A UK public body can buy a virtual data room through G-Cloud 14 by direct award, without running a full competitive procurement. The practical problem is that almost nobody in this market is on the framework. An exact-phrase search for virtual data room on the Digital Marketplace returns two services, both from the same supplier, and no major international data room brand appears at all.
That gap is the single most useful thing a public sector buyer can know about this market, because it inverts the shortlist. The platforms that dominate commercial UK deal work are largely unavailable by direct award, while several smaller and mostly British suppliers are.
What G-Cloud 14 is, and what it allows
G-Cloud is the Crown Commercial Service framework for cloud services. The current iteration is RM1557.14, which runs until 28 October 2026. It has three lots covering cloud hosting, cloud software and cloud support, and a data room sits in cloud software.
Its value is procedural. A buyer who finds a suitable service on the Digital Marketplace can award directly, having documented a fair selection against published requirements, rather than running a full tender. On a transaction with a deadline, that difference is often measured in months.
Suppliers publish a service definition, pricing and a set of declared attributes covering security, data location and certifications. Those declarations are the raw material for a buyer's comparison, and it is worth understanding their status: they are hosted by government but completed by the supplier. The Government Digital Service does not independently verify them.
Who is actually listed
Searching the Digital Marketplace for the exact phrase virtual data room returns two services, both from Admincontrol, the Norwegian provider owned by Euronext Corporate Solutions. Broadening to data room adds Nine23, a Southampton-based high assurance provider whose LynX FileShare is built for defence supply chains. Searching secure deal rooms adds Kahootz, an Oxfordshire collaboration platform.
That is essentially the field. Datasite, Intralinks, Firmex and Ansarada do not appear under any of those terms.
| Supplier | Listed as | Published price | Data location |
|---|---|---|---|
| Admincontrol | Virtual Data Room | £250 to £1,000 per licence per month | European Economic Area, no UK option |
| Nine23 | LynX FileShare, UK sovereign secure file share | £1,000 per instance per month | United Kingdom |
| Kahootz | Secure Deal Rooms and Collaborative Procurement | £2.50 to £12.50 per user per month | United Kingdom |
The trade-offs are real and they are different in each case. Admincontrol is the only one of the three that is a purpose-built transaction data room, and it is the only one that does not host in the UK. Nine23 hosts in UK sovereign accredited facilities and handles material up to OFFICIAL-SENSITIVE, but it is a managed file share rather than a deal platform, with no Q&A module or bidder management. Kahootz is UK hosted with the most transparent pricing of the three, and is a collaboration platform rather than a data room.
In other words, no single G-Cloud listing gives a public sector buyer both UK hosting and full transaction tooling. That is worth knowing before you start, because it is a choice between compromises rather than a search for the best option.
PPN 014 and Cyber Essentials
Procurement Policy Note 014 has applied since 24 February 2025, replacing PPN 09/14 and PPN 09/23. It covers all central government departments, executive agencies, non-departmental public bodies and NHS bodies, and it requires suppliers to demonstrate the Cyber Essentials technical requirements.
The mechanics matter:
- Evidence is required before contract award, not after
- Subcontractors are caught through the Model Services Contract
- Recertification is annual
- Buyers must not apply the requirement as a blanket rule, and controls must be proportionate to risk
The proportionality point cuts both ways. The higher-risk triggers named in the guidance include citizens' personal data, government employee and minister data, and ICT systems processing data at OFFICIAL. A data room used for a government transaction typically hits at least one, which makes Cyber Essentials Plus the defensible position rather than basic certification.
Across the 18 providers we assess, only 5 claim Cyber Essentials in any form: Admincontrol, Sterling Technology, Projectfusion, Kahootz and Nine23. Most are UK-native. Every one of those claims is supplier self-declared, because the IASME certificate register blocks automated lookup, so ask for the certificate and check the scope before award.
Cost note. The National Cyber Security Centre states that Cyber Essentials certification starts at £320 plus VAT, priced by organisation size. There is no published price for Cyber Essentials Plus, which is quoted on network size and complexity. That asymmetry is part of why smaller suppliers hold basic certification and fewer hold Plus.
Does the data have to stay in the UK?
Not as a matter of data protection law. UK GDPR is retained EU GDPR under section 3(10) of the Data Protection Act 2018 and contains no residency requirement. What it regulates is the restricted transfer, and we found no gov.uk statement mandating UK-only storage for material at OFFICIAL.
In practice, though, departmental policy frequently specifies it, and where it does the G-Cloud declaration is the place to check. Admincontrol declares its locations as the European Economic Area with no user control over location, which means a UK-only requirement rules it out regardless of its UK offices and accreditations. Our explainer on UK data residency and restricted transfers sets out what the law actually asks for.
A worked example
Imagine an NHS foundation trust disposing of a surplus site, working to a board deadline eleven weeks away. The estates team needs a data room for title documents, surveys, asbestos reports and tenancy information, shared with a shortlist of developers and their advisers.
A full procurement would consume most of the eleven weeks, so G-Cloud direct award is the obvious route. The trust holds personal data in the tenancy files and is an NHS body, so PPN 014 applies and the risk profile points to Cyber Essentials Plus. Departmental policy specifies UK storage.
That combination eliminates Admincontrol despite it being the only true data room on the framework, because it does not host in the UK. Nine23 satisfies sovereignty and accreditation comfortably but offers no bidder-facing Q&A, which matters when five developers are asking questions about the same title plan. The trust ends up with Kahootz, accepting that it will run the question process by structured workspace rather than a purpose-built Q&A module, and documents that reasoning in its award rationale. The point of the example is that the reasoning, not the product, is what survives audit.
Buying off framework
If none of the listed services fits, a public body is not obliged to use G-Cloud. Other routes exist, including the Digital Specialists and Programmes framework and open procurement under the Procurement Act 2023. The trade-off is time.
Where the requirement is genuinely a commercial-grade transaction data room with UK hosting and full deal tooling, an open procurement is likely the only way to reach the providers that offer it. Several do, including UK-native suppliers not on any framework. Our list of UK-based providers is the place to start, and the full ranked comparison shows which of them offer UK residency and which hold Cyber Essentials.
Common mistakes
Assuming the big brands are available. Buyers who shortlist from commercial market awareness rather than from the framework itself lose time discovering that most of their shortlist cannot be awarded directly.
Treating a G-Cloud declaration as verified.The certification and data location fields are supplier self-declared. At least one supplier's listing contradicts itself between its tick-box answers and its free text. Read both, and ask for certificates.
Confusing a UK office with UK hosting. A supplier can have UK offices, UK accreditations and a UK sales team while storing every document abroad. The data location field is the one that matters.
Leaving Cyber Essentials evidence to contract stage. PPN 014 requires it before award. Discovering at signature that a preferred supplier holds basic certification rather than Plus, on a higher-risk system, is an avoidable delay.
Ignoring the framework expiry. G-Cloud 14 ends on 28 October 2026. If your procurement timetable runs close to that date, confirm the position on call-off duration before you rely on it.