate the personal data to which the request relates.
If a Rights Request is incomplete or ambiguous — for example, because the Data Subject has not provided sufficient information to enable NTP to identify them or to understand the scope of their request — the receipt date shall be the date on which NTP receives the additional information necessary to process the request. The Response Deadline clock starts on that later date.
Where additional information is required, NTP must request such information from the Data Subject without undue delay and in any event within five (5) business days of the initial receipt of the incomplete or ambiguous request. The request for additional information must be communicated clearly, specifying what information is needed and why, and informing the Data Subject that the Response Deadline will commence upon receipt of the requested information.
6. IDENTITY VERIFICATION
6.1 Purpose
Before acting on any Rights Request, NTP must take reasonable steps to verify the identity of the individual making the request, to ensure that personal data is not disclosed to, or actions are not taken at the instruction of, any individual who is not the Data Subject or their duly authorised representative. The purpose of identity verification is to prevent the unauthorised disclosure of personal data, which would itself constitute a personal data breach.
The level and rigour of verification applied must be proportionate to the sensitivity of the personal data involved and the risk of harm that could result from unauthorised disclosure or action. Where data of a particularly sensitive nature is involved (e.g., Special Category Data, financial data, or data relating to children), more robust verification measures may be appropriate.
6.2 Verification Methods
The following verification methods apply, differentiated by Data Subject category:
Consumer Subscribers (NorthCloud). Where a Rights Request is submitted through the NorthCloud self-service privacy dashboard, identity is verified through the Data Subject's NorthCloud account login credentials (username and password) plus one additional authentication factor, such as an email confirmation sent to the registered email address or an SMS verification code sent to the registered mobile telephone number. Where a consumer subscriber submits a Rights Request outside of the NorthCloud platform (e.g., by email or post), NTP may request a copy of government-issued photographic identification (such as a passport or driving licence), with all information other than the Data Subject's name, photograph, and date of birth redacted by the Data Subject.
Enterprise Clients. Enterprise client-level Rights Requests (e.g., requests from authorised administrators acting on behalf of the enterprise client) are verified through the authorised administrator contact details held on file by NTP. Where an individual Data Subject within an enterprise client organisation makes a Rights Request in respect of their own personal data, verification is conducted through employer confirmation and the provision of government-issued photographic identification.
Employees, Contractors, and Temporary Workers. Rights Requests from current employees, contractors, and temporary workers are verified through the individual's NTP employee or contractor identification number, combined with confirmation from their registered work email address. For former employees, contractors, or temporary workers who no longer have access to NTP email systems, government-issued photographic identification is required.
Job Applicants and Website Visitors. Rights Requests from job applicants are verified through government-issued photographic identification. For website visitors, verification may be conducted through the email address or other identifier (such as a cookie identifier or IP address) used during the relevant interaction, to the extent practicable.
Authorised Representatives and Agents. Where a Rights Request is submitted by a third party on behalf of a Data Subject (e.g., a solicitor, a parent or legal guardian, or a holder of a power of attorney), the following documentation is required:
(a) written authorisation from the Data Subject (original or certified copy), clearly identifying the Data Subject, the authorised representative, and the scope of the authority granted; and
(b) verification of the representative's identity, which may include the solicitor's firm credentials (e.g., SRA registration number), a certified copy of the power of attorney, or parental or guardian documentation (e.g., birth certificate or court order).
6.3 Proportionality
The verification measures described in Section 6.2 must be applied proportionately. In particular:
(a) Where NTP already holds identity verification on file (e.g., as part of the customer onboarding process or employment records) and the Rights Request is made through an authenticated channel (e.g., a logged-in NorthCloud account or a registered work email address), additional verification may not be required.
(b) Where NTP has reasonable doubts concerning the identity of the natural person making the request, NTP may request the provision of additional information necessary to confirm the identity of the Data Subject, pursuant to Article 12(6) of the UK GDPR and EU GDPR. The Response Deadline clock is paused from the date NTP requests additional verification information until the date such information is received.
(c) The CISO (Thomas Okoye) shall advise on the adequacy of verification measures for Rights Requests involving sensitive data or high-risk processing activities, including requests relating to Special Category Data, financial data, or data processed under DPIA-001, DPIA-006, or DPIA-007.
6.4 Refusal for Failure to Verify
If NTP is unable to identify or verify the identity of the Data Subject after taking reasonable steps to do so, and the Data Subject has been given a reasonable opportunity to provide the necessary verification, NTP may refuse to act on the Rights Request, in accordance with Article 12(6) of the UK GDPR and EU GDPR. In such cases:
(a) NTP must inform the Data Subject of the reasons for the refusal; and
(b) NTP must inform the Data Subject of their right to lodge a complaint with the relevant supervisory authority and to seek a judicial remedy.
The DPO must document the refusal and the reasoning in Sundial Solutions.
7. TRIAGE AND ASSESSMENT
7.1 Initial Triage
Within two (2) business days of logging a Rights Request in Sundial Solutions, the assigned Request Handler shall perform an initial triage of the request. The triage process involves the following assessments:
(a) Right identification: Confirm which specific right or rights under Chapter III of the UK GDPR / EU GDPR the Data Subject is seeking to exercise. Where the request is ambiguous, the Request Handler shall seek clarification from the Data Subject.
(b) Entity identification: Identify which NTP entity or entities hold the personal data to which the request relates. This assessment is informed by the ROPA and by the Data Subject's relationship with NTP (e.g., consumer subscriber, employee, enterprise client).
(c) Cross-border assessment: Determine whether the request relates to processing activities involving multiple NTP entities or cross-border processing (e.g., data processed in both the UK and the EU, or data transferred to processors outside the UK/EEA).
(d) Special Category Data assessment: Determine whether the request involves any of the 14 processing activities identified as involving Special Category Data. If so, the request is flagged for escalation to the DPO.
(e) Processor data assessment: Identify whether the personal data to which the request relates is held by, or has been transferred to, any of NTP's Processors (Caldwell Analytics Inc., Pinnacle Cloud Services Ltd, Sunderland-Hayes Payroll Services Inc., or Moritaka Systems K.K.).
(f) Automated decision-making assessment: Flag whether the request involves personal data subject to automated decision-making or profiling, in particular in respect of processing activities covered by DPIA-001 (NorthCloud AI-driven customer churn prediction model), DPIA-006 (customer credit scoring and fraud detection), or DPIA-007 (marketing profiling and targeted advertising on NorthCloud freemium tier).
The results of the initial triage are recorded in Sundial Solutions as part of the request record.
7.2 Multi-Entity Coordination
Where the initial triage identifies that a Data Subject's personal data is processed by more than one NTP entity (for example, where an employee of Northgate GmbH is also a consumer subscriber of NorthCloud services provided by Northgate Telecommunications PLC), the DPO shall coordinate the response across all relevant entities.
Marcus Engström (Head of EU Operations) acts as the designated coordinator for Rights Requests involving EU subsidiary data. In such cases, Marcus Engström works with the local data stewards in the relevant EU subsidiaries to identify and retrieve the personal data held by each entity.
A single consolidated response is provided to the Data Subject, unless regulatory requirements in a particular jurisdiction or the nature of the request necessitate separate responses from each Controller entity. Where separate responses are required, the DPO ensures consistency across the responses and coordinates the timing of issuance.
7.3 Processor Notification
Where the initial triage identifies that personal data relevant to the Rights Request is held by or has been transferred to a Processor, the Request Handler shall notify the relevant Processor contact within three (3) business days of completion of the triage, requesting the Processor's assistance in fulfilling the Rights Request.
Processors are contractually required under their respective DPAs to respond to NTP's requests for assistance within ten (10) business days of receipt of the notification.
The following Processor-specific considerations apply:
(a) Caldwell Analytics Inc. (US-based): Rights Request assistance requests are routed through Jennifer Huang (VP, Legal & Privacy). Data held by Caldwell may be pseudonymised; reversal of pseudonymisation shall only be undertaken where necessary to fulfil the specific Rights Request, and subject to appropriate technical and organisational safeguards. Given the sensitivity of cross-border transfers to the United States in the context of the DPC inquiry (IN-22-11-3), the DPO must be informed of all Processor notifications to Caldwell.
(b) Pinnacle Cloud Services Ltd: Rights Request assistance requests are routed through Graham Alderton (Head of Legal, Cloud Services Division). Data held by Pinnacle includes data stored on Pinnacle infrastructure across multiple data centre locations, including London, Frankfurt, Amsterdam, Dublin, and Stockholm, as well as data processed by Pinnacle's sub-processors, Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd. The Request Handler must specify to Pinnacle which data centre locations and sub-processors are likely to hold the relevant data.
(c) Sunderland-Hayes Payroll Services Inc. and Moritaka Systems K.K.: Assistance requests are routed through the designated contacts identified in the relevant DPAs and set out in Annex H.
7.4 Complexity Assessment
Following initial triage, the DPO shall assess whether the Rights Request is "complex" for the purposes of extending the Response Deadline by up to two additional calendar months, in accordance with Article 12(3) of the UK GDPR and EU GDPR.
The following factors are indicative of complexity:
(a) the request involves a large volume of personal data across multiple systems or databases;
(b) the request involves multiple NTP entities or cross-border processing;
(c) an exemption assessment is required (see Section 9);
(d) personal data of the requesting Data Subject is intermingled with personal data of third parties, requiring careful redaction;
(e) a legal privilege review is required, in coordination with the General Counsel;
(f) personal data is held by overseas Processors or sub-processors, and retrieval involves international data transfer considerations;
(g) the request involves data subject to automated decision-making or profiling, requiring assessment of the logic and significance of the processing;
(h) the request has been made by a third-party agent, and additional authority verification is required; or
(i) the request involves data subject to retention obligations under the IPA 2016 or equivalent EU member state communications data retention legislation.
If the DPO determines that an extension is required, the Data Subject must be informed within the initial one calendar month period of the reasons for the delay and the new response deadline. The extension notification is issued using Template Letter B (Annex B).
The DPO's complexity assessment and reasoning must be recorded in Sundial Solutions.
8. RESPONSE TIMELINES (SLAs)
8.1 Standard Response Deadline
NTP must respond to all Rights Requests within one calendar month from the receipt date (as defined in Section 5.4). The calendar month is calculated in accordance with Article 12(3) of the UK GDPR and EU GDPR — for example, a request received on 15 January requires a response by 15 February; a request received on 31 January requires a response by 28 February (or 29 February in a leap year).
8.2 Extended Response Deadline
Where a Rights Request is complex or where NTP has received a large number of requests from the same Data Subject, the Response Deadline may be extended by a further two calendar months, resulting in a maximum total response period of three calendar months from the receipt date.
The following conditions apply to any extension:
(a) The Data Subject must be notified of the extension within the initial one-month period, together with the reasons for the delay.
(b) The extension notification must be issued using Template Letter B (see Annex B) and must specify the new response deadline date.
(c) The DPO must approve any extension and record the justification in Sundial Solutions.
(d) An extension is not a routine measure; it is reserved for genuinely complex requests and must not be used as a default mechanism to manage workload.
8.3 Internal Processing Milestones
To ensure that NTP meets the statutory Response Deadline, the following internal processing milestones have been established:
These milestones are tracked in Sundial Solutions, and any slippage against these targets is flagged automatically to the DPO and the relevant Request Handler.
8.4 Manifestly Unfounded or Excessive Requests
Where a Rights Request is manifestly unfounded or excessive, in particular because of its repetitive character, NTP may, in accordance with Article 12(5) of the UK GDPR and EU GDPR:
(a) charge a reasonable fee based on the administrative costs of providing the information or communication or taking the action requested; or
(b) refuse to act on the request.
The DPO is the sole decision-maker within NTP on whether a Rights Request is manifestly unfounded or excessive. The burden of demonstrating the manifestly unfounded or excessive character of a request lies with NTP. The DPO must document the assessment and reasoning in Sundial Solutions.
Where NTP charges a fee or refuses to act on a manifestly unfounded or excessive request, the Data Subject must be informed without undue delay and at the latest within one month of receipt of the request:
(a) of the reasons for the fee or refusal;
(b) of the possibility of lodging a complaint with the relevant supervisory authority; and
(c) of the Data Subject's right to seek a judicial remedy.
8.5 No-Fee Principle
As a general principle, all DSARs and other Rights Requests are handled free of charge. A reasonable fee may only be charged in the following circumstances:
(a) where the request is manifestly unfounded or excessive (as described in Section 8.4); or
(b) where a Data Subject requests further copies of personal data under Article 15(3), in which case NTP may charge a reasonable fee based on administrative costs.
9. EXEMPTIONS AND RESTRICTIONS
9.1 General Approach
NTP recognises that the data subject rights set out in Chapter III of the UK GDPR and EU GDPR are not absolute and that certain exemptions and restrictions may apply. However, exemptions must be applied on a case-by-case basis and must be interpreted narrowly. The DPO is responsible for all exemption assessments, and the assessment and reasoning must be fully documented in Sundial Solutions in respect of each Rights Request where an exemption is considered or applied.
NTP shall not apply exemptions as a matter of routine or policy. Each exemption must be justified on its own merits, having regard to the specific circumstances of the Rights Request and the nature of the personal data involved.
9.2 UK GDPR Exemptions (Schedule 2, Data Protection Act 2018)
The following exemptions under Schedule 2 of the DPA 2018 are relevant to NTP's operations and may be considered in the context of Rights Requests:
Legal professional privilege (Schedule 2, Paragraph 19). This exemption applies where disclosure of personal data in response to a Rights Request would reveal legally privileged communications, whether subject to legal advice privilege or litigation privilege. Where this exemption is potentially applicable, the General Counsel (Fiona Gallagher) must be consulted before the exemption is applied. The exemption covers only the privileged material itself; non-privileged personal data must still be disclosed.
Crime and taxation (Schedule 2, Paragraph 2). This exemption applies where compliance with a data subject right