PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / LITIGATION PRIVILEGE This document is protected by legal professional privilege and litigation privilege. It has been prepared by Calderwood & Harkness LLP at the request of and for the sole benefit of Northgate Telecommunications PLC. It must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC.
TRANSFER IMPACT ASSESSMENT
TIA-002
Assessment of Transfer: Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd
Transfer Destination: India
Reference: SC/NTP/2023-0213/PDS — TIA-002
Classification: Privileged and Confidential — Attorney-Client Privileged / Litigation Privilege
Prepared for: Northgate Telecommunications PLC
Prepared by: Sara Hendricks, Lead Associate, Privacy & Data Security Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN United Kingdom
Supervised by: Rachel Bernstein, Billing Partner, Privacy & Data Security Calderwood & Harkness LLP
Date of Assessment: July 2023 (Phase 4 — Transfer Mechanisms workstream)
Version: Final (1.0)
Right-click to update Table of Contents
1. EXECUTIVE SUMMARY
This Transfer Impact Assessment ("TIA" or "Assessment") has been prepared by Calderwood & Harkness LLP ("C&H") on behalf of Northgate Telecommunications PLC ("NTP", Company Number 04837291) in connection with the transfer of personal data from Pinnacle Cloud Services Ltd ("Pinnacle" or "PCS", Company Number 09142837, registered at Apex House, 24 Victoria Embankment, London EC4Y 0DZ, United Kingdom) to Pinnacle India Pvt Ltd ("Pinnacle India", CIN U72200HR2016PTC065412, registered at Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India).
The purpose of this Assessment is to determine whether the laws and practices of the Republic of India provide an essentially equivalent level of protection to that guaranteed within the United Kingdom and the European Economic Area, as required under Articles 44 to 49 of Regulation (EU) 2016/679 (the "EU GDPR") and the equivalent provisions of the Data Protection Act 2018 and the UK General Data Protection Regulation (the "UK GDPR"), for the transfer of personal data from Pinnacle (acting as a UK-based processor on behalf of NTP) to Pinnacle India (acting as a sub-processor within Pinnacle's processing chain).
Pinnacle Cloud Services Ltd acts as a data processor for NTP under an Amended Data Processing Agreement (the "Amended DPA") executed on 28 June 2023. Pinnacle provides Infrastructure-as-a-Service ("IaaS") and Platform-as-a-Service ("PaaS") hosting for NTP's NorthCloud SaaS platform and internal enterprise systems, operating data centres in London, Frankfurt, Amsterdam, Dublin, and Stockholm. Pinnacle India Pvt Ltd is a sub-processor within Pinnacle's processing chain, providing infrastructure support and monitoring services, including remote infrastructure management, incident response support, server monitoring, patch management, network operations centre support, and technical troubleshooting for cloud infrastructure hosting NTP data.
India does not benefit from an adequacy decision under either the EU GDPR or the UK GDPR. Accordingly, the transfer of personal data from Pinnacle to Pinnacle India requires an appropriate safeguard under Article 46 GDPR and the equivalent UK GDPR provisions, supplemented where necessary by additional measures to ensure that the level of protection guaranteed by the GDPR is not undermined.
The transfer mechanism relied upon is the EU Standard Contractual Clauses ("SCCs"), specifically Module 3 (Processor to Sub-processor), as approved by European Commission Implementing Decision (EU) 2021/914, supplemented by the UK Addendum to the EU SCCs (the "UK Addendum"), as approved by the Information Commissioner's Office under Section 119A of the Data Protection Act 2018. Both mechanisms are incorporated into the Amended DPA.
Overall Conclusion: Based on the analysis set out in this Assessment, C&H concludes that the transfer from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd may proceed subject to the implementation of the supplementary measures identified in Section 6 below. The Indian legal framework presents certain risks — in particular, the breadth of government surveillance powers under Section 69 of the Information Technology Act 2000 and the absence of independent judicial oversight of interception orders — that mean India does not provide a level of data protection essentially equivalent to that guaranteed under the EU GDPR and UK GDPR. However, these risks can be mitigated to an acceptable level through the combination of technical measures (encryption, pseudonymisation, role-based access controls, privileged access management, and data localisation), organisational measures (government access request handling procedures, training, and audit rights), and contractual measures (enhanced SCC provisions, data localisation commitments, deletion timelines, and termination rights) identified herein. The supplementary measures must be fully implemented in accordance with the timelines set out in Section 7.1, and compliance must be verified through the audit process established under the Amended DPA.
This Assessment forms part of NTP's comprehensive documentation of international data transfer compliance under the Phase 4 — Transfer Mechanisms workstream and is intended to be included in NTP's response to the DPC preliminary inquiry (IN-22-11-3).
2. METHODOLOGY AND LEGAL FRAMEWORK FOR THE ASSESSMENT
2.1 Applicable Guidance
This Assessment has been prepared in accordance with the following authoritative guidance and jurisprudence:
1. EDPB Recommendations 01/2020: European Data Protection Board Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, as adopted in their final version on 18 June 2021. These Recommendations establish a six-step process for assessing and, where necessary, supplementing transfer tools to ensure that transferred personal data is afforded an essentially equivalent level of protection as that guaranteed within the EEA.
2. EDPB Recommendations 02/2020: European Data Protection Board Recommendations 02/2020 on the European Essential Guarantees for surveillance measures, adopted on 10 November 2020. These Recommendations set out four "European Essential Guarantees" against which third-country surveillance legislation should be assessed, derived from the jurisprudence of the Court of Justice of the European Union and the European Court of Human Rights.
3. ICO Guidance on International Data Transfers: Guidance issued by the Information Commissioner's Office on the requirements for international data transfers under the UK GDPR, including the ICO's transfer risk assessment tool and guidance on the use of the UK Addendum to the EU SCCs.
4. Schrems II Judgment: Judgment of the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Ltd and Maximillian Schrems (Case C-311/18), delivered on 16 July 2020 ("Schrems II"). The Schrems II judgment invalidated the EU-US Privacy Shield and confirmed that data exporters relying on Standard Contractual Clauses must assess, on a case-by-case basis, whether the law and practices of the third country of destination ensure an essentially equivalent level of protection. Where such protection is not ensured by the transfer tool alone, the data exporter must adopt supplementary measures or suspend the transfer.
5. K.S. Puttaswamy v. Union of India: Judgment of the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1, recognising the right to privacy as a fundamental right under Article 21 of the Constitution of India, which provides relevant context for the assessment of the Indian legal framework.
The Assessment follows the six-step process prescribed by EDPB Recommendations 01/2020, adapted to the specific circumstances of the transfer at issue.
2.2 Scope of Assessment
The scope of this Assessment encompasses:
• An assessment of the laws and practices of the Republic of India as they relate to government access to personal data, surveillance powers, the data protection framework applicable to private-sector entities, and the rule of law, including the availability of effective remedies for individuals whose personal data is accessed by government authorities.
• An assessment of whether the transfer tool relied upon (EU SCCs Module 3 supplemented by the UK Addendum) is effective in light of Indian law and practice, taking into account the specific circumstances of the transfer, the nature and sensitivity of the personal data involved, and the processing activities undertaken by Pinnacle India.
• An identification of supplementary measures necessary to ensure that the level of protection afforded to the personal data of NTP's data subjects is not undermined by the transfer to India.
This Assessment has been conducted in the context of the specific transfer at issue — namely, the provision of infrastructure support and monitoring services by Pinnacle India for Pinnacle's cloud hosting operations serving NTP. The conclusions of this Assessment are specific to this transfer and should not be applied to other transfers to India without separate analysis. Where general observations are made about the Indian legal framework, they are made in order to assess the specific risks arising in the context of this particular transfer.
The legal analysis set out in this Assessment is based on the laws and practices of India as at July 2023. In particular, we note that the Digital Personal Data Protection Act 2023 was enacted by the Indian Parliament on 11 August 2023 but is not yet in force as of the date of this Assessment, and subordinate rules necessary for its implementation have not yet been promulgated. Our analysis is therefore based primarily on the operative legal framework, being the Information Technology Act 2000 and its subordinate rules, supplemented by observations regarding the trajectory of Indian data protection law under the DPDPA.
2.3 Legal Basis for the Transfer
The legal basis relied upon for the transfer of personal data from Pinnacle Cloud Services Ltd (UK processor) to Pinnacle India Pvt Ltd (Indian sub-processor) is as follows:
EU Personal Data: Article 46(2)(c) of the EU GDPR — Standard Contractual Clauses adopted by the European Commission, specifically the EU Standard Contractual Clauses (Module 3 — Processor to Sub-processor) as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Module 3 governs the transfer of personal data from a processor established in the EU/EEA (or subject to EU GDPR jurisdiction) to a sub-processor in a third country.
UK Personal Data: The UK Addendum to the EU SCCs, as approved by the Information Commissioner under Section 119A of the Data Protection Act 2018, dated 21 March 2022 (version B.1.0). The UK Addendum adapts the EU SCCs for use in connection with transfers of personal data subject to the UK GDPR.
Both the EU SCCs (Module 3) and the UK Addendum are incorporated into the Amended Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd, executed on 28 June 2023. Pinnacle India Pvt Ltd is identified as an approved sub-processor in Annex III to the EU SCCs and in Schedule 4 to the Amended DPA. The sub-processor approval mechanism set out in Clause 9 of the EU SCCs and Section 7 of the Amended DPA has been followed in respect of Pinnacle India's engagement.
Pinnacle Cloud Services Ltd has entered into a back-to-back sub-processing agreement with Pinnacle India Pvt Ltd that incorporates the relevant obligations of the EU SCCs and the UK Addendum, thereby ensuring that the protections afforded by the transfer mechanism are extended through the entire processing chain.
3. STEP 1 — KNOW YOUR TRANSFER
3.1 Data Exporter
Pinnacle Cloud Services Ltd acts as a data processor for NTP pursuant to the Amended DPA. In this capacity, Pinnacle processes personal data on behalf of NTP in accordance with NTP's documented instructions as set out in the Amended DPA and its schedules. For the purposes of the EU SCCs (Module 3), Pinnacle is the data exporter, transferring personal data to Pinnacle India in its capacity as a sub-processor.
It should be noted that Pinnacle's role as data exporter in this context arises from its position in the processing chain. NTP, as the data controller, has authorised the use of Pinnacle India as a sub-processor through the sub-processor approval mechanism in the Amended DPA. NTP retains ultimate responsibility under Article 28 GDPR and the equivalent UK GDPR provision for ensuring that adequate safeguards are in place for transfers to sub-processors in third countries.
3.2 Data Importer
Pinnacle India Pvt Ltd is a private limited company incorporated under Indian law and is a wholly-owned subsidiary of Pinnacle Global Holdings Ltd (incorporated in the British Virgin Islands), which is in turn the parent company of the Pinnacle group of companies, including Pinnacle Cloud Services Ltd. Pinnacle India functions as a sub-processor within Pinnacle's processing chain, providing the following services in relation to the cloud infrastructure hosting NTP data:
(a) Remote infrastructure management, including configuration management, capacity planning support, and infrastructure health monitoring;
(b) Incident response support, including triage, diagnosis, and resolution of infrastructure incidents affecting the availability, performance, or integrity of Pinnacle's cloud hosting environment;
(c) Server monitoring, including continuous 24/7 monitoring of server health, performance metrics, and alerting;
(d) Patch management, including the testing, scheduling, and deployment of security patches and software updates to server and network infrastructure;
(e) Network operations centre ("NOC") support, including monitoring of network connectivity, latency, throughput, and security events; and
(f) Technical troubleshooting for cloud infrastructure hosting NTP data, including root cause analysis of infrastructure failures and performance degradation events.
Pinnacle India's operations relevant to this Assessment are conducted from its facility at Tower B, Cyber City, Gurugram, Haryana, India. Personnel providing the services described above access Pinnacle's UK/EU data centre infrastructure remotely from this location.
3.3 Categories of Data Subjects
The personal data accessible to Pinnacle India in the course of providing the services described in Section 3.2 relates to the following categories of data subjects:
(a) NTP consumer subscribers: NTP provides fixed-line, mobile, and broadband telecommunications services to consumer subscribers across the United Kingdom and the Republic of Ireland. The total number of consumer subscribers whose data may be hosted on Pinnacle infrastructure is approximately 6.3 million.
(b) NTP enterprise clients: NTP provides managed telecommunications and cloud services to enterprise clients. The total number of enterprise client entities whose data may be hosted on Pinnacle infrastructure is approximately 42,000.
(c) NTP employees: NTP employs approximately 11,400 individuals globally, of whom approximately 8,200 are based in the United Kingdom or the European Union. Employee data is stored on NTP's internal enterprise systems, which are hosted on Pinnacle infrastructure.
(d) Contractors, temporary workers, and other individuals: NTP engages contractors, temporary workers, consultants, and other individuals whose personal data may be stored on NTP's internal enterprise systems hosted by Pinnacle.
It is important to note that Pinnacle India personnel access infrastructure support data in the course of providing the services described in Section 3.2. The data transiting to or accessible from India relates primarily to system logs, server metadata, and — in the context of incident response and troubleshooting — incidental access to hosted databases containing personal data. Pinnacle India personnel do not routinely access the full content of NTP's subscriber, enterprise client, or employee databases, but the nature of infrastructure support work means that such access cannot be entirely excluded, particularly during troubleshooting of complex infrastructure incidents.
3.4 Categories of Personal Data Transferred
The categories of personal data that may be transferred to or accessed from India by Pinnacle India personnel in the course of providing the services described in Section 3.2 are as follows:
(a) System and application logs: Log files generated by servers, applications, and network devices within Pinnacle's UK/EU data centre infrastructure, which may contain IP addresses, user identifiers, timestamps, session data, authentication events, and error messages.
(b) Infrastructure monitoring data: Performance metrics, health indicators, alerting data, and capacity utilisation data relating to Pinnacle's UK/EU data centre infrastructure, which may include metadata relating to data subjects (e.g., connection counts, session identifiers, traffic volumes).
(c) Incidental access to hosted databases: During troubleshooting and incident response, Pinnacle India personnel may access hosted databases containing personal data of NTP's data subjects, which may include:
(i) subscriber names, email addresses, telephone numbers, account identifiers, and billing information;
(ii) network usage data, including call detail records, data usage records, and device identifiers;
(iii) enterprise client contact information and service configuration data; and
(iv) any other personal data stored within NTP's NorthCloud SaaS platform and accessible through the Pinnacle hosting infrastructure.
(d) Employee data: Personal data stored on NTP's internal enterprise systems hosted by Pinnacle, including employee names, employee identification numbers, email addresses, human resources records, payroll data, and performance management data.
(e) Special category data: There is potential for incidental access to employee health data stored within NTP's HR systems (e.g., occupational health records, sickness absence records, disability-related adjustments). Access controls at the network and application layer are designed to prevent routine access by Pinnacle India personnel to HR databases containing health data; however, the possibility of incidental access during infrastructure-level troubleshooting cannot be entirely excluded.
3.5 Frequency and Nature of Transfer
The transfer of personal data from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd is ongoing and continuous in nature. Pinnacle India personnel access Pinnacle's UK/EU data centre infrastructure remotely on a 24/7 basis for the purpose of monitoring, incident response, and support activities.
The primary mode of data transfer is remote access: Pinnacle India personnel located in Gurugram, India, connect to Pinnacle's UK/EU data centre infrastructure (located in London, Frankfurt, Amsterdam, and Dublin) via secure, encrypted remote access connections. Under this model, personal data is not routinely copied to or stored on systems located in India. Rather, Pinnacle India personnel view, query, and interact with data hosted on Pinnacle's UK/EU infrastructure through remote desktop, SSH, and other remote management protocols.
However, during incident response and troubleshooting, it is sometimes necessary for Pinnacle India personnel to download data extracts — including log files, database snapshots, configuration dumps, and diagnostic outputs — to local systems in India for analysis. Such temporary data extracts may contain personal data of NTP's data subjects. Under the provisions of the Amended DPA and the sub-processing agreement between Pinnacle and Pinnacle India, such temporary data extracts are required to be encrypted at rest on Pinnacle India systems, and must be securely deleted within 72 hours of resolution of the relevant incident.
The data flow can therefore be summarised as follows:
Primary Flow: NTP personal data (hosted in Pinnacle UK/EU data centres in London, Frankfurt, Amsterdam, and Dublin) → accessed remotely by Pinnacle India personnel located in Gurugram, India, via encrypted connections.
Secondary Flow (Incident Response): Temporary data extracts (log files, database snapshots, diagnostic data) → downloaded to Pinnacle India systems in Gurugram → encrypted at rest → securely deleted within 72 hours of incident resolution.
Both the primary flow (remote access) and the secondary flow (temporary download) constitute a transfer of personal data to a third country within the meaning of Chapter V of the GDPR and the equivalent provisions of the UK GDPR, as confirmed by the EDPB's guidance that remote access from a third country constitutes a transfer.
3.6 Onward Transfers
Based on representations provided by Pinnacle Cloud Services Ltd (via Graham Alderton, Head of Legal, Cloud Services Division), no onward transfers of NTP personal data from Pinnacle India to further sub-processors or other third countries have been identified. Pinnacle India does not engage further sub-processors in connection with the services it provides to Pinnacle in respect of NTP data.
All access to NTP personal data by Pinnacle India personnel occurs from within Indian territory (specifically, from Pinnacle India's facility in Gurugram, Haryana). As noted above, this access constitutes a transfer under GDPR/UK GDPR, and is the transfer that is the subject of this Assessment.
The sub-processing agreement between Pinnacle and Pinnacle India prohibits onward transfers of NTP personal data without the prior specific written authorisation of Pinnacle Cloud Services Ltd, which in turn requires the prior authorisation of NTP under the Amended DPA.
3.7 Retention. Pinnacle India does not maintain permanent copies of NTP personal data. As described in Section 3.5 above, the primary mode of access is remote access to systems hosted in Pinnacle's UK/EU data centres, and any temporary data extracts created during incident response must be securely deleted within 72 hours of incident resolution.
The specific data retention arrangements are as follows:
(a) Temporary data extracts (incident response): To be encrypted at rest on Pinnacle India systems using AES-256 encryption and securely deleted within 72 hours of resolution of the relevant incident. Deletion must be verified through automated deletion processes with audit trail, and Pinnacle India must confirm deletion to Pinnacle Cloud Services Ltd in writing.
(b) Log data accessed remotely: Log data remains on Pinnacle's UK/EU infrastructure and is retained in accordance with NTP's data retention schedule as set out in Schedule 3 to the Amended DPA. Pinnacle India does not independently retain copies of log data accessed remotely, except to the extent that temporary extracts are created during incident response (in which case the 72-hour deletion requirement applies).
(c) No permanent storage in India: The sub-processing agreement between Pinnacle and Pinnacle India expressly prohibits the permanent storage of NTP personal data on systems located in India.
4. STEP 2 — IDENTIFY THE TRANSFER TOOL
4.1 Transfer Mechanism
The transfer tool relied upon for the transfer of personal data from Pinnacle Cloud Services Ltd to Pinnacle India Pvt Ltd is as follows:
For EU personal data: EU Standard Contractual Clauses — Module 3 (Processor to Sub-processor), as set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Module 3 is the appropriate module for transfers from a data processor established in the EU/EEA (or otherwise subject to EU GDPR jurisdiction) to a sub-processor established in a third country.
The EU SCCs (Module 3) are incorporated into the Amended Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd, executed on 28 June 2023. The SCCs are set out in full in Schedule 5 to the Amended DPA, with the Annexes completed as follows:
• Annex I (List of parties, description of transfer, competent supervisory authority): Completed with the details of Pinnacle Cloud Services Ltd as data exporter and Pinnacle India Pvt Ltd as data importer, the description of the transfer as set out in Section 3 of this Assessment, and the Data Protection Commission (Ireland) as the competent supervisory authority.
• Annex II (Technical and organisational measures): Completed with a description of the technical and organisational security measures implemented by Pinnacle India, including the supplementary measures identified in this Assessment.
• Annex III (List of sub-processors): Lists Pinnacle India Pvt Ltd as the sole sub-processor engaged in respect of NTP data, with the details and scope of processing described in Section 3.2 of this Assessment.
For UK personal data: The UK Addendum to the EU SCCs, as approved by the Information Commissioner under Section 119A of the Data Protection Act 2018, dated 21 March 2022 (version B.1.0). The UK Addendum is appended to the EU SCCs and adapts the clauses for use in connection with transfers of personal data subject to the UK GDPR. The UK Addendum is set out in Schedule 5A to the Amended DPA.
Sub-processor authorisation: Pinnacle India Pvt Ltd is listed as an approved sub-processor in Annex III of the EU SCCs and in Schedule 4 of the Amended DPA. NTP has authorised Pinnacle's engagement of Pinnacle India as a sub-processor through the sub-processor authorisation mechanism set out in Section 7 of the Amended DPA and Clause 9 of the EU SCCs.
Sub-processing agreement: Pinnacle Cloud Services Ltd has entered into a back-to-back sub-processing agreement with Pinnacle India Pvt Ltd (the "Sub-Processing Agreement") that incorporates the relevant obligations of the EU SCCs and the UK Addendum. The Sub-Processing Agreement imposes on Pinnacle India the same data protection obligations as those imposed on Pinnacle under the Amended DPA with NTP, thereby ensuring continuity of protection through the processing chain.
4.2 Contractual Protections
In addition to the protections afforded by the EU SCCs and the UK Addendum, the following contractual protections are in place:
Processing instructions: Pinnacle India is bound by the processing instructions received from Pinnacle Cloud Services Ltd. These instructions are in turn governed by NTP's documented instructions as set out in the Amended DPA and its schedules. Pinnacle India is prohibited from processing NTP personal data for any purpose other than the provision of infrastructure support and monitoring services as described in Section 3.2 of this Assessment, and must not process NTP personal data in a manner that exceeds or is inconsistent with NTP's documented instructions.
Audit rights: NTP retains the right to audit Pinnacle and its sub-processors, including Pinnacle India, in respect of compliance with data protection obligations under the Amended DPA and the EU SCCs. Audits may be conducted by NTP directly or by an independent third-party auditor appointed by NTP. The frequency of routine audits is limited to no more than once per 12-month period, unless an audit is triggered by a specific incident, data breach, or regulatory inquiry, in which case NTP may conduct ad hoc audits at any time upon reasonable notice. Pinnacle India is required to cooperate fully with any audit and to provide access to its facilities, systems, and personnel.
Breach notification: Pinnacle India is required to notify Pinnacle Cloud Services Ltd without undue delay, and in any event within 36 hours of becoming aware of a personal data breach affecting NTP personal data. Pinnacle Cloud Services Ltd is in turn required to notify NTP of any personal data breach without undue delay under the Amended DPA, enabling NTP to comply with its own notification obligations to the relevant supervisory authority and affected data subjects under Articles 33 and 34 GDPR.
Data deletion and return: Upon termination of the Sub-Processing Agreement or upon instruction from Pinnacle Cloud Services Ltd, Pinnacle India is required to securely delete all NTP personal data in its possession and to certify such deletion in writing. As noted in Section 3.7, Pinnacle India does not maintain permanent copies of NTP personal data, and temporary data extracts must be deleted within 72 hours of incident resolution.
Confidentiality obligations: All Pinnacle India personnel with access to NTP personal data are subject to contractual confidentiality obligations. Pinnacle India must ensure that its personnel have received appropriate training on data protection and are aware of their obligations in respect of the processing of NTP personal data.
5. STEP 3 — ASSESS THE LAWS AND PRACTICES OF INDIA
5.1 Overview of India's Data Protection Legal Framework
5.1.1 Information Technology Act 2000 (IT Act). The Information Technology Act 2000 (the "IT Act") is the principal legislation governing electronic data and information technology in India. Originally enacted to provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, the IT Act has been amended on multiple occasions (most significantly by the Information Technology (Amendment) Act 2008) and now serves as the primary legal framework for data protection and cybersecurity in India, pending full implementation of the Digital Personal Data Protection Act 2023.
The key provisions of the IT Act relevant to this Assessment are:
Section 43A imposes an obligation on bodies corporate that possess, deal with, or handle any sensitive personal data or information in a computer resource which they own, control, or operate to implement and maintain reasonable security practices and procedures. Where a body corporate is negligent in implementing and maintaining reasonable security practices and procedures, and such negligence causes wrongful loss or wrongful gain to any person, the body corporate shall be liable to pay damages by way of compensation to the affected person. This provision is of relevance to Pinnacle India as a body corporate possessing or handling personal data in computer resources.
The term "sensitive personal data or information" is defined not in the IT Act itself but in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (the "SPDI Rules"), discussed in Section 5.1.2 below. Notably, the definition of sensitive personal data under the SPDI Rules is narrower than the concept of "special categories of personal data" under Article 9 GDPR — for example, the SPDI Rules do not include racial or ethnic origin, political opinions, trade union membership, or genetic data within the definition of sensitive personal data.
Section 72A criminalises the disclosure of personal information in breach of a lawful contract. Any person, including an intermediary, who has secured access to any material containing personal information about another person, under the terms of a lawful contract, and discloses such material to any other person without the consent of the person concerned, or in breach of a lawful contract, shall be punished with imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees (INR 500,000), or with both. This provision provides a degree of legal protection against unauthorised disclosure of personal data by service providers such as Pinnacle India, although its scope is limited to disclosures in breach of contract and it does not provide a comprehensive data protection framework.
5.1.2 IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules). The SPDI Rules were promulgated under Section 43A of the IT Act and constitute the most detailed data protection regulation currently in force in India. The key provisions relevant to this Assessment are:
Privacy policies: Rule 4 requires bodies corporate that collect, receive, possess, store, deal with, or handle information of a provider of information to publish a privacy policy on their website, setting out clear and accessible statements of the types of personal information or sensitive personal data collected and the purposes of collection and usage.
Consent: Rule 5 requires bodies corporate to obtain consent from the provider of information prior to the collection of sensitive personal data or information, and to ensure that the information is collected for a lawful purpose connected with a function or activity of the body corporate.
Reasonable security practices: Rule 8 provides that a body corporate or a person on its behalf shall be considered to have complied with reasonable security practices and procedures if it has implemented security practices and standards that are certified or audited by an independent auditor approved by the Central Government. The International Standard IS/ISO/IEC 27001 on "Information Technology — Security Techniques — Information Security Management Systems — Requirements" is specifically identified as an acceptable security standard.
Cross-border transfer: Rule 7 addresses the transfer of sensitive personal data or information. Such data may be transferred to any other body corporate or person in India or located in any other country that ensures the same level of data protection that is adhered to by the transferring body corporate, provided that the transfer is necessary for the performance of a lawful contract between the body corporate or any person on its behalf and the provider of information, or where the provider of information has consented to the transfer.
The SPDI Rules have been criticised for their limited scope (covering only sensitive personal data, not all personal data), their age (having been enacted in 2011, well before the GDPR), and their limited enforcement history. They were not designed to achieve equivalence with the GDPR and do not provide the comprehensive protections, independent supervisory authority, or individual rights framework that characterise the EU/UK data protection regime.
5.1.3 Digital Personal Data Protection Act 2023 (DPDPA). The Digital Personal Data Protection Act 2023 (the "DPDPA") was enacted by the Indian Parliament on 11 August 2023 and received Presidential assent on the same date. The DPDPA represents a significant milestone in the evolution of India's data protection framework, establishing for the first time a comprehensive, dedicated data protection statute.
As at the date of this Assessment (July 2023), the DPDPA had been passed by the Lok Sabha (House of the People) but had not yet received final parliamentary approval. In any event, even following enactment, the DPDPA will not become operative until subordinate rules are promulgated by the Central Government, and a phased implementation is expected. Accordingly, the DPDPA is not yet in force and cannot be relied upon as operative law for the purposes of this Assessment. However, the trajectory represented by the DPDPA is noted as a positive indicator for the development of India's data protection framework.
Key features of the DPDPA, when effective, will include:
(a) Consent requirements: Processing of personal data will require the consent of the data principal (the individual to whom the data relates), obtained through a notice clearly setting out the purposes of processing and the categories of data to be processed.
(b) Purpose limitation and data minimisation: Data fiduciaries (the equivalent of data controllers) will be required to process personal data only for the purposes for which consent was obtained, and to collect only such personal data as is necessary for those purposes.
(c) Rights of data principals: Data principals will have the right to access their personal data, the right to correction and erasure, the right to grievance redressal, and the right to nominate another individual to exercise rights in the event of death or incapacity.
(d) Obligations of data fiduciaries and data processors: Data fiduciaries will be required to implement appropriate technical and organisational measures, appoint a data protection officer (for significant data fiduciaries), conduct data protection impact assessments, and comply with data breach notification obligations.
(e) Cross-border transfers: The DPDPA adopts a "blacklist" approach to cross-border transfers — transfers of personal data outside India will be permitted to all countries except those specifically notified by the Central Government as restricted. This represents a departure from the "whitelist" (adequacy) approach under the GDPR, and the practical effect will depend on which countries, if any, the Central Government notifies as restricted.
(f) Data Protection Board of India: The DPDPA provides for the establishment of the Data Protection Board of India as the enforcement authority, with the power to impose significant monetary penalties for non-compliance.
While the DPDPA, once fully in force, will substantially strengthen India's data protection framework, it is important to note that the statute has been criticised for certain aspects, including broad exemptions for government processing, the absence of a comprehensive right to data portability, and concerns about the independence of the Data Protection Board (whose members will be appointed by the Central Government). These aspects will need to be assessed in future reassessments of this TIA once the DPDPA becomes operative.
5.1.4 Sectoral Regulations. In addition to the general data protection framework described above, certain sectoral regulations are relevant to the assessment:
Reserve Bank of India data localisation requirements: The Reserve Bank of India ("RBI") has issued directives requiring that all data relating to payment systems operated in India must be stored in India. These data localisation requirements apply to payment data processed by payment system operators and are not directly relevant to the transfer at issue in this Assessment, as Pinnacle India's role relates to infrastructure support and not the processing of payment data.
Telecommunications sector regulations: The Telecom Regulatory Authority of India ("TRAI") regulates the telecommunications sector in India. TRAI has issued various regulations and directions relating to privacy and data protection in the telecommunications context, including the Telecom Commercial Communications Customer Preference Regulations 2018. While NTP is a telecommunications service provider in the United Kingdom and Ireland, Pinnacle India does not itself provide telecommunications services in India — its role is limited to infrastructure support for Pinnacle's cloud hosting operations. Accordingly, the telecommunications-specific regulations issued by TRAI are not directly applicable to Pinnacle India's processing activities in respect of NTP data, though they provide useful context for the regulatory environment in which telecommunications-related data is handled in India.
5.2 Government Access to Personal Data — Surveillance Powers
5.2.1 Section 69 of the IT Act 2000. Section 69 of the IT Act empowers the Central Government or a State Government to direct any agency of the appropriate Government to intercept, monitor, or decrypt, or cause to be intercepted, monitored, or decrypted, any information generated, transmitted, received, or stored in any computer resource, if the Central Government or State Government is satisfied that it is necessary or expedient to do so in the interest of:
(a) the sovereignty or integrity of India;
(b) the defence of India;
(c) the security of the State;
(d) friendly relations with foreign States;
(e) public order;
(f) preventing incitement to the commission of any cognisable offence relating to the above; or
(g) for investigation of any offence.
The subscriber, intermediary, or any person in charge of a computer resource must, when called upon by the authorised agency, extend all facilities and technical assistance to provide access to, or secure access to, the computer resource for interception, monitoring, or decryption purposes. Failure to comply is punishable by imprisonment for a term which may extend to seven years, together with a fine.
The procedural safeguards applicable to interception under Section 69 are set out in the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009 (the "IT Interception Rules"). Key procedural requirements include:
(a) Written reasoned order: The order for interception must be issued in writing by the competent authority, being the Secretary in the Ministry of Home Affairs (for Central Government orders) or the Secretary of the Home Department of the relevant State Government (for State Government orders). In unavoidable circumstances, the head or next senior officer of an authorised agency may issue an interim order, but prior approval of the competent authority must be obtained within three working days.
(b) Review Committee: A Review Committee, comprising the Cabinet Secretary, the Secretary to the Government of India (Legal Affairs), and the Secretary (Telecommunications), must review every direction issued under Section 69 within seven working days of issuance. If the Review Committee is of the opinion that the direction is not in accordance with the provisions of Section 69, it may set aside the direction and order the destruction of intercepted data.
(c) Duration: Each direction for interception shall remain in force for a period not exceeding 60 days, unless renewed by the competent authority. The total period of interception shall not exceed 180 days.
(d) Destruction of records: The intercepted information must be destroyed within six months of discontinuation of the interception, unless required for functional requirements or legal proceedings.
5.2.2 Section 69A of the IT Act 2000. Section 69A of the IT Act empowers the Central Government to direct any agency of the Government, or any intermediary, to block for access by the public, or cause to be blocked for access by the public, any information generated, transmitted, received, stored, or hosted in any computer resource. This power may be exercised where the Central Government is satisfied that it is necessary or expedient to do so in the interests of the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, or public order, or for preventing incitement to the commission of any cognisable offence relating to the above.
The procedural safeguards applicable to blocking orders under Section 69A are set out in the Information Technology (Procedure and Safeguards for blocking for Access of Information by Public) Rules 2009. While Section 69A is primarily concerned with blocking of online content (rather than interception of communications or access to stored data), it is included in this Assessment for completeness, as it illustrates the breadth of governmental powers over computer resources and intermediaries in India.
5.2.3 Section 69B of the IT Act 2000. Section 69B of the IT Act empowers the Central Government to authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received, or stored in any computer resource for the purposes of cybersecurity. "Traffic data" is defined to mean any data identifying or purporting to identify any person, computer system, or computer network, or data relating to the location, type, duration, or content of communication.
The procedural safeguards applicable to monitoring under Section 69B are set out in the Information Technology (Procedure and Safeguard for Monitoring and Collecting Traffic Data or Information) Rules 2009. The competent authority for issuing orders under Section 69B is the Secretary in the Department of Information Technology, with review by a Review Committee.
Section 69B is particularly relevant to this Assessment because the data accessible to Pinnacle India includes infrastructure monitoring data, system logs, and traffic data relating to NTP's cloud hosting environment. If the Indian Government were to exercise its powers under Section 69B in respect of Pinnacle India's computer resources, it could potentially access traffic data and metadata relating to NTP data subjects.
5.2.4 Indian Telegraph Act 1885 (as amended). The Indian Telegraph Act 1885 (the "Telegraph Act") is the foundational legislation governing telecommunications in India. Despite its age, the Telegraph Act remains in force and provides the legal basis for government interception of telecommunications.
Section 5(2) of the Telegraph Act empowers the Central Government or a State Government, or any officer specially authorised by the Central Government or a State Government, to order that any message or class of messages, to or from any person or class of persons, shall not be transmitted or shall be intercepted or detained, on the occurrence of any public emergency or in the interest of public safety, provided that the Central Government or the State Government is satisfied that it is necessary or expedient so to do in the interests of:
(a) the sovereignty and integrity of India;
(b) the security of the State;
(c) friendly relations with foreign States;
(d) public order; or
(e) preventing incitement to the commission of an offence.
The procedural safeguards for lawful interception under the Telegraph Act are set out in Rule 419A of the Indian Telegraph Rules 1951, introduced in 2007. Key requirements under Rule 419A include:
(a) Designated authority: Interception orders must be issued by the Secretary in the Ministry of Home Affairs (for Central Government orders) or the Home Secretary of the relevant State Government (for State Government orders). In unavoidable circumstances, an officer not below the rank of Joint Secretary may issue orders, subject to confirmation by the competent authority within seven working days.
(b) Proportionality: The competent authority must record reasons for the interception direction and must consider whether the information sought cannot reasonably be obtained by other means.
(c) Review Committee: A Review Committee must review every interception order within seven working days. The Review Committee has the power to set aside directions that it considers not to be in accordance with the provisions of Section 5(2).
(d) Duration: Each interception order shall remain in force for a period not exceeding 60 days, unless renewed.
(e) Record keeping and destruction: Records of intercepted communications must be destroyed within two months of discontinuation of the interception, unless required for legal proceedings.
5.2.5 Code of Criminal Procedure 1973 (CrPC) / Bharatiya Nagarik Suraksha Sanhita 2023. The Code of Criminal Procedure 1973 ("CrPC") provides for various powers of investigation and evidence gathering in the context of criminal proceedings. The most relevant provisions for this Assessment are:
Section 91 (Production of Documents): Any court or officer in charge of a police station may issue a summons or written order requiring any person in whose possession or power any document or thing is believed to be to produce such document or thing. This provision could potentially be used to compel Pinnacle India to produce documents or data in its possession relating to NTP data subjects, in the context of a criminal investigation.
Sections 93 and 94 (Search Warrants): A court may issue a search warrant authorising the search of any place and the seizure of any document, parcel, or other thing, if it has reason to believe that such a search is necessary for the purposes of any investigation, inquiry, trial, or other proceeding under the CrPC. These provisions could potentially be used to conduct searches of Pinnacle India's premises and seize data stored on Pinnacle India systems.
It should be noted that the Bharatiya Nagarik Suraksha Sanhita 2023, which was enacted in December 2023, is intended to replace the CrPC. As the Sanhita was not yet enacted at the date of this Assessment, the analysis above is based on the CrPC provisions, which remain in force.
5.2.6 National intelligence Grid (NATGRID) and Central Monitoring System (CMS). In addition to the statutory interception powers described above, two government initiatives relating to surveillance and intelligence gathering are relevant to this Assessment:
Central Monitoring System (CMS): The CMS is a centralised lawful interception and monitoring system operated by the Government of India through the Centre for Development of Telematics (C-DOT) and the Telecom Enforcement Resource and Monitoring (TERM) cells of the Department of Telecommunications. The CMS enables real-time interception of communications, including voice calls, text messages, and internet data, without requiring the manual intervention of telecommunications service providers. The CMS has been operational since approximately 2013, although its full capabilities and operational scope are not publicly documented.
Concerns have been raised by civil society organisations, including the Crowne Albany Holdings and the Centre for Internet and Society, about the lack of parliamentary oversight and the absence of judicial authorisation requirements for surveillance conducted through the CMS. The CMS operates under the legal framework of Section 5(2) of the Telegraph Act and Section 69 of the IT Act, but its centralised, automated nature raises questions about whether the procedural safeguards in Rule 419A and the IT Interception Rules are effectively applied in practice.
National intelligence Grid (NATGRID): NATGRID is an intelligence database linking the databases of multiple government agencies, including the intelligence Bureau, the Research and Analysis Wing, the Central Bureau of Investigation, the Directorate of Revenue intelligence, the Enforcement Directorate, the Financial intelligence Unit, the National Investigation Agency, and various other security and law enforcement agencies. NATGRID is designed to enable cross-referencing of data from multiple sources, including immigration records, bank records, telecommunications records, and airline passenger data, for counter-terrorism and national security purposes.
While NATGRID's primary focus is on intelligence relating to security threats within India, the breadth of data sources integrated into the system and the absence of comprehensive independent oversight raise concerns about the potential for mass surveillance capabilities that could, in theory, extend to data held by private-sector entities such as Pinnacle India.
5.3 Assessment Against European Essential Guarantees
The EDPB Recommendations 02/2020 identify four European Essential Guarantees derived from the case law of the CJEU and the ECtHR, against which third-country surveillance legislation should be assessed. Each of these guarantees is assessed below in relation to the Indian legal framework.
5.3.1 Processing Based on Clear, Precise, and Accessible Rules. Standard: The limitation on the right to data protection must be provided for by law. The law itself must be sufficiently clear in its terms to give citizens an adequate indication as to the circumstances in which, and the conditions on which, public authorities are empowered to resort to any surveillance measures. The law must be accessible and its effects foreseeable.
Assessment: Section 69 of the IT Act and the IT Interception Rules 2009 provide a legal basis for government interception, monitoring, and decryption of information in computer resources. The legal provisions are published and publicly accessible. Similarly, Section 5(2) of the Telegraph Act and Rule 419A of the Telegraph Rules provide a published legal basis for interception of telecommunications.
However, the breadth of the grounds upon which interception may be authorised raises concerns about the clarity and precision of the legal framework. In particular, the grounds of "public order" and "investigation of any offence" are significantly broader than what would be considered necessary in a democratic society under European standards. The concept of "public order" is undefined and could encompass a wide range of circumstances. The ground of "investigation of any offence" — without limitation to serious criminal offences — means that the interception power is not restricted to cases where there is a serious threat to a significant public interest.
Furthermore, the legal framework governing the CMS and NATGRID is not set out in primary legislation but operates under the general provisions of Section 69 IT Act and Section 5(2) Telegraph Act, without specific statutory authorisation or detailed published rules.
Conclusion: Partially met. A legal basis for government access exists, and the relevant provisions are publicly accessible. However, the breadth of the grounds for interception, particularly "public order" and "investigation of any offence," lacks the precision required by European standards. The legal framework governing centralised surveillance systems (CMS, NATGRID) lacks specific statutory authorisation and transparency.
5.3.2 Necessity and Proportionality. Standard: The interference with the right to data protection must be limited to what is strictly necessary. The legislation must lay down clear and precise rules governing the scope and application of the measures and must impose minimum safeguards. The legislation must indicate the circumstances and conditions under which the measure may be applied, taking into account the severity of the interference.
Assessment: The IT Interception Rules 2009 require that the competent authority, when issuing a direction for interception, must consider whether the information sought can be obtained by other means and must record reasons for the direction. Rule 419A of the Telegraph Rules similarly requires the competent authority to consider whether the information cannot reasonably be obtained by other means. These provisions introduce a degree of necessity assessment.
However, the Indian legal framework does not contain an express proportionality test equivalent to that required under Article 52(1) of the EU Charter of Fundamental Rights. There is no requirement that the interception must be proportionate to the legitimate aim pursued, taking into account the severity of the interference with the right to privacy. The scope of Section 69 IT Act is extremely broad, applying to "any information generated, transmitted, received or stored in any computer resource" — which could encompass all data held on Pinnacle India's systems or accessible through Pinnacle India's network connections. There are no limitations based on the severity of the offence under investigation (in the case of the "investigation of any offence" ground) or the sensitivity of the data accessed.
While the time limitations on interception orders (60 days, renewable up to a maximum of 180 days under the IT Interception Rules) provide some constraint, the breadth of the underlying power and the absence of a structured proportionality assessment mean that the necessity and proportionality requirements of European law are not fully met.
Conclusion: Partially met. The Indian legal framework includes some procedural limitations (consideration of alternative means, time limits on interception orders) but lacks a structured proportionality test and does not limit the scope of interception based on the severity of the offence or the sensitivity of the data. The necessity and proportionality framework is weaker than European standards.
5.3.3 Independent Oversight. Standard: The interference must be subject to effective, independent, and impartial oversight. The oversight body must have the competence and power to exercise an effective and continuous supervision over the surveillance activities. It must be functionally independent from the executive branch and the intelligence services.
Assessment: The primary oversight mechanism for interception under both the IT Act and the Telegraph Act is the Review Committee. Under the IT Interception Rules 2009, the Review Committee is composed of the Cabinet Secretary, the Secretary to the Government of India (Legal Affairs), and the Secretary (Telecommunications). Under Rule 419A of the Telegraph Rules, a similar Review Committee is established. In both cases, the Review Committee reviews interception directions within seven working days of issuance and has the power to set aside directions that are not in accordance with the law.
Critically, all members of the Review Committee are executive branch officials. There is no independent judicial authorisation required prior to the issuance of an interception order. The Review Committee conducts a post-hoc review, not prior authorisation, and its members lack the functional independence from the executive that European standards require.
There is no independent supervisory authority in India with responsibility for oversight of surveillance activities. The Data Protection Board of India, to be established under the DPDPA once in force, will have jurisdiction over data protection matters but is not designed to serve as a surveillance oversight body and has itself been criticised for potential lack of independence given the government's role in appointing its members.
The Supreme Court of India's landmark decision in K.S. Puttaswamy v. Union of India (2017) affirmed the right to privacy as a fundamental right under Article 21 of the Indian Constitution and called for the enactment of legislation providing robust safeguards for surveillance, including judicial oversight. However, as at the date of this Assessment, implementing legislation establishing independent, judicial oversight of surveillance has not been enacted.
Conclusion: Not met. Oversight of government surveillance in India is conducted by executive branch officials through the Review Committee mechanism. There is no requirement for independent judicial authorisation prior to interception, and no independent supervisory authority exercises ongoing supervision over surveillance activities. This represents a significant gap when measured against European essential guarantees.
5.3.4 Effective Remedies. Standard: An effective remedy must be available to the individual. The individual must have access to a court or independent administrative body whose decisions are binding on the intelligence services. The individual must be notified of the surveillance, or the remedies must be effective even without notification.
Assessment: Indian law provides several avenues through which individuals may challenge government surveillance:
(a) Constitutional writ petitions: Article 32 of the Indian Constitution provides for the right to move the Supreme Court for enforcement of fundamental rights, including the right to privacy under Article 21. Article 226 provides for similar writ jurisdiction before the High Courts. These are well-established mechanisms for judicial review of government action.
(b) Civil suits: Individuals may bring civil suits for damages arising from unlawful interference with their right to privacy, though the scope of such remedies in the surveillance context is uncertain.
However, the practical effectiveness of these remedies in the surveillance context is significantly limited by several factors: