Tools and providers
Part of When to review your professional services marketing tools and providers
Professional services marketing vendor due diligence explained
A professional services marketing checklist for vetting vendors, covering UK data protection and anti-bribery law, contract safeguards and review records.
What to take away
Professional services marketing vendor due diligence is the documented process a firm runs before signing with an agency, platform or contractor, covering data protection, anti-bribery controls, commercial terms and exit routes.
- Check the vendor against UK GDPR and the Data Protection Act 2018, including its ICO register of fee payers entry where required, before client data moves.
- Assess the Bribery Act 2010 risk and ask about adequate procedures; ISO 37001 can support the evidence but is not the law.
- Match spend to channelLinkedIn Text Ads suit low-cost B2B testing, but still need a named budget owner.
- Record who approved the vendor, on what evidence, and when the file was last reviewed.
- Set a review date before renewal, not after.
Why run due diligence at all
Professional services buyers sell expertise, so a vendor failure becomes a client-facing problem. A data breach at an agency handling matter files is your regulatory exposure, not theirs alone.
Under UK GDPR and the Data Protection Act 2018, you retain responsibility for your controller duties when an agency processes personal data on your instructions. The ICO's controllers and processors guidance explains the role split; a written data processing agreement sets the processor's obligations, and the contract, not the pitch deck, decides your risk.
A short, evidence-based check at selection also protects fee earners' time and avoids a longer dispute at renewal. The tools and supplier guide maps the vendor categories; the checklist below sets out the evidence to collect for whichever type you choose.
The pre-contract checklist
Work through these in order and keep the evidence in one file.
Pre-contract vendor checks
- Legal entityCompanies House filing history
- Data protectioncontroller, processor, sub-processors
- Anti-briberyISO 37001 or equivalent policy
- Insuranceprofessional indemnity and cyber cover
- Referencestwo similar clients, recorded
- Financial healthlatest filed accounts
- Exit termsnotice, data return, handover
- Legal entity.Confirm the registered name and number with Companies House, and check the filing history for late accounts.
- Data protection and security.Establish controller and processor roles, sub-processors and data locations. Check the vendor's entry on the ICO register of fee payers if it is required to pay the data protection fee. Agree a written data processing agreement meeting UK GDPR Article 28. For a restricted transfer outside the UK, identify and document the applicable safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Set a contractual breach notification deadline in hours, require a current sub-processor list and change notices, and include an audit right. Ask for ISO 27001 or Cyber Essentials evidence where proportionate; certification does not replace legal duties.
- Anti-bribery.Assess the Bribery Act 2010 risk. For a commercial organisation, adequate procedures are the defence to the section 7 offence of failing to prevent bribery by an associated person. Ask for evidence of controls covering gifts, hospitality and intermediary payments. ISO 37001 is a voluntary standard and can support, but does not replace, those controls.
- Insurance.Obtain current professional indemnity and cyber policy schedules. Record the limits and excesses in pounds sterling, check exclusions, and compare the cover with your exposure and contract obligations; set requirements for the risk rather than assuming a universal limit.
- References.Speak to two clients of similar size and sector, and record what they said.
- Financial health.For contracts above your internal threshold, request the latest filed accounts.
- Exit terms.Agree notice periods, data return formats, deletion of remaining copies and handover support before signature.
Comparing vendor types
The depth of check should match the risk, not the invoice value. The review cycles in the table are practical prompts, not statutory deadlines: base the frequency on data access, service criticality and the consequences of failure, and review sooner if those risks change.
Vendor type vs evidence
Vendor type
- Freelance copywriter
- Data terms, references
- PR agency
- ISO 37001, media lists
- CRM or email platform
- Security cert, sub-processors
- Paid media agency
- Budget controls, ad account
- Research supplier
- Panel consent, retention
Key evidence
- Freelance copywriter
- Annual
- PR agency
- Annual
- CRM or email platform
- Every contract term
- Paid media agency
- Six-monthly
- Research supplier
- Per project
Review cycle
- Freelance copywriter
- PR agency
- CRM or email platform
- Paid media agency
- Research supplier
| Vendor type | Key evidence | Typical review cycle |
|---|---|---|
| Freelance copywriter | Data processing terms, references | Annual |
| PR agency | ISO 37001 status, media list handling | Annual |
| CRM or email platform | Security certification, sub-processor list | Every contract term |
| Paid media agency | Budget controls, ad account ownership | Six-monthly |
| Research supplier | Panel consent records, retention policy | Per project |
For example, a firm paying £2,000 a month to a paid media agency should confirm who owns the ad account, because losing access mid-campaign costs more than the fee.
Red flags to act on
A vendor who will not name sub-processors is a data protection risk you cannot price. Walk away or insist on a restricted list.
Pressure to sign before references are taken usually signals a weak pipeline, not urgency on your side.
Payment requests to a personal account, or invoices from an entity that differs from the contracting party, warrant a stop and a check. Anti-bribery controls exist for exactly this pattern.
If the vendor cannot describe their own retention schedule in one sentence, assume data is kept indefinitely.
Documenting the decision
Keep a one-page record per vendor: scope, evidence seen, data flows and transfer safeguards, contract protections, risks accepted, approver and date. Record why the chosen review cycle is proportionate, and have a partner or operations lead sign it.
This record matters at renewal, and it supports your position if a regulator or client asks how a supplier was selected.
Record who owns the handover into implementation as part of the vendor decision. The tool implementation guide covers migration, training and the first 90 days, which is where most value is lost.
Common questions
How long should due diligence take?
For a low-risk freelance contract, a day is realistic. For an agency handling client data, allow two to three weeks so references and certificates can be verified properly.
Does a small firm need the same checks?
The evidence can be lighter, but the questions stay the same. Data protection duties depend on the firm's role and the personal data it processes; the Bribery Act 2010 applies to commercial organisations within its scope, regardless of headcount.
Who should own the vendor file?
Operations or practice management usually holds it, with a partner signing off. Avoid letting the fee earner who championed the vendor also approve the risk.
When should the file be refreshed?
At renewal, on any ownership change, or after a breach or complaint. A fixed annual date is simpler to enforce than an event-based trigger.
