Supplier monitoring
A supplier assessment is accurate on the day it is signed. Our supplier monitoring keeps it accurate afterwards, combining automated checks with review by your data protection officer, so the evidence behind your risk assessment’s stays current.
Available to all clients in Q1 2027
Each layer builds on the one below. The last is the one software cannot do.
The problem
Under Article 28 of the UK GDPR you may use only processors that provide sufficient guarantees, and under Article 5(2) you must be able to show it. Most organisations assess a supplier once, at procurement, and then hear nothing until renewal.
They add sub-processors, move hosting, change their data processing terms or let a certification lapse, often with only a notice on their website.
Certificates expire, email protections are weakened, and old services are left exposed. None of it shows up in a questionnaire answered last year.
Automated security ratings flag issues, but they cannot tell you whether a finding matters for the data you share with that supplier.
Our approach
Automated monitoring and expert review usually come from different places. We put them together, so every change we detect is read by someone who knows your processing and can tell you what it means.
Every day
Every week
Every day
Whenever something changes
What you receive
You will not be asked to make sense of a security score on your own. When a supplier changes something that matters, you hear from us with what changed, whether it affects your data and what, if anything, you should do.
Behind each piece of advice sits a dated scan and a published scoring method, so the evidence stands up if your assessments are ever questioned by a regulator, an auditor or a parent.
The supplier’s published sub-processor list now includes an AI provider processing data in the United States.
This affects the DPIA we hold for you. We recommend that you confirm whether the feature is enabled for your account. We have drafted the questions for the supplier and will update the assessment once they reply.
Illustrative example
How it works for you
Suppliers are grouped into portfolios such as EdTech, Finance or General. Platforms that many of our clients use are monitored once and shared, so you benefit from coverage of your sector from day one.
Niche or specialist suppliers can sit in a private portfolio that only you and we can see.
Each DPIA records the scan it relied on. When a later scan finds a material change, the DPIA is flagged for review automatically.
Our scanner collects only what suppliers make publicly available and never tests logins or exploits weaknesses. Suppliers can see exactly how it works on our scanner page.
Questions
Supplier monitoring will be available to all clients in Q1 2027. If you would like your suppliers included from the start, tell us which ones matter most to you.
No. Supplier monitoring is included for all of our clients.
No. It sees what a supplier exposes to the internet and what it publishes, not its internal controls. It tells you when to ask questions, and our DPIAs still include the questions that only the supplier can answer.
Yes, if they look. Our scanner identifies itself and links to a public page explaining what it does, how to correct a finding and how to contact us. Nothing about the monitoring is hidden.
No. Results are shared only with clients who use the supplier concerned, and only after our review. Where we publish a summary assessment, it contains our commentary and the date, never a score.
Any supplier with its own internet domain. Tell us which suppliers process your personal data and we will add any that are not already monitored.
Book a call and we will talk you through how monitoring works with your existing DPIAs and the suppliers you rely on most.
© 2026 GDS Analytics. All rights reserved.