Add documents to vendors

Compliance officers, DPOs, and risk managers use the Documents tab on a vendor record to attach policies, Data Processing Agreements, and other key documents directly to that vendor — so that everything auditors need is in one place, not scattered across the system.

The Documents tab on a vendor's detail page is where you build the documentary evidence trail for that vendor. Instead of hunting through the Policies & Documents module every time an auditor asks "where is the DPA for Acme Processing?", you link the relevant documents directly to the vendor record. From that moment on, anyone who opens the vendor can see its attached documents at a glance. This tab sits alongside the vendor's general information, criticality scores, assessments, and risk scenarios, completing the due-diligence picture that GDPR Article 28 and similar regulations require for third-party processors.

How to open it

In the main sidebar, click Vendors.
Click on any vendor row to open its detail page.
In the left-side tab menu, click Documents.

The breadcrumb bar at the top of the page will show Vendors › [Vendor Name] › Documents, with "Documents" highlighted in blue to confirm you are on the right tab.

Access note: You need at least read access to Vendors to reach this page. To link or unlink documents you also need edit access to Vendors. If the Add button or the row action menus are missing, your account likely has read-only access — ask your DPMS administrator to check your permissions.

What you see

The page follows DPMS's standard two-column vendor layout. On the far left is a collapsible navigation panel listing all vendor tabs (General, Documents, Criticality, Assets, Transfers, Tasks, Assessments, Risk, Workflows). Click the small circle icon at the very left edge to expand or collapse this panel — useful when you want a wider table view on a smaller screen.

Running across the top of the content area is the breadcrumb bar. Alongside the vendor name you will notice a pair of left and right chevron arrows. These let you jump straight to the previous or next vendor in your current filtered list without going back to the Vendors index — handy when you are auditing documents across a batch of vendors.

The sticky bar just below the breadcrumb always shows the vendor's responsible person(s), its lifecycle status (Draft, Active, Inactive, Review, etc.), and a clock icon on the right. The clock opens the Activity Log, a slide-in panel listing every change ever made to this vendor record — useful if you need to prove when a document was linked.

Below the sticky bar is the main document table. When documents are already linked, each row shows the document's name, status, responsible person, classification tags, and last-updated date. If nothing has been linked yet, the table shows an empty-state prompt encouraging you to add your first document.

Working with this screen

Linking an existing document to a vendor for the first time

The most common task here is attaching a document that already exists in your DPMS Policies & Documents library — for example, a freshly signed Data Processing Agreement.

Click the Add button above the document table. A search panel opens showing all available documents from the Policies & Documents module.
Type part of the document's name into the search bar to narrow the list. For example, typing "Data Processing" will filter down to all DPA-type documents.
Tick the checkbox next to the document(s) you want to attach to this vendor. You can select multiple documents at once.
Click Add to list to confirm. The panel closes, and the selected documents appear immediately in the vendor's document table.

From this point on, any reviewer who opens this vendor will find the document listed here. If the document is later updated in the Policies & Documents module — for example its status changes from Draft to Active — that change will be reflected here automatically on the next page load, because the link is a live reference, not a copy.

Heads up: If the document you need does not exist in the system yet, you cannot create it from this tab. You must first go to Policies & Documents, create the document record there, and then come back here to link it. See the "Tips & common pitfalls" section below for the recommended order of operations.

Creating a brand-new document and linking it

If your organisation's workflow involves creating documents directly from the vendor context, DPMS provides a document creation flow accessible from the same Documents tab area. Clicking the upload/create option (where available) opens a form where you can fill in:

The responsible person for the new document
The status (e.g. Draft)
A classification attribute to tag the document type
The actual file, which you can drag and drop into the upload area or select from your file system

Once saved, the new document is created in the Policies & Documents module and simultaneously linked to this vendor. You can then find and manage it in full detail from the Policies & Documents section.

Removing a document that is no longer relevant

Annual reviews often surface documents that should no longer be attached to a vendor — an expired policy, a superseded agreement, or a document linked by mistake.

In the document table, hover over the row for the document you want to remove.
Click the three-dot menu (⋯) that appears at the right end of the row.
Click the trash bin icon to unlink the document. A green confirmation check mark confirms the action was successful.

The document disappears from the vendor's table immediately. Importantly, the document itself is not deleted — it remains fully intact in the Policies & Documents module and can be linked to other vendors or objects at any time. Unlinking simply removes the association.

Heads up: There is no undo button after unlinking. If you remove a document by mistake, simply click Add again and re-link it.

Auditing documents across multiple vendors quickly

After a security incident or during a periodic review, you may need to check that a specific policy (for example, an Information Security Policy) is linked to every one of several critical vendors.

Open the first vendor's detail page and click Documents.
Scan the table to confirm the policy is present. If it is missing, click Add, find the policy, and link it.
Instead of clicking back to the Vendors index, click the right chevron arrow (›) next to the vendor name in the breadcrumb. This jumps you directly to the next vendor in your current sorted/filtered list.
Repeat the check (and link if needed) for each subsequent vendor.

This chevron navigation keeps you in the Documents tab context as you move from vendor to vendor, saving a significant number of clicks during bulk audits.

Viewing a historical snapshot with Time Machine

If a regulator asks "what documents did you have linked to this vendor six months ago?", you can use the DPMS Time Machine feature to answer that question without any risk of accidentally changing current data.

When Time Machine is active (indicated by a date-selection banner at the top of the vendor page), the Documents tab switches to a fully read-only state: the Add button disappears, the three-dot action menus on document rows are hidden, and clicking a document row no longer navigates to the document's detail page. You can scroll through the historical document list freely. To restore full edit access, deactivate Time Machine.

Field reference

When creating a new document from within the vendor's Documents tab, you will encounter the following fields:

Responsible person — The person accountable for this document within your organisation. Required. Select from your organisation's user list.
Status — The lifecycle stage of the document (e.g. Draft, Active, Inactive). Required. Choose the stage that reflects the document's current state.
Classification — Optional tags or attribute values that categorise the document (e.g. "Legal", "Security", "HR"). These help with filtering in the Policies & Documents module.
File upload — The actual document file. Drag it into the upload area or click to browse. Accepted formats and file-size limits follow your organisation's DPMS configuration.

How this connects to the rest of DPMS

The Documents tab sits in the middle of two important flows.

Coming in: Documents you link here originate from the Policies & Documents module. Any status change, responsible-person update, or content revision made to a document in that module is instantly reflected here when the vendor page reloads — there is no manual sync step required.

Going out: Clicking any document row opens that document's full detail page in the Policies & Documents module, where you can review its approval history, download the attached file, or update its metadata.

Outside the documents themselves, this tab affects two broader workflows. First, vendor risk reviews: while linked documents do not feed a numeric risk score directly, reviewers and auditors typically expect to see a DPA and at least a security policy linked before they mark a vendor as Active. Second, organisation sharing: if your organisation shares a vendor record through the DPMS portal, linked documents are visible to the recipient in read-only mode — so what you attach here may be seen by an external party.

Tips & common pitfalls

Heads up: Unlinking is not deleting. Clicking the trash icon on a document row removes only the link between the vendor and the document. The document survives untouched in the Policies & Documents module. Do not use unlinking as a way to "archive" or "delete" documents — go to Policies & Documents for that.

Tip: If the Add button has vanished, check whether Time Machine is switched on. A date-range banner near the top of the vendor page is the tell-tale sign. Deactivating Time Machine immediately restores all edit controls.

Read-only users see the list but not the buttons. If a colleague reports that they can see the document table but cannot add or remove anything, they have read-only Vendor access. An administrator can grant edit access from the user management settings.
"Select All" only selects what is currently filtered. In the Add documents modal, if you check Select All while a search filter is active, only the documents matching that filter will be linked — not every document in the system. Clear the search field before selecting all if you genuinely want to link everything.
Create the document first, then link it. There is no "create and link" shortcut directly on this tab (unless your DPMS configuration includes the create-document flow described above). If you try to link a document that does not yet exist, it will not appear in the search list. Go to Policies & Documents first, create the record, then come back here to attach it.
Tab memory after navigating away. When you click a document row and then use the browser back button, DPMS should return you to the Documents tab. However, if you navigate to a completely different module in between, the system may drop you back on the General tab instead. Simply click Documents in the left-side menu again to return.