Feature availability: You need to be on a current Vanta plan and have a privacy framework enabled to use Privacy Management features.

The Data inventory page in Vanta is where you create and manage your organization’s processing activities as part of Privacy Management in Vanta. From this page, you can document how personal data is used across your business, link related vendors and privacy assessments, and export your Record of Processing Activities (ROPA). This central view makes it easier for administrators and privacy teams to stay compliant with privacy regulations like GDPR and respond confidently to audits or data subject requests.

Creating processing activities

Processing activities describe the different ways your organization handles personal data—what you collect, why you use it, who is involved, and where it’s stored. You can create processing activities directly in Vanta or import an existing inventory to get started more quickly. Both options allow you to build and maintain your data inventory.

Adding a processing activity

To add a processing activity to your data inventory:

On the Data inventory page, click the Create processing activity button.
Fill out the required fields: Processing activity name and Data processing purpose.
Click the Create button.
Fill out the processing activity details.

Importing processing activities from a spreadsheet

You can bulk import processing activities from a ROPA spreadsheet (Excel or CSV). This is useful if you currently manage your ROPA outside of Vanta.

To import a ROPA file:

On the Data inventory page, click the down arrow ▼ next to the Create processing activity button.
Select Import from ROPA.
Click Download the Vanta template to prepare your spreadsheet.
Add any custom fields you need in the Settings page before importing.
When you’re ready, upload your spreadsheet and map the columns to Vanta fields.

Helpful tips for importing

Separate multiple values with commas.
Select header rows during import so they aren’t treated as processing activity data.
Use ISO three-letter country codes for data locations (ex: USA, JPN, GBR).

Deleting a processing activity

To delete a processing activity:

Open the processing activity.
Click the ••• more menu.
Select Delete.
Review the warning to confirm you understand the action is permanent, then click the Delete button.

Once deleted, the activity will be removed from any linked impact assessments or processing vendors.

Editing processing activity details

Once you’ve created processing activities, keep them up to date by reviewing and completing their details. From the Processing activities tab, select a processing activity to update its fields, add or remove linked vendors, and manage any associated impact assessments.

Filling out default fields

Vanta provides default fields to help you describe each processing activity.

Only the processing activity name and data processing purpose are required to create a processing activity.
All other fields are recommended to help you document additional details as you learn them.
Hover over the ⓘ info icon to learn more about the purpose of a field.

Managing custom fields

You can define custom fields for processing activities to capture information that isn’t included in Vanta’s default fields. This helps you maintain extra details that are specific to your organization’s privacy program.

To create a custom field:

In your account header, click the Settings icon, scroll to the Features section, and select Privacy.
In the Custom processing activity fields section, click the Add field button.
Enter a Label to name the field.
Enter a Description to appear within a processing activity when someone hovers over the ⓘ info icon.
Select the Field type (text, number, date, or multi-select)—you can’t edit this selection after creating the field.
Choose the Processing section, which determines where the field should appear within a processing activity.
Click the Update button to save the custom field so you can begin using it.

Linking assessments

To link assessments to a processing activity:

Open the processing activity details.
Scroll to the Assessments section.
From here you can:
- Create a new assessment, which will be added to the Assessments tab.
- Select from library to link an existing assessment from the Assessments tab.
- Upload to import a document, which will not be added to the Assessments tab.

Linking processing vendors

To link a vendor (or subprocessor) to a processing activity:

Open the processing activity details.
Next to the Processing vendors section, click the ✎ pencil icon.
Search by vendor name and select the vendors (note: requires the vendor to already exist in your vendor list).

Using your data inventory

On the Data inventory page, you can view your processing activities, see details by vendor, and view your ROPA.

Location	Description
Processing activities tab	View the processing activities your business performs, search and filter activities, and create or update processing activities.
Processors tab	View the vendors processing data on your behalf, search and filter processors, and see which processing activities each vendor supports.
View ROPA button	View your processing activities in a ROPA-style table and export your ROPA as an Excel file.

Viewing processing activities

The Processing activities tab displays the complete list of activities in your organization. From this page, you can:

Search or filter activities
Open an activity to review its details
Edit activity information as your processes change
Archive activities that are no longer in use

Viewing processors

If you link processors to processing activities, the Processors tab shows all third-party vendors that process personal data on your behalf. From this page, you can:

Review which vendors handle personal data
See activities linked to each vendor
Open vendor profiles

Exporting a ROPA

Click the View ROPA button to view your processing activities in a ROPA-style table and export your ROPA as an Excel file. You can export this view to Excel to share with auditors or regulators. The exported ROPA includes all required GDPR Article 30 fields and reflects any updates you make in the Data Inventory.

Managing Your Data Inventory & ROPAs