Client portal
One secure portal for your plan, your assessments, your suppliers, your DPIAs and your record of processing. Use it with GDS Analytics as your data protection officer, or on its own.
Everything a regulator, an auditor or your governors may ask to see.
The problem
Under Article 5(2) of the UK GDPR you must be able to show that you comply, not just say so. For most organisations the evidence is spread across a tracker, a folder of policies, last year’s supplier questionnaires and whoever happens to remember.
Actions agreed in a meeting slip without anyone noticing, and nobody can say what is done without asking around.
When an auditor, an insurer or the ICO asks, the record of processing, the DPIAs and the supplier checks are in different places and different states.
The suppliers that hold your data change their security, their sub-processors and their standing long after you assessed them.
What it does
Each part works on its own, but they are built to connect: your suppliers feed your record of processing, your assessments generate your action plan, and your DPIAs sit next to the monitoring they rely on.
Your data protection roadmap as a live plan rather than a spreadsheet: every step dated, owned and tracked.
Ten frameworks ready to use, including the nine ICO data protection audit toolkits and the IASME Cyber Essentials question set, plus risk assessments for AI products.
More than 300 widely used services are monitored every day from public information, and you can add your own. Mark the ones you use and they sit at the top of your list.
The same checks, run on your own domains with your consent, so you see what an attacker, an insurer or a customer doing due diligence sees.
Your record of processing activities, as Article 30 requires, organised by activity and linked to the suppliers each one uses. Your DPIAs are held alongside it.
Two ways to use it
The portal is the same either way. The difference is whether GDS Analytics reviews what it finds and advises you, or whether your own team runs it.
| Feature | Managed service | Portal only |
|---|---|---|
| Your plan | Built and tracked with your DPO | The plan module, run by your own team |
| Assessments | Ten frameworks, validated by GDS | Ten frameworks, self-assessed |
| Supplier monitoring | Daily, with GDS review and advice | Daily, automated results |
| Your own domains | Included, with what to fix first | Included |
| Record of processing | Each entry reviewed by GDS | Gap checks, no GDS review |
| DPIAs | Written by your DPO | With the managed service |
| How you pay | Included in your retainer | Annual subscription, 12 or 24 months |
The portal-only subscription is provided under our Terms of Service, which include our data processing terms. See also the service description and our Security Statement.
Security
The portal and our monitoring run on servers in Europe, under UK and EU data protection law.
Multi-factor authentication is required for every portal account.
Every change records who made it and when, in a log that shows if any entry has been altered or removed.
Each organisation sees only its own plans, assessments and records. We do not install anything on your systems or collect data from them: supplier and domain checks use public information only.
Questions
Yes. Book a call and we will show you the portal with demonstration data, and talk through how it would work with your existing plans and records.
No. The portal is included for clients who use our data protection officer or information security services.
Yes. Your plans, assessments and records stay in the portal if you move from the portal on its own to the managed service, or the other way.
Yes. We can import an existing record of processing and convert an existing project plan, so you do not start again.
Independent schools and organisations in financial services, hospitality, retail and other sectors. The templates and frameworks are not specific to one sector.
Our Terms of Service cover the portal-only subscription, including our data processing terms under Article 28 of the UK GDPR. The service description sets out what is included, and the Security Statement explains how the portal is hosted, backed up, patched and tested.
No. The portal gives your data protection lead the tools; it does not make judgements about your processing. That is what the managed service adds.
Book a call and we will walk you through the portal with demonstration data, and talk about which option suits your organisation.
© 2026 GDS Analytics. All rights reserved.