Tools and providers
Part of Buy a single platform or assemble a stack? Choosing content agency tools and providers
Before you sign, run content agencies vendor due diligence
A checklist for content agencies vendor due diligence in England: company records, regulatory status, ad tech claims, data protection and contract questions.
What to take away
- Most teams treat due diligence as an end-of-process reference check rather than checks that run alongside shortlisting.
- Four checks catch most problems earlycompany records, regulatory status in regulated sectors, data protection arrangements, and evidence behind any ad tech claim.
- Ask every shortlisted agency for its subcontractor list. Undisclosed freelancers and offshore production are a frequent source of delivery slippage.
- Put the answers in writing before you compare price. A cheaper quote with weaker answers is not a cheaper supplier.
Start with company records
Begin with the legal entity, not the trading name. Search Companies House for the registered number, then check filing history, accounts and any change of name. A trading name that does not match the contracting entity needs resolving before you exchange drafts.
Company records checks
- Search Companies House for registered number
- Check filing history and accounts
- Check any change of name
- Resolve trading name mismatch
- Confirm signer's authority in writing
Check who signs. If the person negotiating is not a director or lacks delegated authority, ask for written confirmation of their authority. This prevents signature delays later.
Check regulatory and sector fit
Where the work touches communications services, first identify the regulated activity; a content agency does not need a broadcast licence merely because it creates content. If it operates a television service, check whether an Ofcom television broadcast licence is required and verify any claimed licence against Ofcom's television broadcast licensing records. The Ofcom organisation page sets out the regulator's remit, but does not prove that a particular agency holds a licence.
For financial services clients, ask how the agency handles financial promotions approval. For health clients, ask about advertising codes. Ask for the named person who signs off regulated copy.
Check ad tech and martech claims
Many agency pitches include a distribution or measurement platform. Ask which parts are owned, licensed or resold. The IAB UK programmatic guide explains how programmatic buying works, which helps you test whether a claimed capability is genuinely in-house.
Where a partner badge is used, verify it. The LinkedIn Marketing Partners directory lists recognised partners, so a claimed badge can be checked against the register rather than taken on trust.
Our wider content agencies tools and supplier guide sets out how platform decisions fit into a full procurement plan.
Data protection and security
Ask for the agency's data processing agreement template before contract stage, not after. Check whether it identifies controller and processor roles, names subprocessors, says where data is stored, and explains how deletion works at the end of the engagement. Confirm the agreement addresses the UK GDPR and Data Protection Act 2018; the Information Commissioner's Office (ICO) is the UK's data protection regulator. If personal data will be transferred outside the UK in a restricted transfer, ask which safeguard applies, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
Request its latest security questionnaire responses covering access control, device management and incident reporting. If the agency cannot produce these, treat that as an answer in itself.
The worked example
A mid-sized retailer shortlisted three agencies for a twelve-month content programme. Quotes were £4,200, £3,600 and £5,000 a month.
The cheapest had filed late accounts twice and could not name its subprocessors. The middle quote came from an entity whose trading name did not match the contracting company. The highest came from an agency with a completed security questionnaire, a named regulatory sign-off contact and a partner listing that checked out.
Over twelve months the retailer paid £60,000 rather than £43,200, but avoided an estimated £8,000 in re-briefing and legal review costs after the cheaper supplier failed onboarding. The figures are illustrative.
Questions to send in writing
Send the same questions to every shortlisted agency so answers can be compared side by side.
- Which legal entity will contract, and what is its registered number?
- Who signs off regulated or legally sensitive copy?
- Which platforms are owned, licensed or resold?
- Who are the named subprocessors, and where are they based?
- What happens to our data at the end of the contract?
- If personal data will be transferred outside the UK, which transfer safeguard applies?
Our guide to content agencies best tools and data sources explains how to verify the data and platform claims behind these answers.
Common questions
How long should due diligence take?
For a mid-market engagement, allow two to three weeks alongside commercial negotiation. Rushing this stage is what causes onboarding failures later.
Do I need to check every subcontractor?
You need to know who they are, where they operate and what data they touch. You do not need to audit each one, but the agency should be able to list them.
What if the agency refuses to answer?
Treat a refusal as a material risk. A supplier unwilling to confirm its legal entity or data arrangements before signing is unlikely to be more forthcoming afterwards.
Does this apply outside England?
Company law and data protection rules apply across the UK, though some sector rules differ in Scotland, Wales and Northern Ireland. Confirm the position for your client's sector.
