Vendor privacy contact sheet: each supplier's DPO, privacy or grievance inbox from its own website, with the page it was found on and a re-check date

Updated 27 Oct 2026 · Disclosure: the website contact scraper linked below is an Unadhi product on the Apify Store. This guide is free, and the sheet also works if you copy contacts from each vendor's privacy policy by hand. Current Apify pricing is only on the Store page. This page has no affiliate links and nobody paid to be mentioned. This is not legal advice.

The finished sheet

privacy tab (example rows are made up)

The six-month re-check is our working rule, not a legal deadline. Change it in one cell if you prefer every three or twelve months.

Why keep vendor privacy contacts in one place

• A vendor has a breach. Under GDPR Article 33(2), a processor must notify the controller (you) without undue delay after becoming aware of a personal data breach. You then have your own 72-hour clock under Article 33(1). Knowing who to write back to at the vendor saves hours. Our 72-hour breach sheet covers your side.
• A customer asks for their data. Article 28(3)(e) says the processor contract must require the processor to help you answer data subject requests. You still need to reach the right team.
• The vendor has to publish it anyway. Under Article 37(7), a controller or processor that has a data protection officer must publish the DPO's contact details, and Article 13(1)(b) puts the DPO's contact details in the privacy notice where there is one. So the contact you need is usually already on the vendor's own website.
• India: Rule 9 of the Digital Personal Data Protection Rules, 2025 requires every Data Fiduciary to prominently publish on its website or app the business contact information of its DPO, if it has one, or of a person who can answer questions about processing. Rule 9 is in the group that comes into force eighteen months after the Rules were published on 13 November 2025, which works out to 13 May 2027. Until then many Indian vendors will list a grievance officer or a general inbox instead.

The sheet sits next to your record of processing. If you are building that too, see the Article 30 records of processing sheet and the Article 28 processor agreement check sheet.

Step 1: list your vendors in a tab named vendors

The quickest way to find vendors is your last 12 months of card and bank statements plus the "connected apps" page of your email and website tools.

Step 2: run the contact scraper on the vendor websites

Open the website contact scraper on the Apify Store and paste column B into urls (one per line). What it does, as written in the Actor's input schema and code on 27 October 2026:

• Reads the homepage, then the most contact-like pages first. Contact and imprint pages rank highest; links with privacy, legal, about or support in them come next. maxPagesPerSite is 4 by default. For this job set it to 8 so the privacy policy page is more likely to be read.
• Returns only shared role inboxes. dpo@, privacy@, dsar@, dsarequests@, grievance@, nodal@, legal@, compliance@ and security@ are all on its role list. dataprotection@ and gdpr@ are not on the list, so with personal emails off they are dropped and only counted in personalEmailsDropped. If that count is above 0, open the privacy policy and check.
• Records the page each inbox was found on (emails/N/foundOn) and whether the domain can receive mail (emails/N/mxValid).
• Follows robots.txt and reads each site's terms. Many large software companies' terms forbid scraping, so expect some rows to come back as blocked-by-terms, blocked-by-tos-list or blocked-by-robots. Those are not charged; you copy their contact by hand.

When the run finishes, export the dataset as CSV, then in your sheet use File → Import → Upload, "Insert new sheet", and rename it scrape. Nested fields become headers like emails/0/email and emails/0/foundOn, so the formulas below find columns by header name, not by position.

Free route

For ten vendors, open each privacy policy, search the page for "@", and type what you find into a scrape tab with the headers domain, status (type ok), emails/0/email, emails/0/foundOn, emails/1/email, emails/1/foundOn and so on. The formulas work the same.

Step 3: build the privacy tab

Create a tab named privacy, put these headers in row 1 and these formulas in row 2, and fill down as many rows as scrape has.

Notes on the formulas:

• Column K finds the header of the best inbox (for example emails/3/email), swaps it for emails/3/foundOn and returns that page, so you can show where the contact came from.
• Join the two tabs with the vendor name if you like: in vendors, =IFERROR(INDEX(privacy!$I:$I, MATCH("*"&REGEXEXTRACT(B2, "//(?:www\.)?([^/]+)")&"*", privacy!$A:$A, 0)), "") pulls the best contact next to each vendor.
• If emails/N/mxValid is FALSE for the inbox you picked, that domain has no mail server. Use the vendor's support form or account manager instead.

Step 4: fix the Weak and Missing rows

• Open the vendor's privacy policy and search for "data protection officer", "DPO", "grievance officer" or "privacy". Copy the inbox into the scrape tab by hand.
• Look for a privacy request form. Many larger vendors use a web form instead of an inbox; paste the form link into column I and type Form in column J.
• Still nothing: write to your account manager or support and ask, in writing, which address to use for data protection requests and breach notices. Put the answer in the sheet with today's date.
• Processors you rely on heavily (payroll, CRM, AI tools that see customer data): check the signed data processing agreement too. It often names a notice address that is different from the website.

Step 5: use it

Add a tab named plan. In A1: =QUERY(privacy!A2:P, "select P, count(A) where A is not null group by P order by count(A) desc label P 'Next step', count(A) 'Vendors'", 0). Work the Skipped, Missing and Weak rows first. Put a calendar reminder on the earliest Re-check on date.

Keep the sheet with the people who answer customer data requests. It holds only shared company inboxes, not anyone's personal address.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

• GDPR Article 13(1)(b), Article 28(3)(e), Article 30, Article 33(1) and (2), Article 37(7): gdpr-info.eu (read 27 October 2026).
• Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025), rule 1(4) commencement and rule 9 contact information: MeitY.
• Contact scraper inputs and outputs (urls, maxPagesPerSite default 4, includePersonalEmails off by default, role inbox list incl. dpo, privacy, dsar, grievance, nodal, legal, compliance, security; foundOn, mxValid, personalEmailsDropped, statuses blocked-by-terms, blocked-by-tos-list, blocked-by-robots): Apify Store listing and the Actor's input schema and code.
• Google Sheets INDEX/MATCH, FILTER, REGEXEXTRACT, EDATE and QUERY functions: Google Docs Editors Help.

Related

• GDPR Article 30 records of processing sheet
• GDPR Article 28 processor agreement check sheet
• Personal data breach 72-hour sheet
• Supplier bank details change call-back sheet
• Clean a contact CSV into a call sheet

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.