Tools and providers
Part of How to procure digital PR outreach
What should digital PR vendor due diligence cover before signing?
Due diligence checklist for digital PR vendors in England: lawful basis for outreach data, quality audits, ad code compliance, insurance and contract terms.
What to take away
- Of the 5,889 complaints the Advertising Standards Authority resolved in 2024, roughly two thirds concerned misleading claims, many involving undisclosed paid or advertorial content, so check how a vendor labels commercial coverage before you brief them.
- Ask which lawful basis the vendor relies on for outreach data. The ICO's guidance on choosing your lawful basis for direct marketing sets out when consent is required and when legitimate interest can apply.
- Request evidence of a quality management system. BSI's quality management pages explain what certification and audit involve, which helps you judge whether a vendor's process claims hold up.
- Test whether the vendor can explain, in plain terms, how it applies the CAP and BCAP advertising codes to native advertising and endorsements.
- Agree exit terms, data deletion and link removal rights in writing before the first campaign goes live.
Company and ownership checks
Start with Companies House. Confirm the registered number, filing history and any charges. A vendor trading under a different name to the entity you are paying is a warning sign.
Company and ownership checks
- Confirm registered number at Companies House
- Review filing history and charges
- Check county court judgments
- Check insolvency notices
- Identify ultimate owner and parent
- Flag trading name mismatch
Check for county court judgments and insolvency notices. Ask who owns the business and whether a parent company sits outside the UK, which affects where disputes are heard.
Data and outreach compliance
Digital PR runs on media lists, journalist contacts and prospecting data. Ask where the vendor sources each list and whether recipients opted in.
Lawful basis for outreach data
Can the vendor name its lawful basis in one sentence?
proceed and record the basis
treat as inherited compliance risk
The ICO distinguishes consent from legitimate interest, and the right basis depends on the channel and audience. A vendor that cannot name its basis in one sentence is a risk you inherit.
For a fuller picture of how supplier compliance sits alongside pricing and reporting, work through the digital PR tools and supplier guide before you shortlist.
Quality systems and audits
Ask whether the vendor holds certification to a recognised quality standard, and which one. Certification means an external body has audited the management system, not that every campaign succeeds.
Request the scope statement. A certificate covering one office or service line does not cover the team doing your work. Check the expiry date and certification body.
If the vendor has no certification, ask what internal checks exist: editorial sign-off, fact-checking, correction logs and named account leads.
Editorial standards and disclosure
Paid placements, advertorials and affiliate arrangements must be labelled clearly. The advertising codes cover native advertising and endorsements, so the vendor should be able to show how it briefs publishers on disclosure.
Ask for two recent examples where a client requested a change after publication, and how the vendor handled it.
Commercial and contract terms
Confirm what is included: research, writing, outreach, reporting and any tools. Ask whether link placement fees are passed through at cost or marked up.
Check payment terms, notice periods and whether the vendor can subcontract. If it can, ask who approves subcontractors.
Security, insurance and continuity
Request professional indemnity and public liability cover with limits and expiry dates. Ask how client data is stored, who can access it and what happens on termination.
Test continuity. If the account lead leaves, who takes over and how is knowledge transferred?
Decision table
Choose
- Regulated sector client
- Vendor with documented lawful basis and sector references
- High-volume outreach
- Certified process with audit trail
- Small pilot budget
- Fixed-scope trial with clear exit terms
- Paid placements involved
- Vendor that labels advertorials correctly
Avoid
- Regulated sector client
- Vendors relying on purchased lists
- High-volume outreach
- Vendors with no editorial sign-off
- Small pilot budget
- Annual retainers with long notice
- Paid placements involved
- Vendors promising undisclosed links
Questions to ask references
Ask two client references how the vendor handled a correction, a missed deadline and a change of account lead. Vague answers are informative.
Compare answers across three or four vendors side by side rather than judging each in isolation, using this supplier comparison in England to keep scoring consistent.
Common questions
Does due diligence differ for agencies and freelancers?
The checks are the same. Freelancers may lack certification and insurance, so ask for evidence directly and consider a shorter initial contract.
How long should the process take?
For a mid-sized retainer, allow two to three weeks. Rushing the contract stage usually costs more later than the delay costs now.
What if a vendor refuses to share its data sources?
Treat it as a red flag. You cannot assess lawful basis or reputational risk without knowing where contact data came from.
Do I need a separate data processing agreement?
If the vendor handles personal data on your behalf, yes. Ask your legal adviser to review it alongside the main contract.
