Paid social vendor due diligence: a decision file

Paid social vendor due diligence should produce a decision file, not a pile of questionnaires. Give each question an owner, acceptable evidence, expiry date and result of pass, fail, unknown or not applicable. A serious unresolved item stops approval even if other answers are strong.

The checks suit a paid-social agency or its client operating in England. The privacy and electronic-communications rules cited here are UK-wide. Named legal, privacy, security, accessibility, procurement and platform-contract reviewers should sign off the final file.

What to take away

Identity and authority

Start with who is actually contracting. Match the proposal's legal counterparty, company number, registered office and filing status against the Companies House company information service, which shows details such as the registered address and date of incorporation. A register entry verifies filed identity, not quality or solvency.

Reconcile that entity with invoices, data terms, bank-change controls and insurance evidence, and identify any resellers and subcontractors. Then record who owns the advertising account, page, pixel or tag, audience, creative, billing profile and export. Confirm who can invite, remove and recover administrators, and compare the answers with the supplier checks on ad account access.

Ask whether the agency receives referral income, rebates, credits or group-licence benefits. Decide how each conflict is disclosed and treated, and write the answer into the decision file so the reviewer can see which commercial interests sit behind the recommendation.

Service and commercial boundary

Pin down the exact product, edition, account geography and enabled functions. Save the dated service description and distinguish what the commercial contracts bind from what sits on editable web pages, because the supplier can change a web page without telling you.

Obtain a quote stating currency, VAT treatment, billing unit and period, minimum term, media-spend payer, overage, support, renewal and termination, and compare it against the England paid-social pricing-model guide. Leave unstated items as unknown rather than assuming a favourable answer.

Define metric fields and the team roles that own the evidence. A supplier dashboard is a reporting source, not independent proof of a business outcome. Record platform suspension and feature-change consequences, and name the person allowed to pause automation or revert to the manual process.

Privacy, PECR and information life cycle

Map each purpose, population, data field, source, lawful basis, party role, recipient, retention rule and rights route. Do not apply one role label to every activity. Test access, correction, objection, export and deletion propagation, following the data protection duties for rights requests and incidents.

For processor activity, compare the agreement with the ICO guidance, “What needs to be included in the contract?”, on contracts between controllers and processors. The ICO states that this page is under review after changes made by the Data (Use and Access) Act, so recheck it at signature.

Assess cookies, pixels, scripts and comparable device access separately under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), using the ICO's Guidance on the use of storage and access technologies. Where personal data is involved, check the UK GDPR and Data Protection Act 2018 as well. A supplier toggle cannot decide the legal position. List storage, remote support and subprocessor access countries, and document the exporter and any restricted-transfer mechanism.

Preserve records subject to a justified retention requirement without leaving indefinite vendor access. Ask the supplier to show how a deletion request reaches backups, subprocessors and reporting exports, and keep the answer with the expiry date of the evidence.

Security and resilience

Tailor the National Cyber Security Centre's (NCSC) supplier assurance questions to the service. Request control evidence for authentication, privileged access, logging, vulnerabilities, backup, incidents and contract exit. Use individual identities, least privilege and multifactor authentication, and set deadlines for leavers, partner removal and credential rotation.

Agree incident contacts, initial facts, evidence preservation and escalation timing. The responsible controller must assess any notification duty; a supplier should not predetermine it. Rehearse account recovery and a manual continuity route, and check which records remain available during an outage or dispute.

Accessibility and usable evidence

Ask for the scope, version, date and author of accessibility evidence. Do not accept a badge as proof. Test critical tasks with intended users, browsers, keyboard and relevant assistive technology. WCAG 2.2 provides criteria for web content, but buyer testing must cover the actual configuration and exports.

Make approvals, warnings, errors and disclosures perceivable to every reviewer who signs them off. Give blocking defects an owner and resolution date, and record whether the supplier or the client carries the fix, so that a known defect cannot slip through as an unowned risk.

Exit and change control

List every asset, format, credential, integration, record and payment relationship that must move or close. Define export validation, access revocation and deletion evidence, as the paid-social delivery operations guide sets out. Trigger a fresh review if the legal entity, subprocessor, permissions, terms, price basis, export, security posture or accessibility changes.

Approval should identify remaining unknowns explicitly. If a vendor cannot evidence a non-compensating gate, exclude it or narrow the proposed service rather than averaging the risk away.

Decision-file template

Use one row for each check. Enter an accountable owner, the evidence retained and its expiry date; select one result and record the decision or action. Add rows if the service requires further checks.

Before you act

Common questions