NORTHGATE TELECOMMUNICATIONS PLC
International Transfers Policy & Mechanism Selection Guidance
Document Reference: NTP-DP-POL-007
Right-click to update Table of Contents
1. PURPOSE AND OBJECTIVES
1.1 Purpose. The purpose of this International Transfers Policy & Mechanism Selection Guidance (the "Policy") is to establish a binding internal policy framework governing the transfer of personal data from Northgate Telecommunications PLC ("NTP" or the "Company") and its subsidiaries (together, the "NTP Group") to recipients located outside the United Kingdom (the "UK") and the European Economic Area (the "EEA"). This Policy sets out the principles, procedures, and decision-making framework that must be followed before any international transfer of personal data is initiated, continued, or materially varied.
This Policy is designed to function as an authoritative reference document for all NTP Group personnel who are involved in, or responsible for, the identification, assessment, authorisation, implementation, or ongoing monitoring of international transfers of personal data. It provides detailed guidance on the selection of appropriate transfer mechanisms, the conduct of Transfer Impact Assessments, the identification and deployment of supplementary measures, and the ongoing governance and compliance monitoring requirements applicable to international data transfers within the NTP Group.
1.2 Objectives. The objectives of this Policy are to:
1. Ensure that all international transfers of personal data by or on behalf of the NTP Group are carried out in full compliance with the UK General Data Protection Regulation (the "UK GDPR"), as retained EU law under the European Union (Withdrawal) Act 2018 and as supplemented by the Data Protection Act 2018 (the "DPA 2018"), and the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), as applicable to the NTP Group's EU subsidiary operations.
2. Provide a structured, repeatable decision-making process for the selection of appropriate transfer mechanisms, ensuring consistency across all NTP Group entities and business units.
3. Mandate the conduct of Transfer Impact Assessments in accordance with the methodology set out by the European Data Protection Board ("EDPB") in its Recommendations 01/2020 on supplementary measures, as adopted on 18 June 2021, and in line with guidance published by the UK Information Commissioner's Office (the "ICO").
4. Establish clear roles and responsibilities for the identification, escalation, approval, documentation, and periodic review of international data transfers.
5. Maintain a comprehensive and up-to-date International Transfers Register, integrated with the NTP Group's Record of Processing Activities ("ROPA") and the Sundial Solutions privacy management platform.
6. Ensure that supplementary measures — whether technical, contractual, or organisational — are identified, implemented, and maintained where a Transfer Impact Assessment reveals that the legal framework of the destination country does not provide a level of protection for personal data that is essentially equivalent to that guaranteed within the UK or the EEA.
7. Support the NTP Group's compliance with its obligations to supervisory authorities, including the ICO and the Data Protection Commission of Ireland (the "DPC"), and to respond to regulatory inquiries, including the active DPC preliminary inquiry (reference IN-22-11-3) regarding cross-border transfers from Northgate Ireland Ltd to US-based processors.
1.3 Context. This Policy has been developed as part of the NTP Group's comprehensive GDPR compliance programme build, which was initiated in February 2023 and is scheduled for completion in September 2023. The compliance programme was mandated by a resolution of the NTP Board Audit & Risk Committee dated 8 December 2022, which directed the General Counsel to engage external specialist counsel and to oversee the development, documentation, and implementation of a suite of data protection policies, procedures, and governance structures across the NTP Group.
Calderwood & Harkness LLP was engaged as external counsel to the Company under engagement reference SC/NTP/2023-0213/PDS to lead the development of this Policy and the associated Transfer Impact Assessments, transfer mechanism documentation, and supplementary measures framework.
1.4 Regulatory Backdrop
This Policy is developed against the backdrop of a heightened regulatory environment for international data transfers, shaped in particular by the following developments:
• The judgment of the Court of Justice of the European Union ("CJEU") in Data Protection Commissioner v Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18, 16 July 2020) (the "Schrems II" judgment), which invalidated the EU-US Privacy Shield and imposed enhanced scrutiny obligations on data exporters relying on Standard Contractual Clauses or other Article 46 transfer mechanisms to transfer personal data to third countries.
• The adoption by the EDPB of Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (version 2.0, adopted 18 June 2021), which set out a six-step methodology for assessing and supplementing international data transfers.
• The adoption by the European Commission of new Standard Contractual Clauses for international data transfers under Implementing Decision (EU) 2021/914 of 4 June 2021, which replaced the previous sets of Standard Contractual Clauses and introduced a modular approach.
• The ICO's publication of the UK International Data Transfer Agreement ("UK IDTA") and the Approved Addendum to the EU Standard Contractual Clauses (the "UK Addendum") under Section 119A of the DPA 2018, providing UK-specific transfer mechanisms for transfers subject to the UK GDPR.
• The active DPC preliminary inquiry (reference IN-22-11-3) regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors, which was initiated in November 2022 and remains ongoing as at the effective date of this Policy. This inquiry underscores the heightened scrutiny to which the NTP Group's international transfer practices are subject and the critical importance of maintaining demonstrable compliance with applicable transfer requirements.
• The adoption by the European Commission of an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023 (Implementing Decision (EU) 2023/1795), which provides a new basis for transfers to certified US organisations, although its long-term durability remains uncertain in light of potential legal challenges.
2. SCOPE
2.1 Organisational Scope
This Policy applies to the following entities within the NTP Group:
2.1.1 Northgate Telecommunications PLC (the ultimate parent company of the NTP Group), a public limited company incorporated in England and Wales under Company Number 04837291, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom. NTP PLC is registered with the ICO under Registration Number ZA482917.
2.1.2 All EU/EEA subsidiaries of NTP PLC, specifically:
(a) Northgate Ireland Ltd, a private limited company incorporated in Ireland under CRO Number 587214, with its registered office at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland. Northgate Ireland Ltd is the NTP Group's principal EU establishment and serves as the establishment for the purposes of identifying the DPC as the NTP Group's lead supervisory authority in respect of cross-border processing within the EU.
(b) Northgate GmbH, a company with limited liability incorporated in Germany under HRB 214503 B at the Amtsgericht Charlottenburg, with its registered office at Friedrichstraße 91, 10117 Berlin, Germany. Northgate GmbH serves the NTP Group's German-speaking markets (Germany, Austria, and German-speaking Switzerland).
(c) Northgate B.V., a private limited liability company incorporated in the Netherlands under KvK Number 72841936, with its registered office at Herikerbergweg 44, 1101 CM Amsterdam, Netherlands. Northgate B.V. serves the NTP Group's Benelux operations.
(d) Northgate France SAS, a simplified joint-stock company incorporated in France under SIREN Number 891 247 503, with its registered office at 27 Rue de Berri, 75008 Paris, France. Northgate France SAS serves the NTP Group's French and francophone European operations.
(e) Northgate Iberia S.L., a limited liability company incorporated in Spain under CIF B-91847263, with its registered office at Calle de Serrano 41, 28001 Madrid, Spain. Northgate Iberia S.L. serves the NTP Group's Iberian operations (Spain and Portugal).
2.1.3 Any additional entity that becomes a subsidiary or affiliate of NTP PLC and that processes personal data subject to the UK GDPR or the EU GDPR shall be brought within the scope of this Policy within 90 days of its incorporation, acquisition, or commencement of relevant processing activities.
2.1.4 For the avoidance of doubt, this Policy applies to all departments, business units, functions, and teams within the above entities, including but not limited to: Product & Engineering (including the NorthCloud platform team), Network Operations, Commercial & Sales, People & HR, Finance, Legal & Compliance, and Customer Service.
2.2 Data Transfers in Scope
This Policy applies to the following categories of international data transfers:
(a) All transfers of personal data to recipients (whether acting as controllers, joint controllers, processors, or sub-processors) located in countries or territories outside the UK and/or the EEA that do not benefit from a current and applicable adequacy decision issued by the UK Secretary of State (under Section 17A of the DPA 2018) or the European Commission (under Article 45 of the EU GDPR).
(b) All transfers of personal data to recipients in countries or territories that do benefit from an adequacy decision, where reliance on that adequacy decision must be documented in accordance with the NTP Group's accountability obligations.
(c) All onward transfers by NTP's processors and sub-processors to third-country recipients, regardless of whether those onward transfers are made under instruction from NTP or at the processor's or sub-processor's initiative (subject always to the prior authorisation requirements set out in Section 10 of this Policy).
(d) Any contemplated or proposed new international data transfer that has not yet been initiated but is under consideration by any NTP Group entity, business unit, or project team.
As at the effective date of this Policy, the NTP Group has identified 14 international transfer data flows that fall within the scope of this Policy. These are documented in the International Transfers Register maintained by the DPO and summarised in Section 9 and Appendix B of this Policy.
2.3 Data Subjects Affected
The international data transfers governed by this Policy involve personal data relating to the following categories of data subjects:
Not all data subjects in each category are affected by every international transfer. The specific categories of data subjects affected by each transfer are documented in the International Transfers Register and in the relevant Transfer Impact Assessment.
2.4 Exclusions. The following categories of data transfers are excluded from the scope of this Policy:
(a) Intra-UK transfers: Transfers of personal data between entities, business units, or individuals within the United Kingdom do not constitute restricted transfers and are excluded from the scope of this Policy. Such transfers remain subject to the NTP Group Data Protection Policy (NTP-DP-POL-001) and must be documented in the ROPA where applicable.
(b) Intra-EEA transfers: Transfers of personal data between the NTP Group's EU subsidiaries (i.e., between Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.) do not constitute restricted transfers under the EU GDPR and are excluded from the scope of this Policy. Such transfers must nonetheless be documented in the ROPA.
(c) UK-to-EEA and EEA-to-UK transfers: As at the effective date of this Policy, transfers of personal data from the UK to the EEA are not restricted transfers under the UK GDPR by virtue of the UK Secretary of State's transitional adequacy provisions. Similarly, transfers of personal data from the EEA to the UK are not restricted transfers under the EU GDPR by virtue of the European Commission's adequacy decision for the United Kingdom adopted on 28 June 2021 (Implementing Decision (EU) 2021/1772). These transfers are excluded from the scope of this Policy but are noted in the International Transfers Register for monitoring purposes. In the event that either adequacy arrangement is revoked, suspended, or allowed to expire, the DPO shall immediately initiate a review to bring affected transfers within the full scope of this Policy.
3. REGULATORY FRAMEWORK
3.1 UK GDPR
The UK GDPR, as retained and adapted under the European Union (Withdrawal) Act 2018 and as supplemented by the DPA 2018, governs the processing of personal data by NTP PLC in respect of its UK operations. Chapter V of the UK GDPR (Articles 44 to 49, as retained) establishes the framework for restricted transfers of personal data to third countries and international organisations.
The ICO is the competent supervisory authority for the purposes of the UK GDPR. NTP PLC is registered with the ICO under Registration Number ZA482917. All references in this Policy to provisions of the UK GDPR are references to those provisions as retained and adapted under the DPA 2018, including any amendments made by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419) and subsequent statutory instruments.
Adequacy regulations for the purposes of the UK GDPR are made by the UK Secretary of State under Section 17A of the DPA 2018. The ICO maintains a list of countries and territories that benefit from UK adequacy regulations.
3.2 EU GDPR
The EU GDPR (Regulation (EU) 2016/679) governs the processing of personal data by the NTP Group's EU subsidiaries. Chapter V of the EU GDPR (Articles 44 to 49) establishes the framework for transfers of personal data to third countries and international organisations.
The Data Protection Commission of Ireland (the "DPC") is the NTP Group's lead supervisory authority for the purposes of the EU GDPR, by virtue of the NTP Group's principal EU establishment in Dublin through Northgate Ireland Ltd. This designation is relevant to the NTP Group's obligations under the GDPR's one-stop-shop mechanism (Articles 56 and 60 EU GDPR) and determines the supervisory authority with primary jurisdiction over cross-border processing by the NTP Group's EU subsidiaries.
The DPC's ongoing preliminary inquiry under reference IN-22-11-3 regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors is a material regulatory development that underscores the heightened compliance obligations applicable to the NTP Group's international data transfers. The NTP Group's compliance with this Policy, and its ability to demonstrate such compliance through comprehensive documentation, is directly relevant to the NTP Group's response to this inquiry.
3.3 Key Regulatory Guidance Referenced
This Policy has been developed with reference to, and should be interpreted consistently with, the following regulatory guidance documents:
(a) EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (version 2.0, adopted 18 June 2021). These Recommendations establish a six-step methodology for assessing international data transfers and identifying supplementary measures, and form the basis for the TIA methodology set out in Section 7 of this Policy.
(b) EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures (adopted 10 November 2020). These Recommendations provide the framework for assessing whether the legal framework of a destination country provides adequate safeguards against disproportionate surveillance and government access to personal data.
(c) ICO international transfer risk assessment and tool guidance, including the ICO's Transfer Risk Assessment tool and associated guidance on assessing the level of protection in destination countries.
(d) ICO Approved Addendum under Section 119A DPA 2018 (the "UK Addendum"), which may be appended to the EU Standard Contractual Clauses to extend their application to transfers governed by the UK GDPR.
(e) European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (the "EU SCCs").
3.4 Post-Brexit Dual Regime Requirements
The NTP Group operates under both the UK GDPR and the EU GDPR simultaneously. This dual-regime position arises from the NTP Group's establishment and operations in both the UK (through NTP PLC) and the EU (through its five EU subsidiaries).
The practical consequence of this dual-regime position for international data transfers is as follows:
(a) Transfers of personal data originating from NTP PLC's UK operations to recipients in third countries are governed by the UK GDPR and must be effected pursuant to a UK-specific transfer mechanism (a UK IDTA or a UK Addendum appended to EU SCCs) or a UK adequacy regulation.
(b) Transfers of personal data originating from any of the NTP Group's EU subsidiaries (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, or Northgate Iberia S.L.) to recipients in third countries are governed by the EU GDPR and must be effected pursuant to EU SCCs, an EU adequacy decision, or another Article 46 EU GDPR mechanism.
(c) Where a single data flow involves personal data that is subject to both the UK GDPR and the EU GDPR — for example, where combined UK and EU subscriber data is transferred to a single processor in a third country — dual transfer mechanisms are required. In practice, this means that the relevant EU SCCs must be supplemented by a UK Addendum (or, alternatively, a standalone UK IDTA must also be executed) to ensure that the transfer is lawful under both regimes.
As at the effective date of this Policy, four of the NTP Group's 14 identified international transfer data flows involve personal data subject to both the UK GDPR and the EU GDPR, and dual transfer mechanisms have been implemented for each such flow.
4. DEFINITIONS
For the purposes of this Policy, the following terms shall have the meanings set out below. Terms defined in the UK GDPR or the EU GDPR shall, unless otherwise stated, bear the same meaning as in the relevant regulation.
"Adequate Country" means a country or territory in respect of which (a) the UK Secretary of State has made regulations under Section 17A of the DPA 2018 confirming that the country or territory ensures an adequate level of protection for personal data (for the purposes of the UK GDPR), and/or (b) the European Commission has adopted an adequacy decision under Article 45(3) of the EU GDPR (for the purposes of the EU GDPR).
"Controller" has the meaning given to it in Article 4(7) of the UK GDPR and Article 4(7) of the EU GDPR, namely the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
"Data Exporter" means the Controller or Processor that transfers personal data to a Data Importer in a Third Country, whether directly or through an intermediary.
"Data Importer" means the Controller or Processor in a Third Country that receives personal data from a Data Exporter, whether directly or through an intermediary.
"EEA" means the European Economic Area, comprising the EU Member States together with Iceland, Liechtenstein, and Norway.
"International Transfer" means any transfer of personal data from a Data Exporter established in the UK or the EEA to a Data Importer in a Third Country. For the purposes of this Policy, the term includes both one-off transfers and systematic, repetitive transfers, as well as onward transfers by a Processor or Sub-processor to a further recipient in a Third Country.
"Personal Data" has the meaning given to it in Article 4(1) of the UK GDPR and Article 4(1) of the EU GDPR.
"Processor" has the meaning given to it in Article 4(8) of the UK GDPR and Article 4(8) of the EU GDPR.
"Restricted Transfer" means a transfer of personal data to a recipient in a Third Country that does not benefit from an applicable adequacy decision and that therefore requires an appropriate safeguard under Article 46 of the UK GDPR or Article 46 of the EU GDPR (or, in limited circumstances, a derogation under Article 49).
"Special Category Data" means the categories of personal data listed in Article 9(1) of the UK GDPR and Article 9(1) of the EU GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation.
"Standard Contractual Clauses (SCCs)" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, including Modules 1 through 4 as applicable.
"Sub-processor" means any Processor engaged by another Processor (the primary Processor) to carry out processing activities on behalf of the Controller.
"Supplementary Measures" means the additional technical, contractual, and/or organisational measures identified through a Transfer Impact Assessment as necessary to ensure that the level of protection for personal data transferred to a Third Country is essentially equivalent to that guaranteed within the UK and/or the EEA.
"Third Country" means any country or territory outside the UK and/or the EEA, as the context requires.
"Transfer Impact Assessment (TIA)" means the documented assessment conducted by the Data Exporter, in accordance with the methodology set out in Section 7 of this Policy, to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data and to identify any Supplementary Measures required.
"UK Addendum" means the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, approved by the ICO under Section 119A of the DPA 2018 and laid before Parliament on 2 February 2022 (coming into force on 21 March 2022), which may be appended to the EU SCCs to adapt them for use in connection with transfers governed by the UK GDPR.
"UK IDTA" means the International Data Transfer Agreement issued by the ICO, a standalone UK-specific transfer mechanism for restricted transfers of personal data from the UK to Third Countries, approved under Section 119A of the DPA 2018.
5. ROLES AND RESPONSIBILITIES
5.1 Data Protection Officer — Sanjay Mehta
Sanjay Mehta, CIPP/E, is the designated Data Protection Officer ("DPO") of the NTP Group, having been appointed to the role in March 2019 in accordance with Articles 37–39 of the UK GDPR and Articles 37–39 of the EU GDPR. The DPO reports functionally to the General Counsel and has a dotted-line reporting relationship to the Audit & Risk Committee of the Board of Directors of NTP PLC.
The DPO has the following responsibilities in relation to this Policy:
(a) Overall ownership of this Policy, including responsibility for its maintenance, communication, and periodic review.
(b) Maintenance of the International Transfers Register, including ensuring that all international data transfer flows are accurately recorded, that transfer mechanisms are correctly identified, and that review dates are tracked.
(c) Approval of new international transfers. No new international data transfer may be initiated by any NTP Group entity without the prior written approval of the DPO, following completion of the transfer mechanism selection process and, where applicable, the Transfer Impact Assessment process set out in this Policy.
(d) Review and sign-off of all Transfer Impact Assessments, including annual reassessments.
(e) Provision of an annual compliance report to the General Counsel and, through the General Counsel, to the Audit & Risk Committee of the Board, covering the status of international transfer compliance across the NTP Group, including TIA outcomes, transfer register status, incidents, and regulatory developments.
(f) Acting as the primary point of contact for the ICO and the DPC in relation to international transfer compliance matters, in coordination with the General Counsel.
(g) Monitoring regulatory developments that may affect international data transfers, including new adequacy decisions, revocations, CJEU judgments, EDPB guidance, and ICO announcements, and initiating trigger-based reviews as necessary.
5.2 General Counsel — Fiona Gallagher
Fiona Gallagher, General Counsel & Company Secretary of NTP PLC, has the following responsibilities in relation to this Policy:
(a) Serving as the escalation point for high-risk, novel, or contentious international data transfers, including any transfer where the TIA identifies a residual risk that cannot be adequately mitigated through Supplementary Measures.
(b) Oversight of the contractual mechanisms supporting international data transfers, including the review, negotiation, and execution of Standard Contractual Clauses, UK IDTAs, UK Addenda, and Data Processing Agreements with processors and sub-processors.
(c) Liaison with external counsel (Calderwood & Harkness LLP) in relation to complex transfer mechanism issues, regulatory inquiries, and enforcement proceedings, including the ongoing DPC inquiry (IN-22-11-3).
(d) Approval of this Policy and any material amendments thereto.
(e) Reporting to the Board of Directors and the Audit & Risk Committee on material international transfer risks and compliance matters.
5.3 Chief Information Security Officer — Thomas Okoye
Thomas Okoye, Chief Information Security Officer ("CISO") of NTP PLC, has the following responsibilities in relation to this Policy:
(a) Responsibility for implementing, maintaining, and monitoring the technical Supplementary Measures identified in Transfer Impact Assessments, including encryption standards, pseudonymisation techniques, access controls, and data localisation requirements.
(b) Sign-off on the technical security requirements documented in each TIA, confirming that the specified technical measures are in place and operationally effective.
(c) Ensuring that the NTP Group's information security policies and standards are aligned with the technical Supplementary Measures required for international data transfers.
(d) Providing technical input to the DPO during the TIA process, including assessment of the technical feasibility of proposed Supplementary Measures.
(e) Reporting to the DPO on any security incidents that may affect the integrity, confidentiality, or availability of personal data subject to international transfers.
5.4 Head of EU Operations — Marcus Engström
Marcus Engström, Head of EU Operations, has the following responsibilities in relation to this Policy:
(a) Coordinating the compliance of the NTP Group's five EU subsidiaries with this Policy, including ensuring that each subsidiary identifies, documents, and escalates any international data transfer flows in accordance with the procedures set out herein.
(b) Serving as the liaison point with the DPC (Ireland) in relation to EU international transfer compliance matters, in consultation with the DPO and the General Counsel.
(c) Ensuring that local legal and regulatory requirements in each EU Member State in which the NTP Group operates are taken into account in the implementation of this Policy, including any supplementary requirements imposed by national data protection laws (e.g., the German Bundesdatenschutzgesetz (BDSG)).
5.5 Business Unit Data Stewards
Each business unit within the NTP Group shall designate one or more Data Stewards. Data Stewards are responsible for:
(a) Identifying new or changed international data transfer flows within their respective business units and promptly escalating them to the DPO.
(b) Completing transfer documentation (including transfer mapping questionnaires and TIA input forms) with the support of the DPO and, where necessary, external counsel.
(c) Ensuring that personnel within their business units are aware of and comply with this Policy and the associated procedures.
(d) Participating in periodic reviews of existing international data transfers as requested by the DPO.
5.6 VP, Product & Engineering — NorthCloud — Laura Dearden
Laura Dearden, VP, Product & Engineering for the NorthCloud platform, has the following responsibilities in relation to this Policy:
(a) Ensuring that privacy-by-design principles are integrated into the development and operation of the NorthCloud platform, with specific reference to international data transfer requirements.
(b) Coordinating with engineering teams on the implementation of technical safeguards for international data transfers involving NorthCloud platform data, including encryption, pseudonymisation, and data localisation measures.
(c) Notifying the DPO of any proposed changes to the NorthCloud platform architecture, hosting arrangements, or data processing operations that may create new or altered international data transfer flows.
5.7 Head of People & HR — Philippa Crane
Philippa Crane, Head of People & HR, has the following responsibilities in relation to this Policy:
(a) Responsibility for HR-related international data transfers, including transfers of expatriate payroll data, employee records, and recruitment data to recipients outside the UK and/or the EEA.
(b) Ensuring that employment contracts and privacy notices provided to NTP Group employees and job applicants accurately reflect the NTP Group's international data transfer practices and the applicable transfer mechanisms.
(c) Coordinating with the DPO in relation to TIAs for HR-related international transfers, including the transfer of expatriate payroll data to Sunderland-Hayes Payroll Services Inc. in the United States.
6. TRANSFER MECHANISM SELECTION — DECISION TREE
6.1 Overview. A structured, sequential decision tree must be followed before any international transfer of personal data is initiated or continued by any NTP Group entity. This decision tree is designed to ensure that the appropriate transfer mechanism is identified and implemented for each international data transfer, in accordance with the requirements of the UK GDPR and/or the EU GDPR, as applicable.
The decision tree applies to:
(a) All proposed new international data transfers, regardless of volume, sensitivity, or frequency.
(b) All periodic reassessments of existing international data transfers, which must be conducted at least annually in accordance with Section 13 of this Policy.
(c) Any material change to an existing international data transfer, including a change in the identity of the Data Importer, the destination country, the categories of personal data transferred, the categories of data subjects affected, or the purposes for which the data is transferred.
The decision tree comprises seven sequential steps, each of which is described in detail below. A visual flow chart summarising the decision tree is included as Appendix A to this Policy.
6.2 Step 1: Identify Whether the Transfer Is a "Restricted Transfer"
The first step in the decision tree is to determine whether the proposed or existing transfer of personal data constitutes a "Restricted Transfer" within the meaning of this Policy and the applicable data protection legislation.
(a) Identify the location of the recipient. Determine whether the recipient of the personal data (the Data Importer) is located in a country or territory outside the UK and/or the EEA.
(b) If the recipient is located within the UK or the EEA: The transfer does not constitute a Restricted Transfer and does not fall within the scope of this Policy. However, the transfer must be documented in the NTP Group's ROPA and must comply with all other applicable provisions of the UK GDPR and/or the EU GDPR (including, where applicable, the requirement for a Data Processing Agreement under Article 28).
(c) If the recipient is located outside the UK and/or the EEA: The transfer is potentially a Restricted Transfer. Proceed to Step 2.
6.3 Step 2: Determine Applicable Regime(s)
Where the transfer is identified as a potential Restricted Transfer, the second step is to determine which data protection regime or regimes apply to the transfer.
(a) If the personal data originates from NTP PLC (UK operations): The UK GDPR applies to the transfer. The transfer must be effected pursuant to a UK-specific transfer mechanism (UK IDTA, UK Addendum, or UK adequacy regulation) or, in limited circumstances, a derogation under Article 49 UK GDPR.
(b) If the personal data originates from any of the NTP Group's EU subsidiaries (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, or Northgate Iberia S.L.): The EU GDPR applies to the transfer. The transfer must be effected pursuant to EU SCCs, an EU adequacy decision, another Article 46 EU GDPR mechanism, or a derogation under Article 49 EU GDPR.
(c) If the personal data is subject to both regimes — for example, where combined UK and EU subscriber data is transferred to a single processor, or where a data set contains personal data collected under both the UK GDPR and the EU GDPR — both regimes apply, and dual transfer mechanisms are required. In such cases, the relevant EU SCCs must be supplemented by a UK Addendum (or a standalone UK IDTA must also be executed alongside the EU SCCs) to ensure compliance under both regimes.
Proceed to Step 3.
6.4 Step 3: Check for Adequacy Decision
The third step is to determine whether the destination country or territory benefits from an adequacy decision under the applicable regime(s).
UK adequacy regulations: The DPO shall check the ICO-maintained list of countries and territories that benefit from UK adequacy regulations made by the UK Secretary of State under Section 17A of the DPA 2018. As at the effective date of this Policy, the UK has made adequacy regulations for a number of countries and territories, which are published on the ICO's website and updated from time to time.
EU adequacy decisions: The DPO shall check the list of countries and territories for which the European Commission has adopted adequacy decisions under Article 45 of the EU GDPR. As at the effective date of this Policy, adequacy decisions are in place for a number of countries and territories, including (but not limited to) Japan, Canada (for organisations subject to the Personal Information Protection and Electronic Documents Act ("PIPEDA")), and the United States (for organisations certified under the EU-US Data Privacy Framework).
The following NTP Group transfers currently rely on adequacy decisions:
If an adequacy decision exists and covers the relevant transfer: Document the reliance on the adequacy decision in the International Transfers Register and in the ROPA. No SCCs, UK IDTA, or UK Addendum is required as a legal prerequisite. However, as a matter of best practice, the DPO should consider whether a TIA should nonetheless be conducted, particularly where the adequacy decision is subject to ongoing review or potential legal challenge. Proceed to Step 7 (documentation).
If no adequacy decision exists for the destination country or territory: Proceed to Step 4.
6.5 Step 4: Select Appropriate Transfer Mechanism
Where no adequacy decision is available, the Data Exporter must select and implement an appropriate transfer mechanism from the following options. The DPO, in consultation with the General Counsel, shall determine the most appropriate mechanism for each transfer, having regard to the nature of the transfer, the identity and status of the parties, the applicable regime(s), and the operational context.
Option A — EU Standard Contractual Clauses (SCCs). The EU SCCs, adopted by the European Commission under Implementing Decision (EU) 2021/914, are the primary transfer mechanism for transfers governed by the EU GDPR. The EU SCCs are structured as a modular instrument comprising four modules, each tailored to a specific transfer scenario:
Module 1: Controller to Controller. For use where both the Data Exporter and the Data Importer are acting as independent Controllers. This module governs the obligations of the parties when personal data is transferred from one Controller to another Controller in a Third Country.
Module 2: Controller to Processor. For use where the Data Exporter is acting as a Controller and the Data Importer is acting as a Processor. This is the most commonly used module within the NTP Group. Module 2 is currently used for the NTP PLC → Caldwell Analytics Inc. transfers (network analytics data).
Module 3: Processor to Sub-processor. For use where the Data Exporter is acting as a Processor and the Data Importer is acting as a Sub-processor. Module 3 is currently used for the Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd and Pinnacle Cloud Services Ltd → Pinnacle APAC Pte Ltd transfers (infrastructure support and monitoring data).
Module 4: Processor to Controller. For use where the Data Exporter is acting as a Processor and the Data Importer is acting as a Controller (i.e., a "reverse transfer" scenario). This module is not currently in use within the NTP Group.
As at the effective date of this Policy, seven (7) of the NTP Group's 14 identified international transfer data flows are governed by EU SCCs.
Option B — UK International Data Transfer Agreement (UK IDTA). The UK IDTA is a standalone, ICO-approved transfer mechanism for restricted transfers of personal data from the UK to Third Countries. The UK IDTA is a mandatory-form document published by the ICO under Section 119A of the DPA 2018, and its terms may not be amended or varied, save for the completion of the specified mandatory fields.
The UK IDTA comprises four parts:
Part 1: Parties, key contacts, and roles.
Part 2: Transfer details, including the categories of personal data, data subjects, and purposes.
Part 3: Security requirements, including technical and organisational security measures.
Part 4: Termination and end-of-transfer provisions.
The UK IDTA is used where a transfer is governed exclusively by the UK GDPR and the Data Exporter elects not to use the UK Addendum appended to EU SCCs. As at the effective date of this Policy, three (3) of the NTP Group's international transfer data flows are governed by UK IDTAs (transfers to the United States, India, and Singapore where the data originates exclusively from NTP PLC's UK operations).
Option C — UK Addendum to EU SCCs. The UK Addendum is an ICO-approved addendum that may be appended to the EU SCCs to adapt them for use in connection with transfers governed by the UK GDPR. The UK Addendum was approved under Section 119A of the DPA 2018, was laid before Parliament on 2 February 2022, and came into force on 21 March 2022.
The UK Addendum is the preferred mechanism where a single international data transfer involves personal data subject to both the UK GDPR and the EU GDPR, as it allows the NTP Group to use a single set of EU SCCs supplemented by the UK Addendum, rather than executing a separate standalone UK IDTA alongside the EU SCCs.
As at the effective date of this Policy, four (4) of the NTP Group's international transfer data flows are governed by EU SCCs supplemented by a UK Addendum. The NTP Group has a pre-prepared template UK Addendum with NTP-specific pre-populated fields, which is maintained by the General Counsel's office and is available for use by all NTP Group entities.
Option D — Binding Corporate Rules (BCRs). Binding Corporate Rules are internal rules adopted by a group of undertakings for the purpose of providing adequate safeguards for intra-group transfers of personal data to Third Countries. BCRs must be approved by the competent supervisory authority (or, in the case of the EU GDPR, through the consistency mechanism involving the lead supervisory authority and the EDPB).
The NTP Group has not currently adopted Binding Corporate Rules. However, the adoption of BCRs may be considered in the future if the volume and complexity of intra-group transfers to Third Countries increases to a level that would make BCRs a more efficient and administratively proportionate mechanism than the use of individual SCCs and/or UK IDTAs for each intra-group transfer. Any future BCR application would require ICO and/or lead supervisory authority (DPC) approval and would involve a substantial investment of time and resources.
Option E — Derogations (Article 49 UK GDPR / Article 49 EU GDPR). In strictly limited circumstances, a Restricted Transfer may be made on the basis of a derogation under Article 49 of the UK GDPR or Article 49 of the EU GDPR, without the need for an Article 46 transfer mechanism. The available derogations include:
(a) Explicit consent of the data subject, provided after being informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.
(b) Contract performance: The transfer is necessary for the performance of a contract between the data subject and the Controller, or for the implementation of pre-contractual measures taken at the data subject's request.
(c) Important public interest: The transfer is necessary for important reasons of public interest recognised in UK law or, in the case of EU GDPR, in Union or Member State law.
(d) Legal claims: The transfer is necessary for the establishment, exercise, or defence of legal claims.
(e) Vital interests: The transfer is necessary to protect the vital interests of the data subject or other persons, where the data subject is physically or legally incapable of giving consent.
Derogations must not be used as a primary or systematic transfer mechanism. They are intended only for non-repetitive, occasional transfers where no other mechanism is available or feasible. Any proposed reliance on a derogation requires the prior written approval of the DPO on a case-by-case basis, in accordance with the procedures set out in Section 12 of this Policy.
6.6 Step 5: Conduct Transfer Impact Assessment (TIA)
A Transfer Impact Assessment must be conducted for all Restricted Transfers relying on SCCs, a UK IDTA, or a UK Addendum. A TIA is also recommended as best practice for transfers relying on an adequacy decision, particularly where the adequacy decision is subject to ongoing review or potential legal challenge.
The TIA methodology is set out in detail in Section 7 of this Policy. No Restricted Transfer may be initiated or continued unless a TIA has been completed, has concluded that the transfer can proceed (with or without Supplementary Measures), and has been signed off by the DPO.
6.7 Step 6: Implement Supplementary Measures (if required by TIA)
Where the TIA identifies gaps in the level of protection in the destination country, the Data Exporter must implement Supplementary Measures to bring the level of protection to an essentially equivalent standard. The framework for Supplementary Measures is set out in Section 8 of this Policy.
If the TIA concludes that no combination of Supplementary Measures is capable of ensuring essentially equivalent protection, the transfer must not be initiated or, if already in progress, must be suspended pending resolution.
6.8 Step 7: Document and Register the Transfer
Once the appropriate transfer mechanism has been selected, the TIA (if applicable) has been completed and approved, and any required Supplementary Measures have been implemented, the transfer must be fully documented and registered as follows:
(a) Record the transfer in the International Transfers Register maintained by the DPO, including all fields specified in Appendix B.