tools
Martech Vendor Register Worksheet for DORA
By Art Kukharenko · Published · Updated
Browse tools resourcesThis worksheet is a CSV for inventorying marketing technology vendors in the structure of the DORA register of information (Commission Implementing Regulation (EU) 2024/2956). It has 17 columns, 12 fictitious example rows (customer data platform (CDP), email, analytics, consent and more) and a legend of the S01 to S19 ICT service types. It is a working sheet, not a regulatory submission file. 1
Who this is for: compliance and vendor-management teams building the marketing section of the register. Read the DORA marketing stack guide, then download martech-vendor-register-dora.csv. More assets: tools hub.
How to use the worksheet
- Open the CSV in a spreadsheet. Delete the
Example-rows and the#legend lines before importing into tooling (skip lines starting with#). - List every marketing tool that touches customer data, including team-bought tools.
- Pick one ICT service type per row. Most SaaS martech is S19; self-hosted software licences are S13, with separate rows for hosting (S17 or S07) and managed operations (S14). Add rows when a contract covers several types.
- Record whether the service supports a critical or important function, using your function inventory. Use
tbduntil assessed. - Enter storage and processing locations as country codes, then every subcontractor you know of, with cloud providers first.
- Add contract dates, notice period, exit plan status and last assessment date, then set the concentration flag.
- Review quarterly; move approved rows into your register tooling.
Field-by-field notes
Register field names come from the EUR-Lex text of the regulation 1.
Scroll horizontally to compare all columns ↔
| Column | Closest register field | Note |
|---|---|---|
vendor, product | B_05.01 Legal name of the ICT third-party service provider | Use the contracting legal entity; keep identifier codes in your master register |
ict_service_type_code | B_02.02 Type of ICT services | One code per row |
supports_critical_or_important_function, function_name | B_06.01 Criticality or importance assessment; Function name | Name the business function, not the tool |
data_categories | B_02.02 Sensitiveness of the data stored | Supports the sensitiveness rating |
data_location_storage, data_location_processing | B_02.02 Location of the data at rest; Location of management of the data | Include remote support access as processing |
subcontractors_cloud_provider | B_05.02 ICT service supply chains | The register ranks each subcontractor |
contract_reference, contract_start, contract_end, notice_period | B_02.02 reference, start and end dates, notice period for the financial entity | Check date and day formats in the template instructions |
exit_plan_exists | B_07.01 Existence of an exit plan | Option list sits in B_99.01 |
last_assessment_date | B_07.01 Date of the last audit; B_06.01 Date of the last assessment of criticality or importance | Add a second date column if the two differ |
concentration_risk_flag | None (internal, DORA Article 29) | Suggested rule: flag when three or more contracts rely on one provider, or the vendor is hard to substitute |
notes | None | Record scoping judgements |
What the worksheet does not do
Next, plan exits with the cloud exit strategy template, check lock-in clauses, and read the DORA guide. Track dates in the deadline tracker.
Martech Vendor Register Worksheet for DORA
Research snapshot checked on . Sort any column and retain source dates when reusing records. iAge dataset reuse terms cover the original compilation; third-party source rights remain separate.
12 of 12 records match.
Scroll horizontally to compare all columns ↔
| Example-AdPlatform-Co | Example advertising platform (audience upload API) | S19 | no | Paid media audience activation | hashed email; hashed device IDs; campaign events | US | US | Example-Cloud-C (S17) | EX-CTR-006 | 2022-05-01 | 2027-04-30 | 30 days | no | 2025-08-01 | no | EXAMPLE ROW. Third-country transfer of hashed identifiers: record the transfer mechanism elsewhere. Whether an advertising service counts as an ICT service is a scoping judgement; record your reasoning. |
| Example-Analytics-Co | Example web and app analytics | S19 | no | Website and app usage measurement | pseudonymous IDs; page events; device data; truncated IP address | DE | DE | Example-Cloud-A (S17) | EX-CTR-004 | 2024-06-01 | 2027-05-31 | 30 days | yes | 2026-02-10 | yes | EXAMPLE ROW. Exit plan exists and is documented; test date not recorded in this sheet. |
| Example-Automation-Co | Example marketing automation suite | S19 | no | Journey orchestration and lead nurturing | contact data; behavioural events; segment membership | NL | NL;US | Example-Cloud-A (S17) | EX-CTR-003 | 2025-01-15 | 2028-01-14 | 90 days | partial | 2026-06-30 | yes | EXAMPLE ROW. Shares a cloud provider with six other example rows, which drives the concentration flag. |
| Example-CDP-Co | Example customer data platform (SaaS) | S19 | tbd | Customer data unification for campaign eligibility | contact data; behavioural events; consent records; pseudonymous IDs | DE;IE | DE;IE;US | Example-Cloud-A (S17); Example-CDN-B | EX-CTR-001 | 2024-03-01 | 2027-02-28 | 90 days | partial | 2026-03-31 | yes | EXAMPLE ROW. US appears as a processing location because of vendor support access. If the platform feeds a critical function (for example vulnerability or fraud flags) set the criticality column to yes. A self-hosted licence would be S13 plus separate rows for hosting (S17 or S07) and any managed service (S14). |
| Example-Chat-Co | Example website chat widget | S19 | tbd | Website chat and first-line customer support | chat transcripts; contact data; IP address; page URL | DE | DE;US | Example-Cloud-A (S17); Example-AI-E (S19) | EX-CTR-012 | 2025-09-01 | 2027-08-31 | 30 days | no | Not published | yes | EXAMPLE ROW. If chat is the main support channel for a regulated service, assess as critical or important. The AI subcontractor adds a rank in the supply chain. |
| Example-CMP-Co | Example consent management platform | S19 | tbd | Capture and enforcement of consent preferences | consent records; pseudonymous IDs; IP address | IE | IE | Example-CDN-B | EX-CTR-005 | 2024-02-01 | 2027-01-31 | 60 days | no | 2026-04-20 | no | EXAMPLE ROW. Consent state drives suppression across channels. If an outage would stop lawful messaging or an online service, assess as critical or important. |
| Example-CRM-Co | Example customer relationship management (SaaS) | S19 | yes | Customer relationship and complaints handling | identity data; contact data; case notes; contract data | DE | DE | Example-Cloud-A (S17) | EX-CTR-007 | 2021-10-01 | 2029-09-30 | 90 days | yes | 2026-05-12 | yes | EXAMPLE ROW. Supports a function the entity classes as critical or important, so contract provisions and exit planning need the stricter treatment. |
| Example-DAM-Co | Example digital asset manager | S19 | no | Brand asset storage and distribution | staff contact data; image-rights metadata; product images | IE | IE | Example-Cloud-A (S17) | EX-CTR-011 | 2023-11-01 | 2028-10-31 | 60 days | partial | 2026-07-15 | yes | EXAMPLE ROW. Low data sensitivity, but the shared cloud provider still counts towards concentration. |
| Example-ESP-Co | Example email service platform | S19 | no | Marketing and lifecycle email delivery | email address; name; engagement events; unsubscribe state | IE | IE;US | Example-Cloud-B (S17) | EX-CTR-002 | 2023-09-01 | 2026-12-31 | 60 days | no | 2025-11-15 | no | EXAMPLE ROW. Contract ends within three months: renewal or exit decision is due. Transactional mail (statements, alerts) needs its own row and assessment. |
| Example-Push-Co | Example push notification service | S19 | tbd | Mobile app push messaging | device tokens; app events; pseudonymous IDs | DE | DE;US | Example-Cloud-B (S17) | EX-CTR-009 | 2024-08-01 | 2027-07-31 | 30 days | no | Not published | no | EXAMPLE ROW. No assessment recorded yet: leave the date blank rather than guessing. |
| Example-SMS-Co | Example SMS gateway | S19 | yes | Transaction alerts and one-time passcodes | mobile numbers; message content; delivery receipts | IE | IE;GB | Example-Telco-D (S10) | EX-CTR-008 | 2023-03-01 | 2027-02-28 | 90 days | partial | 2026-01-20 | tbd | EXAMPLE ROW. The upstream carrier is a subcontractor (S10). One-time passcodes supporting customer authentication may make this critical or important; marketing SMS alone would not. |
| Example-Survey-Co | Example survey tool | S19 | no | Customer feedback and satisfaction collection | contact data; survey responses; free-text comments | NL | NL | Example-Cloud-A (S17) | EX-CTR-010 | 2025-04-01 | 2027-03-31 | 30 days | no | 2025-12-01 | yes | EXAMPLE ROW. Free-text answers can contain special-category data; check data sensitivity before classing this as low risk. |
Dataset notes and field definitions
- LEGEND AND NOTES - delete these lines before import or submission (skip any line starting with #)
- Source: Commission Implementing Regulation (EU) 2024/2956 register of information templates - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2956 - checked 2026-10-17
- ICT SERVICE TYPE CODES (Annex III of 2024/2956; wording abbreviated)
- S01 = ICT project management
- S02 = ICT Development
- S03 = ICT help desk and first level support
- S04 = ICT security management services
- S05 = Provision of data
- S06 = Data analysis
- S07 = ICT and facilities and hosting services (excluding Cloud services) - the official label has a comma after ICT
- S08 = Computation
- S09 = Non-Cloud Data storage
- S10 = Telecom carrier
- S11 = Network infrastructure
- S12 = Hardware and physical devices
- S13 = Software licencing (excluding SaaS)
- S14 = ICT operation management (including maintenance)
- S15 = ICT Consulting
- S16 = ICT Risk management
- S17 = Cloud services: IaaS
- S18 = Cloud services: PaaS
- S19 = Cloud services: SaaS
- supports_critical_or_important_function = yes or no or tbd (your assessment; register field B_06.01 Criticality or importance assessment)
- exit_plan_exists = yes or no or partial or tbd (register field B_07.01 Existence of an exit plan; the official option list is in B_99.01)
- concentration_risk_flag = yes or no or tbd (internal flag for DORA Article 29 assessment; not a register field)
- Locations = ISO 3166-1 alpha-2 country codes separated by semicolons; multi-value cells use semicolons; dates are YYYY-MM-DD
- Rows with vendor names starting Example- are fictitious placeholders: replace every one
- This worksheet is not a submission file: the ESAs expect xBRL-CSV through your national competent authority
General information, not legal advice. Read the supporting analysis.
Frequently asked questions
Do marketing tools belong in the DORA register of information?
The register covers contractual arrangements for ICT services, not only critical ones, and most SaaS marketing tools are ICT services. Scoping edge cases, such as advertising platforms, need a documented judgement. Confirm with your compliance team; this is general information, not legal advice.
Which ICT service type code fits a SaaS email platform?
S19, Cloud services: SaaS. Use S13 for software you license and run yourself, S17 or S18 for the infrastructure or platform underneath, and S14 if a provider operates it for you. One contract may need several rows, one per service type, so the supply chain stays visible.
Is a customer data platform a critical or important function?
Not automatically. The classification depends on the business function it supports, such as fraud signals or regulated customer communications. If an outage would stop a regulated service, treat it as critical or important and apply the stricter contract provisions that follow.
Are martech vendors on the critical ICT third-party provider list?
The first list, published 18 November 2025, named 19 providers such as AWS, Google Cloud, Microsoft, Oracle and SAP, and no martech vendor 3. Your martech vendors may still run on listed providers, so record every cloud subcontractor in the worksheet.
Can I submit this CSV to my regulator?
No. It is a planning sheet with friendlier column names than the official templates, and it carries example rows. Submit through your national competent authority in the prescribed xBRL-CSV format, after mapping each column to its register field and validating the output.
Sources
- Commission Implementing Regulation (EU) 2024/2956, templates and Annex III taxonomy Open source
- CSSF, DORA register of information collection Open source
- First list of critical ICT third-party providers (secondary) Open source
Put this evaluation into practice.
Assess your deployment requirementsThis article is general information, not legal advice.
Further reading
- CDP tools and templates
- Cloud Exit Strategy Template
- Vendor Lock-In in Martech: 9 Clauses
- DORA and Your Marketing Stack: Register
- Customer Data Regulation Deadline
Published: · Updated:
Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.