Loading page
About this tool
Track vendors with their processing purposes, data categories and retention terms.
The Vendor Data Processing Inventory turns one line per vendor into a structured eight-column register — Vendor, Purpose, Data categories, People, Location, Retention, DPA / terms and Owner — and counts how many rows are complete versus how many are still missing a field. It is the shape a record of processing activities takes under GDPR Article 30: who processes personal data for you, why, whose data, where it sits, how long it is kept, and under which contract. It is for whoever has been handed the job of listing every SaaS tool that touches customer or staff data before an audit, a security questionnaire or a DPA review.
Open Vendor Data Processing Inventory on AltFTool — it loads instantly in your browser.
Paste one record per line into "Records (one per line)", separating Vendor, Purpose, Data categories, People, Location, Retention, DPA / terms and Owner with the | character.
Leave "Require complete rows" switched on so "Flag missing columns" counts every line that is short of the eight fields or has a blank one.
"Structured inventory" returns the eight-column table with missing cells shown as —, plus Complete rows, Needs review and Columns tiles; the table renders the first 100 records, and Copy and Download export only what is shown.
With flagging on, any row missing one of the eight fields is counted as needing review, so the gaps surface as a number instead of a blank cell nobody notices.
The register keeps the retention term and the DPA or contract reference on the same row as the purpose, which is exactly the pairing an auditor asks about.
Records are pipe-separated lines you can keep in any document or ticket and re-paste later, rather than a spreadsheet locked into one file format.
It is a written inventory of how an organisation processes personal data — purposes, categories of data and data subjects, recipients, transfers, retention periods and security measures. GDPR Article 30 requires controllers and processors to maintain one, and supervisory authorities can ask to see it.
The eight fields this tool tracks: the vendor name, the processing purpose, the categories of data involved, whose data it is (customers, staff, applicants), where it is processed, the retention period, the DPA or contract reference, and the internal owner accountable for that relationship.
No — a register is one requirement among many, and it does not by itself establish a lawful basis, a valid processor contract or adequate transfer safeguards. Treat the output as informational documentation and have a privacy counsel or DPO review your obligations.
Enter as many lines as you like; the rendered table shows the first 100 rows, while the completeness counts cover everything you paste. Each line must use the pipe character to separate all eight fields, in order.