Supplier register template
One list of everyone the company pays, with the contract, the renewal date, the owner and the three checks UK law attaches to suppliers: data processing, contractor status and bribery risk.
A supplier register is a single list of every supplier a company uses, showing who owns the relationship, what the contract says, when it renews and which compliance checks have been done. No UK law requires the register itself, but several duties are far easier to meet with one: a written contract with every supplier that processes personal data, keeping accounting records for six years, deciding the tax status of contractors if you are a medium or large client, and having adequate procedures against bribery. The download has 16 columns and three example rows.
Download the register CSV · opens in Excel, Numbers or Google Sheets
What columns does a supplier register need?
| Column | What to record |
|---|---|
| Supplier ID | Your own reference, so that a renamed supplier keeps its history |
| Supplier name | The legal name on the contract and invoices, with company number |
| What they supply | One line: payroll bureau, office cleaning, design contractor |
| Category | Software, professional services, facilities, contractor, goods |
| Internal owner | The named person who decides whether to renew |
| Supplier contact | Account manager name, email and phone |
| Contract start | Date the current term began |
| Renewal or end date | The date the term ends or renews automatically |
| Notice period | How much notice stops a renewal, and the last date to give it |
| Annual cost | Excluding VAT, with the billing frequency |
| Payment terms | Days from invoice, as the contract states |
| Processes personal data? | Yes or no, and whose: staff, customers or both |
| Data processing agreement | Date signed and where it is filed |
| Insurance and certificates | What you have on file and its expiry date |
| Contractor status check | For individuals working through their own company: date of the status decision |
| Where the contract is filed | Link or folder, so the next person can find it |
Add a risk rating or a last-reviewed date if you will use them. Do not add columns nobody will maintain; a register that is half empty is trusted less than one with fewer fields.
Which UK rules does a supplier register help you meet?
| Duty | Who it applies to | Column |
|---|---|---|
| A written contract with every data processor | Every organisation that uses one | Personal data; data processing agreement |
| Keep accounting records for six years | Every limited company | Where the contract is filed |
| Decide contractors' employment status for tax | Public sector clients, and medium and large private and voluntary sector clients | Contractor status check |
| Adequate procedures to prevent bribery | Every commercial organisation | Category; internal owner |
| Annual modern slavery statement | Turnover of £36 million or more | Category; what they supply |
| Pay on time, or owe statutory interest | Every business customer | Payment terms |
- Data processors. The regulator's guidance is unambiguous: "Whenever a controller uses a processor, there must be a written contract (or other legal act) in place." Your payroll bureau, HR system, IT support and cloud storage are all processors. The register is also most of the supplier side of your record of processing; see the employee privacy notice template.
- Records. gov.uk says a company "must keep records for 6 years from the end of the last company financial year they relate to", including "all money spent by the company, for example receipts, petty cash books, orders and delivery notes". It adds: "You can be fined £3,000 by HMRC or disqualified as a company director if you do not keep accounting records."
- Off-payroll working (IR35). gov.uk: "The rules apply to all public sector clients and medium and large-sized private and voluntary sector clients." A small client does not have to determine status. On gov.uk's current client guidance a company stops being small when it meets two or more of: annual turnover of more than £10.2 million, a balance sheet total of more than £5.1 million, more than 50 employees. The money thresholds rise to £15 million and £7.5 million for financial years beginning on or after 6 April 2025, and HMRC's manual says the earliest tax year that affects a client with a 12-month year is 2027-28.
- Bribery. Under section 7 of the Bribery Act 2010 a company's defence to failing to prevent bribery is that it "had in place adequate procedures". The Ministry of Justice guidance says contractors can be "associated" persons, and so can a supplier that "can properly be said to be performing services for a commercial organisation rather than simply acting as the seller of goods". Agents and intermediaries deserve the closest look.
- Modern slavery. A statement is required each financial year from an organisation that carries on business in the UK, supplies goods or services and "has an annual turnover of £36 million or more". Smaller companies are often asked about their own supply chain by customers who are over the line.
- Late payment. Statutory interest is "8% plus the Bank of England base rate for business to business transactions". An agreed payment date "must usually be within 30 days for public authorities or 60 days for business transactions", and with no agreed date payment is late 30 days after the invoice or delivery. A Bill to tighten these rules was introduced in May 2026 and is not yet law.
How do you build the register?
- Start from the money. Export twelve months of payments from your accounting system and list every payee. This finds the suppliers nobody remembers signing.
- Add the card and expense subscriptions. Software bought on a company card rarely appears as a supplier account.
- Give every row an owner. An unowned supplier is a renewal nobody decided on.
- Find the contract and read three things: the end date, the notice period and whether it renews automatically.
- Mark who touches personal data and chase any missing data processing agreement.
- Put the notice deadlines in a calendar, not just the renewal dates. The deadline that matters is the last day you can say no.
How do you keep a supplier register accurate?
- No purchase order or card payment for a new supplier without a row. Make the register the gate.
- Review it quarterly against the payments export; ten minutes finds the drift.
- Check it when someone leaves. Leavers own suppliers and hold logins. Add the check to the offboarding checklist.
- Close rows, do not delete them. Keep ended suppliers with an end date for the six-year record period.
- Keep it beside the asset register. Leased equipment and software licences appear in both.
Buying HR software is one of these rows. The requirements checklist and the guide to switching HR software cover what to ask about notice, renewal and getting your data out.
Frequently asked questions
What is a supplier register?
A single list of every supplier a company uses, recording who owns the relationship, what is supplied, the contract dates and notice period, the cost, and compliance checks such as data processing agreements and insurance.
Is a supplier register a legal requirement in the UK?
No law requires the register itself. It helps meet duties that are legal requirements, including a written contract with every data processor and keeping company accounting records for six years.
Do you need a contract with a supplier that handles personal data?
Yes. Whenever a controller uses a processor there must be a written contract or other legal act in place, under Article 28 of the UK GDPR. That includes payroll bureaux, HR systems and IT support providers.
How long must a company keep supplier invoices?
A limited company must keep its accounting records, including records of all money spent, for six years from the end of the last company financial year they relate to. HMRC can fine a company 3,000 pounds for not keeping accounting records.
Which companies must publish a modern slavery statement?
Organisations that carry on business in the UK, supply goods or services and have an annual turnover of 36 million pounds or more must publish a slavery and human trafficking statement for each financial year.
Sources
Checked against the primary source on 5 October 2026.
- ICO: contracts - the written contract with a processor
- gov.uk: company and accounting records - what to keep, for six years, and the penalty
- gov.uk: off-payroll working for clients - which clients must decide status
- HMRC Employment Status Manual, ESM10006A - the new size thresholds and when they take effect
- Bribery Act 2010, s.7 - failure to prevent bribery and adequate procedures
- Ministry of Justice: Bribery Act 2010 guidance - contractors and suppliers as associated persons
- gov.uk: publish an annual modern slavery statement - the 36 million pound threshold
- gov.uk: late commercial payments - statutory interest and payment periods
This is general guidance for UK employers and is not legal advice. Take advice on anything contested, unusual or expensive.
More to download: All 44 templates · 79 guides explaining the rules · 27 calculators
The registers a company runs on, in one place
CoDash is the company dashboard for UK teams of 20 to 1,000: people, policies, assets and compliance registers together, so the list of who has what and who owns what is never a spreadsheet on one person's laptop.
Explore a live, safe sandbox