RECORDS OF PROCESSING ACTIVITIES (ROPA)
METHODOLOGY & GUIDANCE NOTE
Prepared for Northgate Telecommunications PLC — Internal Use Only
Right-click to update Table of Contents
1. Introduction and Purpose
1.1 Purpose of This Guidance Note
This guidance note sets out the methodology, roles, responsibilities, and procedures for maintaining and updating the Records of Processing Activities ("ROPA") of Northgate Telecommunications PLC ("NTP" or the "Company") and its EU subsidiaries on an ongoing basis. It is intended to serve as the authoritative procedural reference for all NTP personnel involved in the creation, maintenance, review, and governance of the ROPA, and to ensure that NTP's approach to ROPA management meets and exceeds the minimum standards prescribed by applicable data protection legislation.
The ROPA is a living compliance document required under Article 30 of the UK General Data Protection Regulation ("UK GDPR") and Article 30 of Regulation (EU) 2016/679 (the "EU GDPR"). As a core element of the accountability principle enshrined in Article 5(2) of both instruments, the ROPA must be kept accurate, complete, and up to date at all times. The ROPA is not merely a static record produced at a point in time; it is a dynamic reflection of NTP's processing landscape and must evolve as that landscape changes. Any failure to maintain the ROPA in an accurate and current state exposes NTP to regulatory risk, including the potential for administrative fines, enforcement notices, and reputational harm.
This guidance note complements the ROPA v1.0 deliverables produced by Calderwood & Harkness LLP under engagement SC/NTP/2023-0213/PDS, namely: (i) the Controller ROPA covering eighty-nine (89) processing activities for NTP PLC UK operations; and (ii) the Controller ROPA covering fifty-eight (58) processing activities across the five EU subsidiaries (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.). Together, these deliverables document one hundred and forty-seven (147) processing activities as at the date of this guidance note.
This guidance note is designed to be read alongside, and should be treated as complementary to, the following NTP governance documents:
• The NTP Group Data Protection Policy (version 3.2, effective 1 January 2023);
• The NTP International Transfers Policy & Mechanism Selection Guidance (produced under engagement SC/NTP/2023-0213/PDS); and
• The NTP Data Retention Schedule (version 2.1, effective 15 March 2023).
Where any conflict arises between this guidance note and applicable law or regulatory guidance, the requirements of applicable law and regulatory guidance shall prevail.
1.2 Regulatory Background
The obligation to maintain records of processing activities is a central pillar of the accountability framework established by the GDPR and the UK GDPR. The following provisions and guidance instruments are of particular relevance to NTP's ROPA obligations:
Article 30(1) GDPR / UK GDPR imposes an obligation on each controller to maintain a record of processing activities carried out under its responsibility. The record must contain the information specified in Article 30(1)(a) through (g), including the identity of the controller, the purposes of processing, the categories of data subjects and personal data, the categories of recipients, details of international transfers, retention periods, and a general description of technical and organisational security measures. This obligation applies to each NTP entity that acts as a controller in its own right.
Article 30(2) GDPR / UK GDPR imposes a corresponding obligation on each processor to maintain a record of all categories of processing activities carried out on behalf of a controller. While NTP primarily acts as a controller, certain NTP entities also act as processors in specific contexts (for example, where Northgate Ireland Ltd provides network management services to enterprise clients who retain controllership over certain categories of personal data). In such cases, NTP must maintain processor records in addition to controller records.
Article 30(5) GDPR / UK GDPR provides a limited exemption from the obligation to maintain records for organisations employing fewer than 250 persons. This exemption does not apply to NTP. With approximately 11,400 employees globally and approximately 8,200 employees in the United Kingdom and the European Union, NTP substantially exceeds the 250-employee threshold. Moreover, even if NTP were below that threshold, the exemption would not apply because NTP's processing is not occasional, includes special categories of data (fourteen (14) identified processing activities involve employee health data, trade union membership data, and biometric data used for access controls), and includes data relating to criminal convictions and offences (in the context of pre-employment screening and certain regulatory compliance activities).
Recital 82 of the GDPR clarifies the purpose of the record-keeping obligation, stating that records of processing activities should contribute to demonstrating compliance with the GDPR and that they should enable the supervisory authority to monitor processing operations. The ROPA is therefore not merely a bureaucratic exercise; it is a key tool for evidencing NTP's compliance posture.
In addition to the legislative provisions, NTP has regard to the guidance issued by the Information Commissioner's Office ("ICO") on documentation and accountability obligations, including the ICO's Guide to the UK GDPR and its specific guidance on records of processing and accountability. NTP's ICO Registration Number is ZA482917.
For its EU operations, NTP's lead supervisory authority is the Data Protection Commission ("DPC") of Ireland, by virtue of NTP's EU establishment through Northgate Ireland Ltd, which is incorporated in Dublin and serves as the principal EU establishment for the purposes of Article 56 of the EU GDPR. NTP also has regard to guidance issued by the European Data Protection Board ("EDPB") and the former Article 29 Working Party, to the extent such guidance remains relevant.
1.3 Scope. This guidance note applies to all processing activities carried out by NTP and its subsidiaries, whether acting as controller, processor, or joint controller. Specifically, the scope encompasses the following entities:
(a) Northgate Telecommunications PLC (Company Number 04837291), registered at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom; principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom. NTP PLC is the parent company of the NTP group and the principal controller for UK operations.
(b) Northgate Ireland Ltd (CRO Number 587214), Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland. Northgate Ireland Ltd is the principal EU establishment for the purposes of the one-stop-shop mechanism under Article 56 EU GDPR and coordinates with the DPC as lead supervisory authority.
(c) Northgate GmbH (HRB 214503 B, AG Charlottenburg), Friedrichstraße 91, 10117 Berlin, Germany. Northgate GmbH operates NTP's German telecommunications and enterprise services business.
(d) Northgate B.V. (KvK Number 72841936), Herikerbergweg 44, 1101 CM Amsterdam, Netherlands. Northgate B.V. operates NTP's Dutch telecommunications and cloud services business.
(e) Northgate France SAS (SIREN 891 247 503), 27 Rue de Berri, 75008 Paris, France. Northgate France SAS operates NTP's French telecommunications business.
(f) Northgate Iberia S.L. (CIF B-91847263), Calle de Serrano 41, 28001 Madrid, Spain. Northgate Iberia S.L. operates NTP's Spanish telecommunications business.
The scope of this guidance note covers processing where NTP entities act as controller and, where applicable, as processor (for example, network management services provided to enterprise clients) or as joint controller (for example, the IoT analytics partnership with Moritaka Systems K.K., under which NTP and Moritaka have agreed a joint controller arrangement pursuant to Article 26 GDPR, with respective responsibilities documented in a Joint Controller Agreement dated 8 November 2022).
The ROPA encompasses all categories of data subjects whose personal data is processed by NTP, including:
• Approximately 6.3 million consumer subscribers across the United Kingdom and five EU member states;
• Approximately 42,000 enterprise clients (including individual contacts within enterprise client organisations);
• Approximately 11,400 employees (approximately 8,200 in the UK and EU; the remainder in other jurisdictions outside the scope of this ROPA);
• Approximately 28,000 contractors, temporary workers, job applicants, and website visitors (collectively); and
• A total estimated data subject population of approximately 6.38 million individuals.
These figures are as at the date of ROPA v1.0 (19 May 2023) and will be updated as part of the annual review cycle described in Section 6 below.
2. ROPA Structure and Content Requirements
2.1 Mandatory Fields Under Article 30(1)
Each entry in the ROPA must contain, as a minimum, the information prescribed by Article 30(1)(a) through (g) of the UK GDPR and the EU GDPR. The following paragraphs describe each mandatory field and the standard to which it must be completed for NTP's purposes.
(a) Controller identity and contact details. Each ROPA entry must record the name, address, and contact details of the controller (being the relevant NTP entity responsible for the processing activity). Where the processing activity involves a joint controller arrangement, the identity and contact details of the joint controller must also be recorded, together with a cross-reference to the applicable Joint Controller Agreement and a summary of the respective responsibilities of each joint controller as agreed under Article 26. Where a controller's representative has been appointed (for example, where an NTP entity without an establishment in a particular jurisdiction has designated a representative under Article 27), the identity and contact details of that representative must be recorded. In all cases, the identity and contact details of the Data Protection Officer (currently Sanjay Mehta) must be recorded.
(b) Purposes of processing. Each ROPA entry must contain a clear and specific description of each distinct purpose for which personal data is processed in the context of the relevant processing activity. Purposes must be described with sufficient granularity to enable meaningful assessment of the lawful basis, proportionality, and necessity of the processing. Generic or catch-all descriptions (such as "general business purposes" or "as needed") are not acceptable. Where a single processing activity serves multiple purposes, each purpose must be separately articulated.
(c) Categories of data subjects and categories of personal data. Each ROPA entry must enumerate the categories of data subjects whose personal data is processed (for example, consumer subscribers, enterprise clients, employees, contractors, job applicants, website visitors) and the categories of personal data processed in relation to each category of data subject. Categories of personal data include, but are not limited to: identity data (name, date of birth, identification numbers), contact data (address, email, telephone number), financial data (bank account details, payment card details, billing information), communications data (call records, message metadata, content data where lawfully processed), location data, device identifiers (IMEI, MAC address, IP address), and special category data where applicable (health data, trade union membership data, biometric data).
(d) Categories of recipients. Each ROPA entry must identify the categories of recipients to whom personal data is or may be disclosed. This includes internal business units within the same NTP entity, other NTP group entities, data processors engaged under Article 28 data processing agreements, and any third parties to whom personal data is disclosed (for example, law enforcement agencies pursuant to lawful requests, or regulatory authorities). Current key processors and recipients include Caldwell Analytics Inc. (data analytics services, United States), Pinnacle Cloud Services Ltd (cloud infrastructure, United Kingdom, with sub-processors Pinnacle India Pvt Ltd in India and Pinnacle APAC Pte Ltd in Singapore), Sunderland-Hayes Payroll Services Inc. (payroll processing, United States), and Moritaka Systems K.K. (IoT analytics, Japan). Where disclosure is made to a specific named recipient (as opposed to a category of recipients), the named recipient should be recorded.
(e) International transfers. Each ROPA entry must identify any transfers of personal data to third countries (countries outside the United Kingdom and/or the European Economic Area, as applicable) or to international organisations. For each identified transfer, the ROPA entry must record: the destination country or international organisation; the identity of the recipient in the third country; the transfer mechanism relied upon (for example, EU Standard Contractual Clauses ("SCCs"), UK International Data Transfer Agreement ("UK IDTA"), UK Addendum to EU SCCs, or an adequacy decision); and documentation of the appropriate safeguards in place. Where a Transfer Impact Assessment ("TIA") has been conducted, the ROPA entry must cross-reference the relevant TIA document.
(f) Retention periods. Each ROPA entry must record the envisaged time limits for erasure of the different categories of personal data processed in the context of the relevant activity. Where it is not possible to specify an exact retention period, the criteria used to determine the retention period must be described. All retention periods must be consistent with and cross-referenced to NTP's Data Retention Schedule (version 2.1, effective 15 March 2023).
(g) Technical and organisational security measures. Each ROPA entry must contain a general description of the technical and organisational security measures implemented pursuant to Article 32(1) of the UK GDPR and EU GDPR. This includes, as applicable: encryption standards (AES-256 encryption at rest; TLS 1.3 for data in transit), pseudonymisation techniques, access controls (role-based access, multi-factor authentication), physical security measures (data centre security, biometric access to server rooms), network security measures (firewalls, intrusion detection systems), data backup and recovery procedures, and staff training and awareness programmes. The description need not replicate the full detail of NTP's information security documentation but must be sufficient to demonstrate that appropriate measures are in place.
2.2 Additional Best-Practice Fields Adopted by NTP
In addition to the mandatory fields prescribed by Article 30(1), NTP has adopted a number of best-practice fields that enhance the utility of the ROPA as a compliance management tool and align with the expectations expressed by the ICO and the EDPB. Each NTP ROPA entry should also record the following supplementary information:
Lawful basis. The specific lawful basis relied upon under Article 6(1) of the UK GDPR / EU GDPR for each processing activity. Where the processing involves special category data, the ROPA entry must also record the applicable condition under Article 9(2). As at ROPA v1.0, the distribution of lawful bases across the 147 documented processing activities is as follows:
Legitimate Interest Assessment reference. Where legitimate interest is relied upon as the lawful basis for processing (currently sixty-four (64) processing activities), the ROPA entry must include a cross-reference to the corresponding Legitimate Interest Assessment ("LIA"). The LIA template was developed during Phase 2 of engagement SC/NTP/2023-0213/PDS and is maintained by the DPO's office. Each LIA must assess the three-part test of purpose, necessity, and balancing, and must be refreshed at least annually as part of the ROPA review cycle described in Section 6.
DPIA reference. Where a Data Protection Impact Assessment ("DPIA") has been completed or is required in respect of a processing activity, the ROPA entry must include a cross-reference to the relevant DPIA document. As at ROPA v1.0, eleven (11) DPIAs have been completed (DPIA-001 through DPIA-011), each linked to one or more ROPA entries. The ROPA entry should indicate whether the DPIA identified any residual high risks and whether prior consultation with a supervisory authority was required under Article 36.
Data source. Each ROPA entry must record whether personal data is collected directly from the data subject (for example, through account registration, contract formation, or consent mechanisms) or obtained from third-party sources (for example, credit reference agencies, public registers, or data brokers). Where data is obtained from third-party sources, the identity or category of the source should be recorded.
Automated decision-making / profiling. Each ROPA entry must indicate whether the processing activity involves automated decision-making (including profiling) within the meaning of Article 22 of the UK GDPR / EU GDPR. Where automated decision-making is involved, the ROPA entry should describe the logic involved, the significance and envisaged consequences for the data subject, and the safeguards in place (including the right to obtain human intervention, to express a point of view, and to contest the decision).
Special category data indicator. Each ROPA entry must include a flag indicating whether the processing activity involves special category data as defined in Article 9(1) of the UK GDPR / EU GDPR. Fourteen (14) processing activities have been identified as involving special category data (including employee health data processed for occupational health and absence management purposes, trade union membership data processed for payroll and industrial relations purposes, and biometric data processed for physical access controls at NTP premises).
Responsible business unit / data steward. Each ROPA entry must identify the business unit responsible for the processing activity and the named individual serving as data steward for that entry. The data steward is responsible for the ongoing accuracy of the ROPA entry and for notifying the DPO of any changes in accordance with the procedures described in Section 4 and Section 5 of this guidance note.
Date of last review. Each ROPA entry must record the date on which the entry was last reviewed and confirmed as accurate. This field supports the annual review cycle described in Section 6 and enables the DPO to identify entries that are overdue for review.
2.3 ROPA Format and Platform
ROPA v1.0 has been delivered in two Microsoft Excel spreadsheet files, structured as follows:
(i) UK Operations — covering eighty-nine (89) processing activities for Northgate Telecommunications PLC (UK operations). Each activity is documented on a separate row, with columns corresponding to the mandatory and best-practice fields described in Sections 2.1 and 2.2 above.
(ii) EU Subsidiaries — covering fifty-eight (58) processing activities across the five EU subsidiaries, broken down as follows: Northgate Ireland Ltd (18 activities), Northgate GmbH (16 activities), Northgate B.V. (11 activities), Northgate France SAS (8 activities), and Northgate Iberia S.L. (5 activities). Each activity is documented on a separate row, with an additional column identifying the relevant subsidiary entity.
Going forward, the ROPA will be maintained on the Sundial Solutions privacy management platform, as configured by Ashdown Consulting Group Ltd (Company Number 11293847, registered at 15 Bedford Row, London WC1R 4BU, United Kingdom), under the direction of Anita Chakravarti (Lead Privacy Engineer, Ashdown) and Robert Fairclough (Managing Director, Ashdown). The Sundial Solutions platform has been selected as NTP's primary ROPA management tool because it provides automated workflows for ROPA updates, comprehensive change tracking and audit trail functionality, configurable reporting dashboards, and integration with other privacy compliance modules (including the DPIA module and the data mapping module). Further details of the Sundial Solutions platform configuration are set out in Section 7 below.
The Excel spreadsheet versions of the ROPA will be retained as an offline backup and for use in regulatory submissions where regulators request the ROPA in a portable or non-platform-dependent format. This includes potential use in connection with DPC inquiry IN-22-11-3 (relating to Northgate Ireland Ltd's processing of consumer subscriber communications metadata) and any future requests from the ICO. The spreadsheet backup must be updated concurrently with the Sundial Solutions platform to ensure consistency between the two records.
3. Roles and Responsibilities
The effective maintenance of the ROPA depends on clear allocation of roles and responsibilities across the NTP organisation. This section defines the key roles and their respective responsibilities in relation to ROPA governance.
3.1 Data Protection Officer (DPO)
Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC. Mr. Mehta holds the Certified Information Privacy Professional/Europe (CIPP/E) credential and was appointed to the role of DPO in March 2019. He reports to the General Counsel (Fiona Gallagher) on operational matters, with a dotted reporting line to the Audit & Risk Committee of the NTP Board to ensure appropriate independence as required by Article 38 of the UK GDPR / EU GDPR.
The DPO has overall accountability for the accuracy, completeness, and currency of the ROPA across all NTP entities. This encompasses both the UK Operations ROPA and the EU Subsidiaries ROPA. The DPO's specific responsibilities in relation to the ROPA include, without limitation:
(a) Overseeing the annual ROPA review cycle and approving ad hoc updates in accordance with the procedures set out in Sections 5 and 6 of this guidance note.
(b) Approving new ROPA entries and material amendments to existing entries before they are finalised in the Sundial Solutions platform.
(c) Ensuring that the ROPA is available for inspection by the ICO and/or the DPC (or any other relevant supervisory authority) upon request, as required by Article 30(4) of the UK GDPR / EU GDPR.
(d) Coordinating with business unit data stewards across all NTP entities to obtain and validate the information required for each ROPA entry.
(e) Reporting ROPA status, including compliance metrics and any identified gaps or risks, to the Audit & Risk Committee of the NTP Board as part of the DPO's quarterly data protection reporting.
(f) Liaising with the CISO (Thomas Okoye) to ensure that the technical and organisational security measures recorded in the ROPA accurately reflect NTP's implemented controls and are updated when material changes occur.
(g) Maintaining the ROPA update log and ensuring that all changes to the ROPA are properly documented, including the date of change, nature of change, responsible data steward, and DPO approval date.
3.2 Business Unit Data Stewards
Each business unit and each subsidiary within the NTP group must designate a "data steward" who is responsible for the accuracy and currency of ROPA entries relating to processing activities within that business unit or subsidiary. The data steward role is not a full-time position; it is an additional responsibility assigned to a sufficiently senior individual within the business unit who has the operational knowledge necessary to provide accurate information about the unit's processing activities.
The responsibilities of each data steward include:
(a) Providing accurate and timely information for ROPA entries relating to their processing activities, including completing the Data Mapping Questionnaire (template distributed 1 March 2023) for new or materially changed activities.
(b) Notifying the DPO of any new processing activities, changes to existing activities, or cessation of activities, in accordance with the update triggers described in Section 4 and the update procedures described in Section 5 of this guidance note.
(c) Participating actively in the annual ROPA review cycle, including reviewing and confirming or amending all ROPA entries within their area of responsibility within the timescales specified in Section 6.
(d) Completing the Data Mapping Questionnaire for new or materially changed processing activities and submitting it to the DPO for review and approval before processing commences.
The following key data stewards have been designated for the purposes of ROPA v1.0:
Laura Dearden (VP, Product & Engineering, NTP PLC) — responsible for ROPA entries relating to NorthCloud platform activities, including AI-driven churn prediction, marketing profiling, targeted advertising, and SaaS processing activities provided to enterprise clients.
Philippa Crane (Head of People & HR, NTP PLC) — responsible for ROPA entries relating to employee data processing across all HR functions, including recruitment, onboarding, payroll administration, performance management, HR analytics, the NorthPulse employee wellbeing platform, biometric access controls, and occupational health processing.
Thomas Okoye (CISO, NTP PLC) — responsible for ROPA entries relating to cybersecurity-related processing activities, including network traffic analysis, anomaly detection, security incident investigation, CCTV surveillance, and access logging.
Marcus Engström (Head of EU Operations, based in Dublin) — responsible for coordinating the accuracy of ROPA entries for Northgate Ireland Ltd and for overseeing coordination with data stewards at the other EU subsidiaries (Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.).
Each EU subsidiary (Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.) is required to appoint a subsidiary-level data steward to work with Marcus Engström and the DPO. The names and contact details of subsidiary-level data stewards must be registered with the DPO's office within thirty (30) calendar days of the date of this guidance note.
3.3 General Counsel
Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC, provides legal oversight of the ROPA programme. Ms. Gallagher's responsibilities in relation to the ROPA include:
(a) Serving as the escalation point for complex lawful basis assessments, novel legal questions, and regulatory inquiries relating to ROPA disclosures.
(b) Approving ROPA-related submissions to regulators, including any disclosure of the ROPA (or extracts thereof) to the ICO, the DPC, or any other supervisory authority.
(c) Engaging external counsel (including Calderwood & Harkness LLP or other advisors) where the DPO identifies a requirement for external legal advice in connection with ROPA matters.
(d) Coordinating with NTP's statutory auditors (Whitmore Kendall LLP) where access to the ROPA is requested in connection with internal controls review or annual report risk disclosures.
3.4 Chief Information Security Officer (CISO)
Thomas Okoye, CISO, Northgate Telecommunications PLC, is responsible for ensuring that the technical and organisational security measures described in the ROPA accurately reflect NTP's implemented controls at all times. Mr. Okoye's responsibilities in relation to the ROPA include:
(a) Reviewing and validating the description of security measures in each ROPA entry during the annual review cycle and upon request from the DPO.
(b) Notifying the DPO promptly of any material changes to NTP's security architecture that affect the accuracy of ROPA entries. Material changes include, without limitation: changes to encryption standards or protocols, changes to access control mechanisms, deployment of new or decommissioning of existing security tools, changes to data centre configurations (including at NTP's primary data centres in London, Frankfurt, Amsterdam, and Dublin), and changes to network security architecture.
(c) Providing technical input to the DPO where DPIA screening or completion requires assessment of security measures in the context of a new or changed processing activity.
3.5 External Support
NTP engages the following external service providers in connection with ROPA management:
Ashdown Consulting Group Ltd (Company Number 11293847, 15 Bedford Row, London WC1R 4BU, United Kingdom) provides ongoing technical support for the Sundial Solutions privacy management platform, including platform maintenance, data flow inventory updates, system configuration changes, and user training. The primary contacts at Ashdown for ROPA-related matters are Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer). Ashdown's engagement is governed by a separate support agreement between NTP and Ashdown, which includes appropriate data processing terms and confidentiality obligations.
Calderwood & Harkness LLP is available to provide advisory support on ROPA methodology, regulatory interpretation, and audit readiness on an ad hoc basis. It should be noted that the current engagement (SC/NTP/2023-0213/PDS) under which this guidance note and ROPA v1.0 have been delivered has been completed as at the date of this guidance note. Any future advisory support from Calderwood & Harkness LLP will be subject to a separate engagement letter and fee arrangement, to be coordinated through the General Counsel.
4. Update Triggers — When to Update the ROPA
The ROPA is a living document and must be updated whenever there is a change to NTP's processing landscape that affects the accuracy or completeness of any ROPA entry. This section identifies the events that trigger a mandatory or recommended update to the ROPA.
4.1 Mandatory Update Events
The ROPA must be updated promptly, and in any event within thirty (30) calendar days, of the occurrence of any of the following events:
New processing activity. The introduction of any new processing activity involving personal data, including the launch of new products, services, systems, platforms, applications, or internal processes that involve the collection, use, storage, disclosure, or other processing of personal data. The responsible data steward must complete the Data Mapping Questionnaire and submit it to the DPO for review and approval before the new processing activity commences. No new processing activity may commence without an approved ROPA entry.
Change in purposes of processing. Any material change to the stated purpose or purposes for which personal data is processed in an existing processing activity. A change is material if it would affect the assessment of whether the processing is necessary and proportionate, or if it would alter the information that should be provided to data subjects in a privacy notice.
Change in lawful basis. Any change in the lawful basis relied upon for a processing activity. This includes, for example, a transition from consent to legitimate interest (or vice versa), a change from contract performance to legal obligation, or the identification of a more appropriate lawful basis following legal review. Where legitimate interest is newly relied upon as the lawful basis, a Legitimate Interest Assessment must be completed using the LIA template before the ROPA entry is amended.
Change in categories of data subjects or personal data. The addition of new categories of data subjects (for example, extending a service to a new population of individuals) or new types of personal data (for example, collecting biometric data where previously only identity data was collected) to an existing processing activity.
New or changed recipients / processors. The engagement of a new data processor under Article 28 (for example, the appointment of a new sub-processor approved under the data processing agreement with Pinnacle Cloud Services Ltd, or the engagement of a successor provider to Caldwell Analytics Inc.), the termination of an existing processor relationship, or any material change in the scope of processing carried out by an existing processor. This also includes the addition of new categories of internal or external recipients.
New international data transfer. Any new transfer of personal data to a third country or international organisation, or a change in the destination country for an existing transfer (for example, where a processor relocates processing operations to a new jurisdiction). A new international transfer must be accompanied by a mechanism selection assessment (in accordance with the International Transfers Policy) and, where required, a Transfer Impact Assessment, before the ROPA entry is approved by the DPO.
Change in retention periods. Any change to the applicable retention period for a category of personal data processed in the context of an existing activity. Changes to retention periods must be cross-referenced to the Data Retention Schedule and, where applicable, coordinated with the General Counsel to ensure legal and regulatory requirements are met.
Change in technical / organisational measures. Material changes to the technical and organisational security measures relevant to a processing activity, as notified by the CISO in accordance with Section 3.4 above. Examples include the migration to a new encryption standard, the implementation of new access control mechanisms, or changes to data centre security arrangements.
Cessation of a processing activity. Where a processing activity is discontinued or permanently ceased, the corresponding ROPA entry must be updated to reflect the cessation. The entry must be marked as "inactive" in the Sundial Solutions platform and in the spreadsheet backup, with the cessation date recorded. The inactive entry must be retained for audit trail purposes and must not be deleted. By way of example, the ROPA entry for the facial recognition pilot (associated with DPIA-008) has been marked as "inactive" following the Board's acceptance on 14 June 2023 of the recommendation to discontinue that processing activity.
Regulatory direction or enforcement action. Any direction, enforcement notice, reprimand, or other formal action by the ICO, the DPC, or any other supervisory authority that requires changes to NTP's processing activities must result in a corresponding update to the relevant ROPA entry or entries. This includes, for example, any required changes arising from ICO Enforcement Notice ENF/2021/0934 or from DPC inquiry IN-22-11-3.
DPIA outcome. Where a DPIA identifies the need for changes to a processing activity (for example, additional safeguards, modifications to the scope of processing, or restrictions on certain processing operations), the corresponding ROPA entry must be updated to reflect the DPIA's findings and any mitigation measures adopted.
4.2 Recommended Update Events
In addition to the mandatory update events described above, the following events should also prompt a review and, where appropriate, an update to the ROPA:
• Organisational restructuring affecting the controller or processor entities within the NTP group, including changes to group corporate structure, reporting lines, or business unit boundaries.
• Changes to data centre locations or cloud infrastructure arrangements, including changes to the data centres operated or used by Pinnacle Cloud Services Ltd (currently located in London, Frankfurt, Amsterdam, Dublin, and Stockholm) and operations conducted by Pinnacle's sub-processors (Pinnacle India Pvt Ltd in India and Pinnacle APAC Pte Ltd in Singapore).
• Changes to applicable legislation or regulatory guidance that affect the content or requirements of the ROPA, including but not limited to the enactment of the UK Data Protection and Digital Information Bill, changes to EU adequacy decisions (including any revocation or revision of existing adequacy decisions for Japan or Canada), and new guidance from the ICO, the DPC, or the EDPB.
• Mergers, acquisitions, or divestitures affecting NTP group entities, including the acquisition of new subsidiaries or the divestiture of existing business lines that involve personal data processing.
• Material changes to vendor or supplier contracts that affect the scope, nature, or terms of personal data processing (for example, a significant expansion of the services provided by a processor, or a renegotiation of data processing terms).
While the thirty (30) calendar day timeline applicable to mandatory update events does not strictly apply to recommended update events, data stewards are encouraged to notify the DPO of such events as promptly as practicable, and in any event during the next annual review cycle.
5. ROPA Update Procedure
This section describes the procedure to be followed when a trigger event identified in Section 4 occurs and a ROPA update is required. The procedure applies to both new ROPA entries and amendments to existing entries.
5.1 Identification and Notification
The data steward for the relevant business unit or subsidiary identifies that a trigger event (as described in Section 4) has occurred or is anticipated to occur. It is the responsibility of the data steward to proactively identify trigger events through their knowledge of the business operations within their area of responsibility.
Upon identifying a trigger event, the data steward must take the following steps:
(a) For new processing activities: complete the Data Mapping Questionnaire in full, providing all information required for the mandatory and best-practice ROPA fields described in Section 2.
(b) For amendments to existing processing activities: complete the Change Notification Form (template appended as Annex A to this guidance note), specifying the ROPA entry reference number, the nature of the change, and the amended field values.
(c) For cessation of processing activities: complete the Change Notification Form, specifying the ROPA entry reference number, the cessation date, and the reason for cessation.
The completed questionnaire or form must be submitted to the DPO (Sanjay Mehta) via the Sundial Solutions workflow, which will automatically log the submission, assign a tracking reference, and route the submission through the appropriate review workflow. If the Sundial Solutions platform is temporarily unavailable for any reason (for example, due to scheduled maintenance or a system outage), the data steward should submit the form by email to the DPO's designated inbox (dpo@northgatetelecoms.co.uk) with the subject line "ROPA Update — [Business Unit] — [Brief Description]."
5.2 Review and Validation
Upon receipt of a submission from a data steward, the DPO must review the submission for completeness and accuracy within ten (10) business days. The review will include the following steps:
(a) Verify that all mandatory Article 30(1) fields have been completed (or, for amendments, that all amended fields have been clearly identified and updated).
(b) Verify that all best-practice fields adopted by NTP (as described in Section 2.2) have been completed.
(c) Assess whether the stated lawful basis is appropriate for the described processing activity and, where legitimate interest is relied upon, confirm that a Legitimate Interest Assessment has been completed or is in progress.
(d) Where the processing involves special category data (currently fourteen (14) activities identified), or where the processing is otherwise likely to be high-risk, assess whether a new or updated DPIA is required before the ROPA entry can be approved. If a DPIA is required, the ROPA entry cannot be finalised until the DPIA has been completed and its outcomes reflected in the ROPA entry.
(e) Where the processing involves an international transfer, confirm that the transfer mechanism has been selected in accordance with the International Transfers Policy and that a Transfer Impact Assessment has been completed where required.
Where the DPO requires additional information or clarification, the DPO will return the submission to the data steward via the Sundial Solutions workflow (or by email if the platform is unavailable) with specific queries. The data steward must respond within five (5) business days.
Where the DPO determines that consultation with other stakeholders is necessary, the DPO may consult with:
• The CISO (Thomas Okoye) in relation to the adequacy and accuracy of technical and organisational security measures described in the ROPA entry.
• The General Counsel (Fiona Gallagher) in relation to lawful basis assessments, regulatory implications, complex legal questions, or matters that may give rise to regulatory risk.
• Ashdown Consulting Group Ltd (Anita Chakravarti) in relation to Sundial Solutions platform configuration, data model adjustments, or workflow modifications required to accommodate the new or amended entry.
5.3 Approval and Entry
Following the completion of the review and validation process, the DPO approves the new or amended ROPA entry in the Sundial Solutions platform. The Sundial Solutions system automatically logs the following information upon approval:
• The identity of the approver (the DPO);
• The date and time of approval;
• The version of the entry (new or amended); and
• The complete content of the approved entry.
Concurrently with the approval in Sundial Solutions, the DPO's office must update the spreadsheet backup to ensure that the offline record is consistent with the Sundial Solutions platform. The spreadsheet backup should be version-controlled in accordance with the version control procedures described in Section 9.
Upon approval, a confirmation notification is automatically generated by Sundial Solutions and sent to the submitting data steward, confirming that the ROPA entry has been approved and the update has been recorded.
5.4 Quality Assurance
The DPO maintains a centralised update log recording all changes to the ROPA. The update log records the following information for each change:
• The ROPA entry reference number;
• The date of the change;
• The nature of the change (new entry, amendment, or inactivation);
• A brief description of the change;
• The name and business unit of the responsible data steward;
• The date of DPO approval; and
• Any notes or observations (for example, where the change was linked to a DPIA outcome or a regulatory direction).
The update log is maintained in a secure, access-controlled format and is available for review by internal audit and for inspection by regulators upon request. The update log supplements the automated audit trail maintained by the Sundial Solutions platform and provides an additional layer of quality assurance.
6. Annual ROPA Review Cycle
6.1 Timing and Scheduling
In addition to the ad hoc updates triggered by the events described in Section 4, a comprehensive review of all ROPA entries must be conducted at least once every twelve (12) months. The annual review cycle is designed to ensure that the ROPA remains a complete and accurate reflection of NTP's processing landscape, even where no specific trigger event has been identified.
The annual review cycle is scheduled to commence on 1 April each year. The first full annual review will commence on 1 April 2024 and is targeted for completion within sixty (60) calendar days (i.e., by 31 May 2024). Subsequent annual reviews will follow the same schedule.
The DPO is responsible for initiating the annual review and coordinating with all data stewards across NTP entities and business units. The DPO should issue a formal launch communication to all data stewards at least fifteen (15) business days before the scheduled commencement date, setting out the review timeline, expectations, and any areas of particular focus.
6.2 Review Scope
The annual review must cover every ROPA entry, without exception. For each entry, the data steward and the DPO must review and confirm or update every field, including:
(a) Purposes of processing — confirm that the stated purposes remain accurate and complete.
(b) Lawful basis — confirm that the lawful basis relied upon remains appropriate. For the sixty-four (64) processing activities relying on legitimate interest, the corresponding Legitimate Interest Assessments must be refreshed where necessary to reflect any changes in the balancing exercise (for example, changes in data subject expectations, changes in the competitive landscape, or the availability of less intrusive alternatives).
(c) Categories of data subjects and personal data — confirm that the enumerated categories remain accurate and that no new categories have been introduced without a corresponding ROPA update.
(d) Categories of recipients — confirm that the list of recipients (internal and external) remains accurate and that no new recipients have been added without a corresponding ROPA update.
(e) International transfers — confirm that all international transfers are accurately reflected, that the transfer mechanisms in place remain valid (for example, that EU SCCs or UK IDTAs have not expired or been revoked), and that Transfer Impact Assessments remain current. As at ROPA v1.0, six (6) TIAs have been completed, covering transfers to the United States, India, Singapore, and Japan.
(f) Retention periods — confirm that the retention periods stated in the ROPA remain consistent with the Data Retention Schedule and that no changes to retention periods have been implemented without a corresponding ROPA update.
(g) Technical and organisational measures — confirm, in coordination with the CISO, that the security measures described in the ROPA accurately reflect NTP's implemented controls.
(h) Processor and sub-processor lists — confirm that the lists of processors and sub-processors remain accurate. Current key processors include Caldwell Analytics Inc. (US), Pinnacle Cloud Services Ltd (UK, with sub-processors Pinnacle India Pvt Ltd in India and Pinnacle APAC Pte Ltd in Singapore), Sunderland-Hayes Payroll Services Inc. (US), and Moritaka Systems K.K. (Japan).
(i) Active / inactive status — confirm that all documented processing activities are still active. Where a processing activity has been discontinued since the last review, the entry must be marked as "inactive" with the cessation date recorded.
(j) DPIA assessment — assess whether any processing activity now triggers a DPIA requirement that was not previously identified (for example, due to changes in scale, scope, or context of processing, or due to new regulatory guidance on DPIA thresholds).
6.3 Review Process
The annual review follows a structured process designed to ensure thoroughness and accountability:
Step 1 — Distribution. The DPO distributes the current ROPA extract to each data steward via the Sundial Solutions workflow. Each data steward receives only the ROPA entries within their area of responsibility. The distribution is accompanied by clear instructions and a deadline for completion.
Step 2 — Data steward review. Each data steward reviews all ROPA entries within their area of responsibility and either confirms that each entry is accurate and up to date or annotates the entry with proposed amendments. Data stewards are given twenty (20) business days to complete their review and return their annotated ROPA extracts to the DPO via the Sundial Solutions workflow.
Step 3 — Consolidation. The DPO consolidates all responses from data stewards, resolves any discrepancies or inconsistencies, and updates the ROPA entries in Sundial Solutions accordingly. Where the DPO identifies entries that require further investigation or clarification, the DPO follows up directly with the relevant data steward.
Step 4 — Annual ROPA Review Report. The DPO prepares an Annual ROPA Review Report summarising the outcomes of the review. The report includes the following information:
• Total number of ROPA entries reviewed;
• Number of new entries added since the last review;
• Number of existing entries amended;
• Number of entries inactivated (with reasons);
• Key themes and trends identified during the review (for example, growth in AI-related processing activities, increase in international transfers, or shifts in lawful basis distribution);
• New compliance risks identified and recommended mitigation actions; and
• Status of outstanding actions from the previous review cycle (if applicable).
Step 5 — Board reporting. The Annual ROPA Review Report is presented to the Audit & Risk Committee of the NTP Board as part of the DPO's annual data protection report. The report enables the Board to exercise appropriate oversight of NTP's data processing landscape and compliance posture.
6.4 Cross-Entity Coordination
The annual review must encompass ROPA entries for all NTP entities, including both UK operations and EU subsidiary operations. To ensure effective cross-entity coordination:
Marcus Engström (Head of EU Operations, based in Dublin) is responsible for coordinating the annual review for EU subsidiary ROPA entries (currently fifty-eight (58) activities). Mr. Engström must ensure that subsidiary-level data stewards at Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L. participate fully in the review process and adhere to the prescribed timelines.
The review must account for regulatory differences between the UK GDPR and the EU GDPR as applicable to each entity's operations. While the substantive requirements of the two instruments are currently closely aligned, there are areas of divergence that may affect ROPA entries (for example, differences in the treatment of international transfers following Brexit, and differences in national implementing legislation in Germany, the Netherlands, France, and Spain). These differences were analysed in the advisory memo on UK GDPR vs. EU GDPR divergence prepared by Calderwood & Harkness LLP during Phase 1 of engagement SC/NTP/2023-0213/PDS, and the DPO should have regard to that analysis when conducting the annual review.