The platform
Every personal-data duty, handled.
UK organisations handle data-protection complaints, subject-access requests, breach reporting, records of processing and DPIAs. TheDutyDesk handles all of them — on one platform, one audit trail, without re-keying a fact.
Whether a duty is compulsory or discretionary good practice, it runs on the same system. One intake. One audit log. One evidence pack. The obligations the ICO actually checks — and the ones that good organisations track anyway.
The duties we handle.
The obligations the ICO actually checks. One platform. One audit trail. One source of truth.
Data-protection complaints
s.164A DPA 2018
Track the 30-day clock, send the acknowledgement, keep the evidence the ICO can review.
[2]Subject-access requests
UK GDPR Art.15
One-month clock. Intake, identity-check, search, redaction, deterministic response pack.
[3]Other data-subject rights
UK GDPR Art.16–22
Rectification, erasure, restriction, portability, objection — all on one workflow.
[3]Breach reporting
UK GDPR Art.33
The 72-hour clock. Pre-filled ICO notification, internal escalation, complainant communications.
[3]Records of processing
UK GDPR Art.30
The living RoPA. Connected to every complaint and subject-access request.
[3]DPIAs and vendor risk
UK GDPR Art.35
Pre-processing assessment, vendor register, residual risk — before the processing starts.
[3]Every obligation runs on the same audit log. Move from a complaint to a DSAR to a breach without re-keying a single fact.
One system, every case.
The same shared infrastructure runs under every duty type — so there is nothing to re-learn and nowhere to re-key.
One multi-channel intake.
Complaints, subject-access requests and breach reports arrive by form, email or social media. One intake surface, one queue — no re-keying, no missed channels.
One SLA clock model.
Each duty runs on its own clock. The platform watches every countdown across every duty type, turns amber before a deadline, and never misses one in silence.
One immutable audit trail.
Every action across every case type — complaint, DSAR, breach — is logged in the same hash-chained, tamper-evident record. Change one event, every hash after it breaks.
One-click ICO evidence pack.
Move from a complaint to a DSAR to a breach and produce a complete, timestamped evidence pack for any of them — in one click, for any case type.
The software that handles every UK data-protection duty.
TheDutyDesk is hosted UK data-protection compliance software. Nothing to install. UK-hosted. Audit-grade by design. Set up in 30 minutes, run by anyone — no IT required.
Put the form on your own website.
One line of code drops a complaint or request form onto your site. We host it, keep it accessible, and route every submission into one place.
Nothing to install or maintain.
Fully hosted. Security, updates and uptime are ours — you just log in. No IT project. No maintenance window.
A dashboard that tells you what to do.
Open cases, deadlines and how you are tracking — across every duty type — the moment you log in.
Reminders before anything is late.
By email, Slack or Teams — the platform watches the clock across every duty so you do not have to.
Proof in one click.
Hand the regulator a complete, timestamped evidence pack the moment you are asked — for any case type, without keeping a single record yourself.
Email in, case logged.
Forward a complaint or a request and it becomes a tracked case automatically — categorised, clocked, nothing to copy across.
Built to ICO guidance · UK-hosted · Audit-grade by design
Common questions.
Does TheDutyDesk only handle data-protection complaints?
No — it handles data-protection complaints under s.164A of the Data Protection Act 2018, subject-access requests and the other data-subject rights under UK GDPR Articles 15 to 22, breach reporting under Article 33, records of processing under Article 30, and DPIAs under Article 35, on one platform and one audit trail.[2] [3] [3] [3] [3]
Is this data-protection compliance software?
Yes — TheDutyDesk is hosted UK data-protection compliance software covering every personal-data duty, with a one-click ICO evidence pack for any case type. Nothing to install. UK-hosted. Audit-grade by design.
Do complaints, subject-access requests and breaches share one system?
Yes — they share one multi-channel intake, one SLA clock model, and one immutable audit trail, so you move between duties without re-keying a single fact.