Diri keeps one register of the companies and people your organisation deals with, called parties. A party can be your supplier, a subcontractor working for one of your suppliers, a customer, or several of these at once. Microsoft can, for example, be your own supplier and at the same time a sub-processor behind four of your other suppliers. Keeping each company once makes it possible to see where your supply chain depends on the same party.
You work with parties in two registers under Vendors, Systems & Processes in the left-hand menu:
Vendors are available when the Cyber security or Privacy module is active. For how vendors relate to IT systems and information assets, see Vendors, IT systems and information assets.
The Vendors page has two tabs:
To register many vendors at once, use Import vendors, see Bulk import. A vendor can be offered to sub-organisations with the inheritance toggles in the form, see Inheriting and sharing.
Use Assess on a supplier's row to start the supplier security assessment. See Pre-assessments.
Subcontractors are collected from three places: a supplier's Sub contractors list, the subcontractors on an IT system, and the sub-processors on a processing activity. You do not register them separately. The tab shows:
| Column | What it shows |
|---|---|
| Name | The party. |
| Works for | How many of your suppliers depend on this party, directly or through their own subcontractors up to three steps up the chain. The list is sorted by this, so the top row is where most of your suppliers share one dependency. |
| Relation to you | Also your supplier or Not your supplier. A party that is both is not a duplicate: you depend on it directly and through your suppliers. |
| Registered on | Where the link was recorded: a supplier, an IT system or a processing activity. |
| Country | The party's nationality, otherwise the countries it processes data in. Blank means not registered. |
A party can appear on both tabs. To move a party between the tabs, change the answer to Do we have an agreement with this party ourselves? on its record.
When you register a party, Diri checks for an existing party with the same organisation number or the same name. If it finds one, it asks whether the company is already registered. Cancel and choose the existing party if it is the same company; select Save as a new party anyway only if it is a different company. Lookup fields in other forms ask the same question ("Does it already exist?") before they create a new party.
A party created from a lookup in another form, with only a name, is marked Unverified until someone opens it in the register and saves it. Use the Unverified filter on the register to find them. Open each one and save it to confirm it, or merge it into the record it duplicates.
Everything that points at the removed party (IT systems, processing activities, risk assessments, subcontractor lists and attachments) moves to the party you keep, and the removed party is deleted. Its history stays in the activity log. A merge cannot be undone.
The customer register records the organisations and people your organisation delivers to: what you have promised them, what you deliver, and what the relationship exposes you to. It is a register for risk and compliance, not a CRM.
A person is personal data: a customer who is a person is always need-to-know, never shared with sub-organisations and never merged with another person.
Use Assess exposure on a customer's row to assess what the relationship exposes you to: what you hold for the customer, what you can reach in their environment, what you have promised and what rides on your service. The terms of the agreement are read from the customer record, so fill in The agreement first. See Pre-assessments.
When your organisation is a data processor, a processing activity names its controllers, which are your customers. If you remove controllers from a processing activity, or delete the activity, Diri asks whether to remove the matching customer records as well. They are kept unless you tick them; a removed customer record goes to the archive.
When every customer relationship with a person has ended or been refused, you can remove who the person was:
The name is replaced with "Anonymisert person", contact details and the customer number are removed, the name is cleared from notifications, and the party is archived. The activity log keeps its earlier entries, so it remains a complete record of what happened. The customer records keep their dates and the fact that there was a customer. This cannot be undone. If your organisation is subject to the anti-money-laundering act, do not anonymise before the retention period has passed (5 or 10 years after the relationship ended).