Most organisations already keep suppliers, systems, risks and tasks in spreadsheets. The bulk import moves that data into Diri in one go, so you do not have to register each record by hand. The same import can also update records you already have, which makes it useful for ongoing maintenance as well as for the first migration.
The import button sits in the top right corner of the register, next to the button for adding a single record.
Register
Button
Vendors
Import vendors
Customers
Import customers
IT systems
Import IT systems
Business processes
Import
Dependencies (when mapping dependencies)
Import from Excel
Business assets and Information assets
Import assets
Threats
Import threats
Vulnerabilities
Import vulnerabilities
Risk assessment (bow tie)
Import rows, or Convert and import an existing risk assessment on an empty bow tie
Treatments
Import treatments
Tasks
Import tasks
Processing activities
Import activities
DPIA
Import DPIAs
Incidents
Import
Policies
Import policies
You need permission to create records in the register to import new rows, and permission to edit records to update existing ones. Records are always imported into your active organisation.
Open the register and select the import button (see the table above). The Import … dialog opens.
Select Download Excel template (or CSV template). The template has the right column headers and an example row. Under What goes in each column? the dialog lists every column, whether it is required or optional, which values are accepted, what a blank cell defaults to, and which other header names are also accepted.
Fill in the template, or adapt your own spreadsheet so that the headers match. The headers must be in the first row, and the data must be on the first sheet.
Drag the file into the dialog, or click to browse. Both .xlsx and .csv files work, including the semicolon-separated CSV files common in Europe. The maximum file size is 20 MB. You can also copy cells from a spreadsheet, paste them under or paste from a spreadsheet and select Preview pasted rows.
Review the preview. Diri maps the columns, validates every row and shows how many rows will be new, updated or blocked. Columns Diri does not recognise are listed as ignored. Rows with errors are skipped, so fix them in your source sheet and preview again to include them.
Choose how existing records are handled (where the register offers a choice):
Create new + update existing (upsert) – new rows are created and rows that match an existing record update it.
Create only (warn on existing) – only new records are created; rows that match an existing record are blocked.
Update existing only – only existing records are updated; rows with no match are blocked.
Select Import (the button shows the number of rows). Nothing is written before this step.
The summary shows how many rows were created, updated, skipped or failed, and why. Select Import another or Done.
The importer handles up to about 500 rows reliably in one batch. If your file is larger, Diri warns you, and it is a good idea to split it into smaller files.
Kind of column
What to enter
Dates
ISO format: YYYY-MM-DD, for example 2026-01-31.
Yes/No
Yes or No.
Lists of values (for example status or criticality)
One of the values shown under What goes in each column?
People (owner, responsible, assignee)
The person's email address, as registered in Diri.
References to other records (for example a vendor or an IT system)
The exact registered name. Where it helps, the dialog offers Valid names (CSV), a list of the names you can use. Some Excel templates include this list as a separate sheet with dropdowns.
You can import the same list again whenever it changes, for example a new export of IT systems from your architecture tool or CMDB (such as Ardoq). You don't need to remove anything first, and you won't get duplicates:
Diri recognises existing records by name. For each row it checks whether a record with the same name already exists in the register, in the organisation you are working in. Upper and lower case and spaces at the start or end don't matter. This is how IT systems, vendors, processing activities, policies and most other registers are matched.
A match updates the existing record with the values in the file. It stays the same record, so everything you have linked to it is kept: processing activities connected to an IT system, risk assessments, dependencies, treatments and so on.
A name that doesn't exist yet becomes a new record.
Nothing is deleted. Records that are in Diri but missing from the file are left as they are. If something has been retired, archive or delete it in Diri yourself.
Before anything is written, the preview shows how many records will be created and how many updated. Check the numbers: if you expected mostly updates and the preview says many new records, the names probably don't match.
Watch out for renamed records. If a system has been renamed in the source since the last import, Diri can't tell that it is the same system, and creates it as a new record. The old record keeps its links. Delete or archive the old one, or, for vendors, merge the two (see Parties and customers). Renaming the record in Diri before you import avoids this.
The safest way to keep a register in step with another system is to import the full list each time, with Create new + update existing, and to keep the names the same in the source and in Diri.
Exports from other tools rarely match Diri's columns exactly: the headers are different, values such as hosting or criticality are written differently, and people appear as names rather than email addresses. An AI assistant such as Microsoft Copilot can convert the data for you. Use the assistant your organisation has approved for this kind of data.
Open the import dialog in Diri and copy the whole What goes in each column? section, from the first column to the tip at the end. These are the rules the assistant must follow.
If the register has references to other records, such as the vendor of an IT system, download Valid names (CSV) where the dialog offers it.
Give the assistant the prompt below, with the rules, the valid names and your data pasted in where indicated.
Copy the CSV it returns, paste it into the import dialog under or paste from a spreadsheet, and select Preview pasted rows.
Read the preview. If rows are blocked, give the error messages to the assistant and ask it to correct the CSV, then preview again.
When the preview looks right, select Import.
A prompt that works well (replace the parts in brackets):
I am going to import [IT systems] into Diri. Convert my data into CSV that
Diri can import, following the import rules below exactly.
Rules for the conversion:
- First row: the column headers exactly as named in the import rules.
Only include columns that are in the rules; leave out all others.
- Keep each record's name exactly as it is in my data. Do not correct,
shorten or translate names. Diri uses the name to recognise records
it already has.
- Columns with a fixed list of values: use only the listed values,
spelled exactly as shown. Map my values to the closest one. If none
fits, leave the cell empty and tell me which row it was.
- Numbers on a scale (for example importance 1 to 5): convert my
values to that scale and tell me how you did it.
- People (owner, responsible, assignee): email addresses only. If my
data has names but no email addresses, leave the cell empty and
list the names for me.
- References to other records (for example vendor): use only names
from the list of valid names below, spelled exactly the same. If
there is no match, leave the cell empty and tell me.
- Dates: YYYY-MM-DD.
- Comma-separated. Put a value in double quotes if it contains a comma.
Reply with the CSV in one code block, followed by a short list of
everything you changed, guessed or left empty.
IMPORT RULES:
[paste the "What goes in each column?" section]
VALID NAMES:
[paste the valid names, or write "none"]
MY DATA:
[paste your rows, including the header row]
The prompt works just as well in Norwegian. Two habits make the result better: give the assistant the real rules from the dialog rather than describing them yourself, and always read the list of what it changed or guessed before you import.
An update only changes the fields that have a value in the row. An empty cell leaves the stored value as it is, so an import never clears a field. To clear a field, edit the record in its form.
A row that would change an approved pre-assessment (and so break its signature) is not changed. The summary lists these rows; make the change in the form, where you are asked to confirm it. See Pre-assessments.
A row whose record was changed by someone else while the import ran is not written. Import it again to apply it to the current record.
Threats, vulnerabilities and assets belong to a module. Open the register from the right module group in the menu (for example Cyber security) before you import, so the records are assigned to that module.
Treatments: choose the module under Import into module. It is applied to all imported treatments, and can be changed per treatment afterwards.
Tasks are imported into the task board that is currently selected. With no task board selected, they are imported without one.
Policies: the policy text itself is not imported. Open each policy in the editor to paste and format the content.
Risk assessments: in the bow tie work surface, each imported row becomes linked causes, events and consequences, treatments included.
Dependencies: download the Excel template first. It contains an IT systems sheet listing every valid system name, and both system columns are dropdowns fed by that list. Names that occur in several organisations appear as "Name (Organisation)". Rows of type "other" need a note saying what the dependency is. See Dependencies.
Customers: the import covers the customer's name, type (organisation or person), organisation number, status and its dates, contract end date, customer number, owner, contact details, dependency and governing law. Obligations, the pre-assessment and the systems and processes that serve the customer are not imported; add them in the customer form. Type and organisation number are set when a customer is created and are not changed by a later import. See Parties and customers.
Every table has a Download CSV action in its toolbar. The file contains the columns you have configured for the table, with the current filters applied, so set up the columns and filters first. See Tables in Diri and Filtering and sorting lists.
Some pages have their own export as well, for example the risk registry (CSV), the annual wheel and the printable reports for assessments.