Register of information (DORA)

The register of information is the record DORA requires financial entities to keep of all contractual arrangements with ICT third-party service providers, available to supervisors on request.

Part of the Learn hub and the customer data glossary.

What it means in practice

Article 28(3) of the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, requires financial entities, as part of their ICT risk management framework, to maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information on all contractual arrangements for ICT services provided by ICT third-party service providers. They must make the full register, or specified sections, available to the competent authority on request 1. DORA has applied since 17 January 2025.

Marketing and customer data tools are in scope when they are ICT services under contract: a customer data platform, an email service, an analytics tool. They belong in the register with their provider, service, location and whether they support a critical or important function. The first list of critical ICT third-party providers (18 November 2025) named 19 providers, including AWS, Google Cloud and Microsoft, and no martech vendor 3.

Example (bank): the register lists the SaaS platform, the email service provider and the cloud region where each stores data, and records whether either supports a critical or important function.

Related terms

• Critical or important function: flagged in the register.
• Data processing agreement: a contract it records.
• Data residency: location of services.
• Data egress: exit and export costs.
• Self-hosted customer data platform (CDP): fewer third-party arrangements.

Where it matters

• DORA and your marketing stack: register, contracts and exit plans.
• Cloud exit strategy for marketing and customer data: template and checklist.

Back to the customer data glossary or the Learn hub.