For adult, cam and creator platforms with UK or EU members

Large-scale special category data. The DPIA is not optional.

Rider walks a platform through the impact assessment the ICO expects — the processing described, consultation, necessity, every risk scored before and after its measures, the DPO’s advice — and will not let it be signed while any part is missing or a high risk remains without the ICO consulted.

Open the demo See pricing

Opens in this browser with an invented platform already in it. No account, no email address, nothing installed.

Open the free demo →

The problem

Half a template, never signed.

Data about a person’s sex life or sexual orientation is special category data, and an adult platform processes it at scale. The UK GDPR asks for an impact assessment before the processing starts, a record of the DPO’s advice, a consultation with the regulator if a high risk is left, and a fresh look whenever the processing changes. Most platforms have a document that stops at section three.

Always

A DPIA is required for large-scale processing of special category data, judged by the number of people, volume, duration and geography.

ICO: When do we need a DPIA? →

Before

The assessment is done before the processing starts, and the DPO’s advice is sought and recorded.

ICO: How do we do a DPIA? →

High risk

If a high risk remains after the measures, the ICO must be consulted before the processing goes ahead.

ICO: How do we do a DPIA? →

Will not sign an assessment that is not finished.

Not a reminder. Sign the assessment refuses, with every gap listed, while a section is empty, consultation has neither happened nor a reason, a risk has no measure or no score after it, the DPO’s advice is not recorded (or not followed without a reason), or a high risk remains and the ICO has not been consulted. Signed, it is frozen. There is no override.

How it works

The ICO’s steps, in order

Describe and weigh

Nature, scope, context and purposes; the lawful basis and the special category condition; necessity, proportionality, rights and transfers.

Score the risks

Each risk to people by likelihood and severity, its measures, whether they eliminate, reduce or accept it, and the score after.

Advise, sign, review

The DPO’s advice recorded, the ICO consulted where a high risk is left, signed and dated, with a review date. A review starts a new draft; the signed one stays.

What it will never do

It assesses the processing. It holds nobody’s data.

Rider is the platform describing what it does with data — not a copy of the data.

No members’ data.No profiles, no preferences, no IDs. Descriptions and scores only.

No performers’ data.The assessment of an age-verification process, never the documents it checks.

It is not the regulator.It records that you consulted the ICO, and when. The ICO decides.

It never touches a payment.The fee is one flat price and it is for software.

Pricing

One price, then a yearly review

An assessment is a piece of work, then a habit.

Platform

$349/month

One platform, once.

Unlimited assessments
Risk scoring before and after
Sign-off gate, no override

Most platforms

Platform plus review

$449/month

One platform, with a year of reviews.

Everything in Platform
Review dates and review drafts
Then $99 a year for reviews

Group

$899/month

Several platforms under one operator.

Everything in Platform plus review
One copy for each platform
Priority support

One-off price, then $99 a year for the review plan. Your bank statement says Rider Software. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

Is our processing ‘large scale’?

The ICO judges it by the number of people, the volume and variety of data, how long it is kept and the geographic reach. A platform with members across a country almost certainly is. If you decide it is not, write down why.

Does it cover the EU too?

The EU GDPR has the same Article 35. Each EU authority publishes its own list of when a DPIA is required; check yours.

What does ‘high risk’ mean here?

Rider scores likelihood (remote, possible, probable) times severity (minimal, significant, severe). Six or more after the measures is high, and the ICO has to be consulted before you go ahead.

Is this legal advice?

No. It is a workbook that argues with you. Your DPO and adviser are the authority.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.

Open the demo before launch

Payout records are assessed and current. Age verification was signed fourteen months ago and is past its review. The new member preference profiles are a draft: the breach risk is still high after its measures, the DPO has not been asked, nobody was consulted, and one risk has no measure at all.

Open the demo See pricing