CONFIDENTIAL TREATMENT REQUESTED — INTERNAL USE ONLY
GROUP DATA PROTECTION POLICY
NORTHGATE TELECOMMUNICATIONS PLC
NTP-POL-DP-001
Document Control
Version History
Right-click to update Table of Contents
1. Introduction and Purpose
1.1 Purpose of this Policy
This Group Data Protection Policy (this "Policy") establishes the overarching framework for the protection of personal data processed by Northgate Telecommunications PLC ("NTP" or the "Company") and all of its subsidiaries and affiliates operating across the United Kingdom and the European Union (collectively, the "Group" or "NTP Group"). It sets out the principles, governance structures, roles, responsibilities, and operational requirements that all Group entities, their employees, officers, directors, contractors, temporary workers, consultants, and any third party with access to NTP personal data must observe in relation to the processing of personal data.
The purpose of this Policy is to ensure that the NTP Group processes personal data in a manner that is lawful, fair, transparent, and compliant with all applicable data protection legislation, including in particular:
(a) the UK General Data Protection Regulation ("UK GDPR"), as retained and incorporated into domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018, as supplemented and modified by the Data Protection Act 2018 ("DPA 2018");
(b) the General Data Protection Regulation of the European Union, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "EU GDPR"); and
(c) all applicable national implementing legislation in each jurisdiction in which the NTP Group operates, including without limitation the Bundesdatenschutzgesetz (BDSG) in Germany, the Uitvoeringswet Algemene Verordening Gegevensbescherming (UAVG) in the Netherlands, the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (Loi Informatique et Libertés) in France, and the Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) in Spain.
This Policy serves as the cornerstone document within the NTP Group's broader data protection compliance framework. It is intended to be read and applied in conjunction with the suite of supporting policies, procedures, and guidance documents identified in Appendix B to this Policy, each of which addresses specific aspects of data protection compliance in greater operational detail.
1.2 Background and Context
NTP is a United Kingdom-headquartered public limited company, incorporated and registered in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. The Group operates telecommunications infrastructure and enterprise Software-as-a-Service ("SaaS") solutions across the United Kingdom and the European Union. For the financial year ended 31 December 2022, NTP reported consolidated revenue of approximately £2.47 billion.
The NTP Group employs approximately 11,400 individuals globally, of whom approximately 8,200 are based in the United Kingdom and European Union member states. The Group processes personal data in respect of approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients, and its full workforce of approximately 11,400 employees. In addition, the Group processes personal data of contractors, temporary workers, job applicants, and website visitors, collectively comprising approximately 28,000 additional data subjects. The scale, nature, and complexity of these processing operations, spanning consumer telecommunications services, the NorthCloud unified communications SaaS platform, managed network services, Internet of Things ("IoT") connectivity platforms, data centre operations across four countries, and extensive human resources, finance, marketing, and corporate functions, demand a comprehensive and rigorously maintained data protection framework.
1.3 Board Mandate
The development and implementation of this Policy were mandated by a resolution of the Audit & Risk Committee of the Board of Directors of NTP, dated 8 December 2022. That resolution directed the Company's management to commission and complete a comprehensive GDPR compliance programme, encompassing a full audit of data processing activities, the creation and population of Records of Processing Activities, the completion of Data Protection Impact Assessments for all high-risk processing, the review and remediation of international data transfer mechanisms, the negotiation and execution of compliant Data Processing Agreements with all material processors, and the drafting and adoption of this Policy and all supporting procedures. Calderwood & Harkness LLP was engaged under engagement reference SC/NTP/2023-0213/PDS to provide external legal support for the design and delivery of this programme.
1.4 Regulatory Context
The adoption of this Policy takes place against the backdrop of NTP's prior and ongoing engagement with data protection supervisory authorities. In particular, the following regulatory matters are relevant:
(a) ICO Enforcement Notice ENF/2021/0934 — On 15 September 2021, the Information Commissioner's Office ("ICO") issued an enforcement notice to NTP following an investigation into the Company's consent mechanisms deployed on the NorthCloud customer portal. The ICO determined that the consent mechanisms in place at the relevant time failed to meet the standard required by Articles 4(11) and 7 of the UK GDPR, and imposed a monetary penalty of £320,000. NTP accepted the enforcement notice and completed all required remediation measures by March 2022, including the redesign of consent flows, the implementation of granular consent management functionality, and the deployment of the Bramwell Systems management platform.
(b) DPC Preliminary Inquiry IN-22-11-3 — In November 2022, the Data Protection Commission ("DPC") of Ireland, acting in its capacity as lead supervisory authority for NTP's EU establishments, opened a preliminary inquiry into cross-border data transfers made by Northgate Ireland Ltd and other EU subsidiaries. The inquiry relates to the adequacy of safeguards applied to certain transfers of personal data to the United States and other third countries. NTP, through the DPO and General Counsel, has cooperated fully with the DPC and submitted a comprehensive response to the inquiry on 4 September 2023. The inquiry remains open as at the date of this Policy.
This Policy is a direct and material element of NTP's response to these regulatory matters and its commitment to demonstrating sustained compliance with the UK GDPR, the EU GDPR, and all associated legislation.
1.5 Related Policies and Procedures
This Policy applies alongside, and must be read in conjunction with, the following NTP data protection policies and procedures, each of which is identified in greater detail in Appendix B:
• Data Subject Rights Procedure
• Data Breach Notification Procedure
• Data Retention Schedule
• International Transfers Policy & Mechanism Selection Guidance
• Individual Data Protection Impact Assessment reports (DPIA-001 through DPIA-011)
• ROPA Methodology & Guidance Note
• Legitimate Interest Assessment Template
• Privacy Notices (Consumer Subscribers, Employees, Enterprise Clients, Website)
• Information Security Policy
In the event of any inconsistency between this Policy and any related procedure or guidance document, the terms of this Policy shall prevail unless the related procedure or guidance document expressly states otherwise and such statement has been approved by the DPO and General Counsel.
2. Scope
2.1 Organisational Scope
This Policy applies to Northgate Telecommunications PLC and to each of its subsidiaries and affiliated entities within the NTP Group. As at the date of this Policy, the NTP Group comprises the following entities:
Northgate Telecommunications PLC (the parent company), incorporated and registered in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP employs approximately 10,590 staff across its United Kingdom operations (inclusive of employees allocated to UK-based functions who may support Group-wide activities).
The following wholly-owned subsidiaries are within scope:
(a) Northgate Ireland Ltd, a company incorporated and registered in Ireland under CRO Number 587214, with its registered office at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland. Northgate Ireland Ltd employs approximately 340 staff and serves as NTP's principal establishment within the European Union for the purposes of the EU GDPR.
(b) Northgate GmbH, a company incorporated and registered in Germany under HRB 214503 B at the Amtsgericht Charlottenburg, with its registered office at Friedrichstraße 91, 10117 Berlin, Germany. Northgate GmbH employs approximately 185 staff and conducts telecommunications infrastructure operations and NorthCloud SaaS sales activities in the German market.
(c) Northgate B.V., a company incorporated and registered in the Netherlands under KvK Number 72841936, with its registered office at Herikerbergweg 44, 1101 CM Amsterdam, Netherlands. Northgate B.V. employs approximately 120 staff and is responsible for NTP's operations in the Benelux region, including the operation of NTP's Amsterdam data centre.
(d) Northgate France SAS, a simplified joint stock company incorporated and registered in France under SIREN 891 247 503, with its registered office at 27 Rue de Berri, 75008 Paris, France. Northgate France SAS employs approximately 95 staff and conducts NorthCloud SaaS platform sales and enterprise managed network services in the French market.
(e) Northgate Iberia S.L., a limited company incorporated and registered in Spain under CIF B-91847263, with its registered office at Calle de Serrano 41, 28001 Madrid, Spain. Northgate Iberia S.L. employs approximately 70 staff and supports NTP's Iberian market operations, including consumer telecommunications services and IoT connectivity solutions.
This Policy extends to all business units, departments, and functions within the NTP Group, including without limitation: consumer telecommunications services, the NorthCloud SaaS platform (sold on a business-to-business basis across 14 EU/EEA member states), managed network services, the IoT connectivity platform, data centre operations (located in London, Frankfurt, Amsterdam, and Dublin), human resources, finance, marketing, corporate affairs, legal and compliance, information technology, and all other corporate functions.
Where the NTP Group acquires additional subsidiaries, affiliates, or business units following the date of this Policy, such entities shall be brought within the scope of this Policy as part of the post-acquisition integration process, and the DPO shall be consulted in advance of any acquisition or merger to assess data protection implications and ensure timely integration.
2.2 Data Processing Scope
This Policy covers all processing of personal data by any member of the NTP Group, whether such processing is carried out by automated means or by manual means, provided that the personal data forms part of, or is intended to form part of, a structured filing system. The term "processing" is to be interpreted broadly, in accordance with the definition set out in Article 4(2) of the UK GDPR and the EU GDPR, and encompasses any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, and destruction.
This Policy encompasses the personal data of all categories of data subjects whose data is processed by the NTP Group, including:
(a) Consumer subscribers — approximately 6.3 million individuals who subscribe to NTP's consumer telecommunications services, including mobile, fixed-line, and broadband services;
(b) Enterprise clients — approximately 42,000 business organisations and their individual representatives, contacts, and end users who utilise the NorthCloud SaaS platform, managed network services, or other NTP enterprise offerings;
(c) Employees — approximately 11,400 individuals employed by NTP Group entities across all jurisdictions;
(d) Contractors, temporary workers, and consultants — individuals engaged by the NTP Group on a non-employment basis to provide services;
(e) Job applicants — individuals who apply for employment or engagement with NTP Group entities;
(f) Website visitors — individuals who access NTP's corporate websites and online portals; and
(g) Other data subjects — including suppliers, business partners, and individuals whose data is incidentally processed in connection with NTP's operations.
Collectively, categories (d) through (g) above comprise approximately 28,000 additional data subjects beyond the primary categories identified in categories (a) through (c).
As at the date of this Policy, the NTP Group has catalogued a total of 147 processing activities within its Records of Processing Activities ("ROPA"). Of these, 89 processing activities relate to UK operations conducted by Northgate Telecommunications PLC, and 58 processing activities relate to EU operations conducted by the Group's five EU subsidiaries. Of the total 147 processing activities, 14 involve the processing of special category data within the meaning of Article 9 of the UK GDPR and the EU GDPR, primarily comprising employee health data, trade union membership data, and biometric data used for access control purposes at NTP data centres.
2.3 Territorial and Regulatory Scope
The NTP Group's data processing operations are subject to supervision by multiple data protection supervisory authorities, reflecting the Group's presence in the United Kingdom and across multiple EU member states.
(a) United Kingdom — NTP's UK operations are regulated by the Information Commissioner's Office ("ICO"). NTP is registered with the ICO under Registration Number ZA482917. The ICO is the competent supervisory authority for all processing of personal data governed by the UK GDPR and the DPA 2018.
(b) European Union — NTP's EU operations are subject to the supervisory jurisdiction of the Data Protection Commission ("DPC") of Ireland, which acts as the lead supervisory authority for the NTP Group's EU establishments pursuant to Article 56 of the EU GDPR. The designation of the DPC as lead supervisory authority reflects the establishment of Northgate Ireland Ltd in Dublin as NTP's principal EU establishment. Individual EU subsidiaries are additionally subject to the supervisory jurisdiction of their respective national data protection authorities, including the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the relevant state data protection authority (Landesdatenschutzbeauftragte) in Germany, the Autoriteit Persoonsgegevens (AP) in the Netherlands, the Commission nationale de l'informatique et des libertés (CNIL) in France, and the Agencia Española de Protección de Datos (AEPD) in Spain.
(c) National implementing legislation — In addition to the EU GDPR, each EU subsidiary must comply with national data protection legislation implementing or supplementing the EU GDPR in its jurisdiction of establishment, including the BDSG in Germany, the UAVG in the Netherlands, the Loi Informatique et Libertés in France, and the LOPDGDD in Spain. This Policy is designed to be compatible with each of these national frameworks; however, where national legislation imposes additional or more specific requirements, the relevant subsidiary must ensure compliance with those requirements in addition to the requirements of this Policy.
2.4 Personnel Scope
This Policy applies to all individuals who process personal data on behalf of, or in connection with the activities of, any NTP Group entity. This includes, without limitation:
(a) all directors and officers of NTP Group entities;
(b) all employees of NTP Group entities, whether full-time, part-time, or on fixed-term or permanent contracts;
(c) all contractors, temporary workers, agency staff, secondees, and consultants engaged by any NTP Group entity;
(d) all third parties who are granted access to NTP personal data, including processors, sub-processors, and their personnel, to the extent applicable.
All personnel within scope are required to acknowledge and comply with this Policy as a condition of their engagement with NTP. For employees, acknowledgement of this Policy forms part of the employment contract and onboarding process. For contractors, temporary workers, and consultants, compliance with this Policy is a contractual obligation incorporated into the terms of their engagement. Failure to comply with this Policy may result in disciplinary or contractual consequences as set out in Section 22 of this Policy.
3. Definitions and Interpretation
3.1 Key Defined Terms
Unless the context otherwise requires, the following terms shall have the meanings set out below when used in this Policy. Where a term is defined in Article 4 of the UK GDPR or Article 4 of the EU GDPR, the definition in this Policy is intended to be consistent with, and shall be interpreted in accordance with, the relevant statutory definition.
"Automated Decision-Making" means a decision made solely by automated means, without any human involvement, which produces legal effects concerning the data subject or similarly significantly affects the data subject, as described in Article 22 of the UK GDPR and the EU GDPR.
"Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her, as defined in Article 4(11) of the UK GDPR and the EU GDPR.
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, as defined in Article 4(7) of the UK GDPR and the EU GDPR.
"Data Protection Impact Assessment" or "DPIA" means an assessment of the impact of the envisaged processing operations on the protection of personal data, carried out in accordance with Article 35 of the UK GDPR and the EU GDPR.
"Data Subject" means an identified or identifiable natural person whose personal data is processed, as defined in Article 4(1) of the UK GDPR and the EU GDPR.
"International Transfer" means a transfer of personal data to a third country (i.e., a country outside the United Kingdom, in respect of the UK GDPR, or a country outside the European Economic Area, in respect of the EU GDPR) or to an international organisation.
"Personal Data" means any information relating to an identified or identifiable natural person (a "data subject"), as defined in Article 4(1) of the UK GDPR and the EU GDPR. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed, as defined in Article 4(12) of the UK GDPR and the EU GDPR.
"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, as defined in Article 4(2) of the UK GDPR and the EU GDPR.
"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller, as defined in Article 4(8) of the UK GDPR and the EU GDPR.
"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements, as defined in Article 4(4) of the UK GDPR and the EU GDPR.
"Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person, as defined in Article 4(5) of the UK GDPR and the EU GDPR.
"Records of Processing Activities" or "ROPA" means the records required to be maintained by controllers under Article 30(1) of the UK GDPR and the EU GDPR, documenting all processing activities carried out under the controller's responsibility.
"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, as described in Article 9(1) of the UK GDPR and the EU GDPR.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission pursuant to Article 46(2)(c) of the EU GDPR, including the clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Supervisory Authority" means an independent public authority which is established by a member state pursuant to Article 51 of the EU GDPR, or the Information Commissioner in respect of the UK GDPR.
"UK International Data Transfer Agreement" or "UK IDTA" means the International Data Transfer Agreement issued by the ICO under Section 119A of the DPA 2018 for the purposes of providing appropriate safeguards for international transfers of personal data from the United Kingdom.
3.2 NTP-Specific Defined Terms
In addition to the statutory terms defined above, the following terms specific to the NTP Group are used throughout this Policy:
"CISO" means the Chief Information Security Officer of Northgate Telecommunications PLC, currently Thomas Okoye, or such other individual as may be appointed to that role from time to time.
"Data Steward" means the designated individual within each business unit or subsidiary of the NTP Group who is responsible for day-to-day data protection compliance within that business unit or subsidiary, as further described in Section 6.9 of this Policy.
"DPO" means the Data Protection Officer of Northgate Telecommunications PLC, currently Sanjay Mehta, appointed in accordance with Articles 37–39 of the UK GDPR and the EU GDPR, or such other individual as may be appointed to that role from time to time.
"Group" means Northgate Telecommunications PLC and all of its subsidiaries listed in Section 2.1 of this Policy, and any additional subsidiaries that may be established or acquired following the date of this Policy.
"NorthCloud" means NTP's cloud-based unified communications SaaS platform, offered on a business-to-business basis to enterprise clients across the United Kingdom and 14 EU/EEA member states.
"NorthPulse" means NTP's employee wellbeing monitoring platform, used internally within the NTP Group for the purposes of monitoring and supporting employee health and wellbeing.
3.3 Rules of Interpretation
In this Policy, unless the context otherwise requires:
(a) references to legislation or statutory provisions are references to those provisions as amended, re-enacted, or replaced from time to time;
(b) references to "Articles" are references to the relevant articles of the UK GDPR or the EU GDPR, as the context requires;
(c) headings are for convenience only and shall not affect the interpretation of this Policy;
(d) words importing the singular include the plural and vice versa;
(e) references to sections, appendices, and schedules are references to sections of, and appendices and schedules to, this Policy; and
(f) where this Policy cross-references another NTP policy, procedure, or document, that reference shall be deemed to include any successor or replacement document.
4. Data Protection Principles
4.1 Overview of Principles
The UK GDPR and the EU GDPR each establish a set of fundamental principles that govern the processing of personal data. These principles, set out in Article 5 of each regulation, are the foundation upon which all of NTP's data protection obligations are built. The NTP Group is committed to ensuring that all processing of personal data complies with each of these principles at all times.
The data protection principles are as follows:
(a) Lawfulness, Fairness, and Transparency (Article 5(1)(a)) — Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject. This requires that all processing is based on a valid lawful basis (as set out in Section 5 of this Policy), that processing does not unduly or unjustifiably prejudice the interests of the data subject, and that data subjects are provided with clear, accessible, and comprehensive information about how their personal data is processed.
(b) Purpose Limitation (Article 5(1)(b)) — Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered to be incompatible with the initial purposes, subject to appropriate safeguards. NTP must ensure that the purposes for which personal data is collected are clearly defined and documented in the ROPA and in relevant privacy notices, and that data is not subsequently used for purposes that are incompatible with the original purposes of collection.
(c) Data Minimisation (Article 5(1)(c)) — Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. NTP must ensure that it does not collect or retain personal data beyond what is strictly required for the specified purpose, and that systems and processes are designed to collect and process only the minimum amount of personal data necessary.
(d) Accuracy (Article 5(1)(d)) — Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. NTP must implement processes for verifying and updating personal data on a regular basis, and must respond promptly to requests from data subjects for rectification of inaccurate data.
(e) Storage Limitation (Article 5(1)(e)) — Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as the data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards. The application of this principle to NTP's operations is governed by the NTP Data Retention Schedule, which specifies retention periods for each category of personal data by reference to purpose, lawful basis, and regulatory requirements.
(f) Integrity and Confidentiality (Article 5(1)(f)) — Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures. The CISO (Thomas Okoye) is responsible for implementing and maintaining the technical and organisational measures required to ensure the security of personal data processed by the NTP Group. Detailed security requirements are set out in Section 16 of this Policy and in NTP's Information Security Policy.
(g) Accountability (Article 5(2)) — The controller shall be responsible for, and be able to demonstrate compliance with, each of the principles set out above. Accountability is not merely a passive obligation; it requires NTP to proactively implement and maintain a comprehensive framework of policies, procedures, records, assessments, and governance structures that evidence compliance. This Policy, together with the ROPA, DPIAs, Legitimate Interest Assessments, Data Processing Agreements, training records, and other accountability measures described in Section 17, constitutes the core of NTP's accountability framework.
4.2 Application of Principles to NTP Operations
The data protection principles described above have practical implications for every aspect of the NTP Group's operations. The following guidance sets out how each principle applies in the specific context of NTP's telecommunications and SaaS business operations.
Lawfulness, fairness, and transparency are ensured through the identification and documentation of a lawful basis for each of the 147 catalogued processing activities (see Section 5), the provision of comprehensive privacy notices to all categories of data subjects (see Section 13), and the implementation of fair processing practices that do not exploit or mislead data subjects.
Purpose limitation is of particular importance in the context of NTP's data analytics and profiling activities. Consumer subscriber data, network performance data, and IoT telemetry data are collected for specified operational, commercial, and regulatory purposes. Any proposal to use such data for a new or different purpose, including for internal research, product development, or commercial analytics, must be assessed against the purpose limitation principle and, where necessary, additional lawful basis and transparency requirements must be satisfied before the new processing commences. The NorthCloud customer churn prediction model (DPIA-001) and marketing profiling activities (DPIA-007) are examples of processing activities where careful attention to purpose limitation has been required.
Data minimisation is critical in the context of NorthCloud platform engineering and product development. The VP, Product & Engineering (NorthCloud), Laura Dearden, is responsible for ensuring that the NorthCloud platform is designed and configured to collect and process only the minimum personal data necessary for each feature and function. Product teams must apply data minimisation principles at every stage of the software development lifecycle, including the design of APIs, data schemas, logging configurations, and analytics pipelines. Similar data minimisation requirements apply to the IoT connectivity platform, where device telemetry data should be aggregated or anonymised at the earliest possible stage to minimise the volume of personal data retained.
Accuracy requirements necessitate that consumer subscriber records, employee records, and enterprise client records are maintained in an accurate and up-to-date state. NTP must provide accessible mechanisms for data subjects to request the rectification of inaccurate data and must implement proactive data quality processes, including periodic data verification exercises and automated data quality checks within key systems.
Storage limitation requires adherence to the NTP Data Retention Schedule. All business units and subsidiaries must ensure that personal data is not retained beyond the applicable retention period and that appropriate deletion or anonymisation processes are in place. The DPO and Data Stewards share responsibility for monitoring compliance with retention periods.
Integrity and confidentiality requirements are addressed through the technical and organisational security measures described in Section 16 of this Policy, under the overall responsibility of the CISO.
Accountability is delivered through the comprehensive framework of governance structures, policies, procedures, records, and reporting mechanisms described throughout this Policy, and in particular in Section 17.
5. Lawful Basis for Processing
5.1 Overview of Lawful Bases
Article 6(1) of the UK GDPR and the EU GDPR provides that the processing of personal data is lawful only if, and to the extent that, at least one of the following conditions applies:
(a) Consent — the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) Contract Performance — processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
(c) Legal Obligation — processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) Vital Interests — processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) Public Interest — processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and
(f) Legitimate Interests — processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
The NTP Group must identify, document, and record the specific lawful basis relied upon for each processing activity before the processing commences. The lawful basis for each processing activity is recorded in the ROPA. Once a lawful basis has been identified and documented, it should not be changed without careful consideration and, where appropriate, consultation with the DPO. If a proposed change to the lawful basis is necessitated by a change in circumstances, the DPO must be consulted and the ROPA must be updated accordingly.
5.2 NTP Lawful Basis Profile
Across the 147 processing activities catalogued in the NTP Group's ROPA as at the date of this Policy, the lawful bases relied upon are distributed as follows:
The predominance of legitimate interests as a lawful basis reflects the nature of NTP's operations, in which a significant proportion of processing activities support the Group's commercial and operational objectives in circumstances where consent, contract performance, or legal obligation are not the most appropriate basis. All lawful bases have been documented in the ROPA, maintained on the Sundial Solutions platform, and are available for review by the DPO, the Audit & Risk Committee, and supervisory authorities upon request.
5.3 Legitimate Interest Assessments
Where legitimate interest is relied upon as the lawful basis for processing, the NTP Group must complete a Legitimate Interest Assessment ("LIA") using the approved NTP LIA template. The LIA template has been developed by Calderwood & Harkness LLP in conjunction with the DPO, and is designed to ensure a rigorous and structured assessment of the legitimate interest relied upon.
Each LIA is structured as a three-part test:
(1) Purpose and Legitimate Interest Identification — The LIA must clearly identify the specific legitimate interest being pursued by NTP or, where applicable, by a third party. The interest must be lawful, clearly articulated, and real rather than speculative. The LIA must explain why the processing is being carried out and what benefit is expected to be achieved.
(2) Necessity Assessment — The LIA must assess whether the processing is necessary for the pursuit of the identified legitimate interest. The processing must be reasonably necessary and not merely convenient or desirable. If the same purpose can be achieved by less intrusive means that do not involve the processing of personal data, or that involve the processing of less personal data, those alternative means should be adopted.
(3) Balancing Test — The LIA must weigh the legitimate interest of the controller or third party against the interests, fundamental rights, and freedoms of the data subjects. The assessment must consider the nature of the personal data, the reasonable expectations of the data subjects, the potential impact on data subjects, the existence of any safeguards that mitigate the impact, and the relationship between the controller and the data subjects.
As at the date of this Policy, 64 LIAs have been completed corresponding to the 64 processing activities for which legitimate interest is relied upon as the lawful basis. All LIAs must be maintained and reviewed at least annually, or sooner upon any material change in the relevant processing activity or the circumstances upon which the LIA was based. LIA records are maintained by the DPO and shall be made available to supervisory authorities upon request.
5.4 Consent
Where consent is relied upon as the lawful basis for processing, the NTP Group must ensure that the consent meets all requirements of the UK GDPR and the EU GDPR. In particular:
(a) Consent must be freely given — the data subject must have a genuine and free choice to give or withhold consent, without detriment. Consent must not be made a precondition for the provision of a service where the processing for which consent is sought is not necessary for the performance of that service.
(b) Consent must be specific — consent must relate to particular processing operations and must not be bundled with other terms and conditions or consents for unrelated purposes.
(c) Consent must be informed — the data subject must be provided with clear and comprehensive information about the processing for which consent is sought, including the identity of the controller, the purposes of processing, the categories of data concerned, and any relevant recipients or international transfers.
(d) Consent must be unambiguous — consent must be given by a clear affirmative action, such as ticking a box or clicking a button. Silence, pre-ticked boxes, or inactivity do not constitute valid consent.
(e) Consent must be demonstrable — NTP must be able to demonstrate that consent was given. This requires the maintenance of consent records, including the identity of the data subject, the date and time consent was given, the specific processing activities consented to, and the information provided to the data subject at the time of consent.
(f) Consent must be easily withdrawable — data subjects must be able to withdraw their consent at any time, as easily as it was given. NTP must inform data subjects of their right to withdraw consent before consent is given.
The ICO Enforcement Notice ENF/2021/0934, issued on 15 September 2021, specifically addressed deficiencies in NTP's consent mechanisms on the NorthCloud customer portal, including the use of pre-ticked boxes and insufficiently granular consent options for direct marketing communications. Following remediation completed in March 2022, NTP's consent mechanisms have been redesigned to comply with the requirements set out above. Consent records for all processing activities relying on consent as the lawful basis are maintained in the Bramwell Systems management platform, as configured and maintained by Ashdown Consulting Group Ltd.
Particular attention must be paid to consent requirements in the context of:
• Direct marketing — Consent for direct marketing communications must be granular (by channel: email, SMS, telephone, post) and must not be bundled with consent for other purposes.
• Cookie consent — The placement of non-essential cookies and similar tracking technologies on NTP websites and online portals requires the prior consent of the user, in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) in the United Kingdom and the ePrivacy Directive (Directive 2002/58/EC) in the European Union. NTP's cookie consent mechanisms have been redesigned and are managed through the Bramwell Systemsokie consent banner.
5.5 Special Category Data
Article 9(1) of the UK GDPR and the EU GDPR prohibits the processing of special category data unless one of the conditions set out in Article 9(2) is met, in addition to the requirement for a lawful basis under Article 6(1).
As at the date of this Policy, the NTP Group has identified 14 processing activities involving the processing of special category data. The categories of special category data processed by the NTP Group are:
(a) Employee health data — including sickness absence records, occupational health reports, reasonable adjustment assessments, and data processed through the NorthPulse employee wellbeing monitoring platform (DPIA-003);
(b) Trade union membership data — processed in connection with trade union recognition arrangements, collective bargaining, and payroll deductions for union subscriptions; and
(c) Biometric data — fingerprint and, in limited cases, facial geometry data processed for the purpose of access control to NTP data centres in London, Frankfurt, Amsterdam, and Dublin (DPIA-005).
For each processing activity involving special category data, an additional condition under Article 9(2) must be identified and documented. The conditions most commonly relied upon by the NTP Group are:
• Explicit consent (Article 9(2)(a)) — used in limited circumstances where processing is not required for employment or other mandatory purposes;
• Employment, social security, and social protection obligations (Article 9(2)(b)) — used for processing of employee health and trade union data to the extent required by employment law;
• Substantial public interest (Article 9(2)(g)) — used in limited circumstances with reference to the specific conditions set out in Schedule 1, Part 2 of the DPA 2018.
In respect of UK processing of special category data, NTP is required to maintain an appropriate policy document as required under Schedule 1, Part 4 of the DPA 2018. This appropriate policy document sets out the procedures for ensuring compliance with the data protection principles in relation to the processing of special category data, the specific conditions under Article 9(2) relied upon for each category of processing, and the retention and deletion policies applicable to the data. The appropriate policy document is maintained by the DPO and is available for inspection by the ICO upon request.
5.6 Criminal Offence Data
Article 10 of the UK GDPR and the EU GDPR imposes additional restrictions on the processing of personal data relating to criminal convictions and offences, or related security measures. The NTP Group processes criminal offence data in limited circumstances, primarily in connection with pre-employment background checks and Disclosure and Barring Service ("DBS") checks conducted in respect of employees who will have access to sensitive systems, data centres, or customer data.
Processing of criminal offence data by the NTP Group is carried out only where a specific condition under the DPA 2018, Schedule 1 is met. In most cases, the relevant condition is that the processing is necessary for the purpose of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, and appropriate safeguards are in place to protect the rights and freedoms of data subjects.
The DPO must be consulted before any new processing of criminal offence data is initiated, and a ROPA entry must be created for each such processing activity.
6. Roles and Responsibilities
6.1 The Board of Directors
The Board of Directors of Northgate Telecommunications PLC bears ultimate accountability for data protection compliance within the NTP Group. The Board is responsible for setting the strategic direction and risk appetite for data protection, for ensuring that adequate resources are allocated to the data protection function, and for overseeing the effectiveness of the Group's data protection governance framework.
The Board exercises its data protection oversight primarily through the Audit & Risk Committee, which receives regular reports from the DPO on data protection compliance, risk, and regulatory matters (as described in Section 17.2). The Audit & Risk Committee is authorised to escalate significant data protection issues to the full Board as appropriate.
Board-level GDPR training was delivered on 22 August 2023 by Kevin Ostrowski (Responsible Partner) and Sara Hendricks (Lead Associate) of Calderwood & Harkness LLP. Refresher training is to be conducted on an annual basis. All Board members are expected to maintain an adequate level of awareness of data protection principles, risks, and regulatory requirements relevant to their oversight responsibilities.
The Board is specifically responsible for:
(a) approving this Policy and any material amendments thereto;
(b) approving the outcomes of DPIAs where significant residual risk has been identified and where strategic decisions are required, such as the Board's acceptance of the DPIA-008 recommendation to discontinue the facial recognition pilot at NTP's London headquarters, which was approved on 14 June 2023;
(c) making strategic data protection decisions, including decisions regarding the acceptance or transfer of significant data protection risks; and
(d) ensuring that the culture of compliance with data protection obligations is embedded throughout the NTP Group.
6.2 Chief Executive Officer — Damian Whitford
The Chief Executive Officer bears overall executive responsibility for NTP's operations and for fostering a culture of compliance across the NTP Group, including compliance with data protection legislation and this Policy. The CEO is responsible for ensuring that the data protection function is adequately resourced, that the DPO is supported in the independent exercise of his or her responsibilities, and that data protection considerations are integrated into NTP's strategic and operational decision-making.
6.3 General Counsel & Company Secretary — Fiona Gallagher
The General Counsel & Company Secretary reports to the CEO and oversees all legal, regulatory, and compliance functions within the NTP Group, including the data protection function. The General Counsel has line management responsibility for the DPO and is the primary interface between NTP and its external legal advisers on data protection matters, including Calderwood & Harkness LLP. The General Counsel also serves as the primary interface with supervisory authorities on significant regulatory matters, in coordination with the DPO.
The General Counsel is responsible for ensuring that legal and contractual arrangements throughout the NTP Group, including Data Processing Agreements, Standard Contractual Clauses, and other data protection-related contractual provisions, are legally robust and compliant with applicable data protection legislation.
6.4 Data Protection Officer — Sanjay Mehta
The DPO is appointed in accordance with Articles 37, 38, and 39 of the UK GDPR and the EU GDPR. The current DPO is Sanjay Mehta, who was appointed to the role in March 2019 and holds the Certified Information Privacy Professional/Europe (CIPP/E) certification from the International Association of Privacy Professionals (IAPP).
The DPO reports to the General Counsel on administrative matters and has a direct (dotted-line) reporting relationship to the Audit & Risk Committee of the Board, ensuring that the DPO has direct access to the highest management level of the organisation as required by Article 38(3) of the UK GDPR and the EU GDPR.
The DPO's responsibilities, as set out in Articles 37–39, include:
(a) informing and advising the controller and its employees who carry out processing of their obligations under the UK GDPR, the EU GDPR, and applicable national data protection legislation;
(b) monitoring compliance with the UK GDPR, the EU GDPR, applicable national data protection legislation, and this Policy, including the assignment of responsibilities, awareness-raising, training of staff involved in processing operations, and the related audits;
(c) providing advice where requested on Data Protection Impact Assessments and monitoring their performance in accordance with Article 35;
(d) cooperating with, and acting as the contact point for, supervisory authorities, including the ICO and the DPC;
(e) maintaining the Records of Processing Activities;