Nobody knows which suppliers process personal data
Supplier privacy assessments record whether a supplier processes personal data and what kind, so your processor list stays accurate.
Nexus Business Register for data protection officers and gdpr leads
GDPR supplier management: processors, DPAs and data locations under control
Under GDPR, controllers must use only processors that provide sufficient guarantees, put a data processing agreement in place (Article 28) and keep records of processing that name recipients and transfers (Article 30). In practice most organisations cannot quickly say which suppliers handle personal data, where it goes or whether the DPA was ever signed. Nexus Business Register keeps that picture current as suppliers are added, reviewed and paid.
Match supplier invoices to projects without the admin headaches, and stay ISO-ready at the same time.
€1,150.00
- Uploaded and confirmedSupplier, VAT and line items checked
- Matched to order and deliveryPO and delivery evidence linked
- Allocated to projectHR · Payroll processing (processor)
- Price change spottedPayroll service fee: +4% at renewal
- Audit evidence keptApproval and evidence on one record
The problems we solve for data protection officers and gdpr leads
DPAs go unsigned
Track each supplier's data processing agreement from required to requested, reviewing and signed; an unresolved DPA blocks approval of the supplier review.
Data locations are unknown
Record where each supplier stores and processes data, and flag transfers outside the EEA that still need a safeguard.
Decisions are not evidenced
Every supplier review records the evidence considered, the decision, the reasons and who decided, ready for a Data Protection Commission enquiry or customer questionnaire.
Your own records stay protected
Records live in your organisation's workspace with role-based access, EU-region primary hosting by design, security-checked evidence and controlled export and closure.
The features you will use most
Supplier reviews and due diligence
Structured supplier reviews that gather the evidence, highlight blockers and record a clear decision, so you can show customers, auditors and insurers how suppliers were checked.
Learn more →Audit trail and compliance evidence
Build audit readiness as a side effect of normal work. Every request, decision, invoice and review is recorded, and audits, findings and corrective actions have their own register.
Learn more →Supplier register
One accurate list of who the business buys from: suppliers, categories, owners, status, evidence and spend in one place, instead of scattered across inboxes and spreadsheets.
Learn more →Software subscriptions and licences
Every software subscription and licence the business pays for, with its billing cycle, seats, renewal date and owner, built from the invoices you already confirm rather than a separate spreadsheet.
Learn more →Questions from data protection officers and gdpr leads
Does Nexus track data processing agreements?
Yes. Each supplier that processes personal data has a DPA status: not applicable, required, requested, reviewing or signed. An unresolved DPA is a blocker on the supplier review.
Can we record where suppliers store personal data?
Yes. Supplier data locations are recorded, and unresolved transfers outside the EEA are flagged in the review so a safeguard can be put in place.
Does it produce our Article 30 record of processing?
It keeps the supplier-side information that feeds your record of processing: processors, the data they handle, locations and agreements. It does not generate the full record or replace legal advice.
Where is Nexus's own data hosted?
Nexus designs its services for EU-region primary data hosting, with access controlled by role inside each organisation's workspace.
Is Nexus itself a processor for our data?
Yes, for the records you store in Nexus Business Register. Nexus Digital's terms and privacy notice set out how that data is handled.
See it with your own suppliers
Free for 30 days. Import your suppliers and upload a few invoices to see your real costs.