GDS Client Portal
The self-service plan gives your organisation the GDS Client Portal on its own: one secure place for your data protection project plan, your DPIAs, the suppliers you rely on and your record of processing activities. Supplier assessments are produced automatically and are not reviewed by GDS staff, which keeps the plan affordable for organisations that run data protection in-house.
What the plan includes
Every part of the portal sits behind the same sign-in, and every user signs in with an authenticator app. Your organisation sees only its own information.
Project plan
Track the actions in your data protection or security programme, with owners, dates and status, and import an existing plan from a spreadsheet.
DPIAs
Keep your final Data Protection Impact Assessments (DPIAs) as PDFs, with the outcome, residual risk and next review date for each. Earlier versions are kept, so you have the history.
Supplier monitoring
Add your suppliers’ domains and the portal checks them every day, from public information only: email security, encryption, website settings, domain security, exposed services, blocklists, lookalike domains and published data protection documents. Each supplier receives a score, a band and a list of findings.
Record of processing
Build your record of processing activities from a template, an import of your existing record or a blank page, link each activity to the suppliers involved, and export it as a PDF or spreadsheet.
Audit trail
A tamper-evident log records sign-ins, uploads, downloads and changes, which helps you demonstrate accountability under Article 5(2) of the UK GDPR.
Your own domain
Monitor up to five of your own domains with the same daily checks, so you can see and fix what others see of your organisation from the internet.
What it does not include
On the self-service plan, supplier results publish automatically and are labelled “Automated, not reviewed by GDS”. They are a point-in-time view of a supplier’s internet-facing security, not an audit or a certification, and they cannot see a supplier’s internal controls.
Nothing in the portal is legal, data protection or security advice. Your organisation remains responsible for its own decisions, including whether to use a supplier and whether a DPIA is adequate.
If you would like a qualified data protection officer to review a result or a DPIA, you can request a GDS review for a separate fee. Organisations that want the review built in can take the portal as part of our managed data protection officer and CISO service instead. Talk to us about the managed service.
Limits and service levels
| Item | Self-service plan |
|---|---|
| Named users | As set out in your Order Form |
| Monitored supplier domains | As set out in your Order Form (a fair-use limit) |
| Monitored own domains | Up to 5 (a fair-use limit) |
| Supplier checks | Daily, with some sources (certificate logs, lookalike domains and Shodan) refreshed weekly |
| Availability | A target of 99.5% each calendar month, excluding planned maintenance notified at least 48 hours in advance |
| Support | Email to admin@gdsanalytics.co.uk, 09:00 to 17:00 UK time on working days, with a first response within one working day |
| Leaving | You can export your data for 30 days after your contract ends, after which it is deleted |
Contract documents
Your Order Form sets out your plan, term and fees. It incorporates the GDS Client Portal Terms of Service, which include our Article 28 Data Processing Agreement, and the GDS Client Portal Security Statement. How we use personal data for our own purposes, such as billing, is explained in our privacy policy.
© 2026 GDS Analytics. All rights reserved.