Influencer agencies vendor due diligence: UK checklist

For influencer agencies, vendor due diligence should produce a reviewable, UK-specific dossier for the exact agency service or software edition. It should cover the agency's creator sourcing and campaign work as well as any software; a sales presentation, certificate or contract alone cannot answer every gate.

What to take away

Verify identity and service boundaries

Record the contracting legal entity, company number where applicable, trading name, registered address, signatory and subcontractors. Companies House company information can verify public details for an incorporated UK company, but not capability or creator authority.

Name the product, edition, modules, user type, geography, data sources and platform dependencies, including Meta (Instagram), TikTok and YouTube. Record each platform's terms and API access route, permissions used, data limits and support or fallback if terms or access change. Date every supplier answer. Separate software functions from agency-operated work and from any payment service. Mark unspecified features as unknown.

Check whether the proposed agency is reselling, referring, configuring or merely accessing the product. Record who contracts with the software company, who can raise support cases and which promises appear in the binding order. A partner badge or marketplace listing does not establish that the agency can commit the vendor or grant data rights.

Trace creator and audience data

Ask where creator profiles originate, which fields are observed or inferred, update frequency, coverage exclusions, correction and objection routes, suppressed profiles and deletion. Define the advertiser, agency, supplier and platform roles for each purpose.

The ICO data-sharing code distinguishes controller sharing from processing on instructions. Assess the UK GDPR and Data Protection Act 2018 obligations for each personal-data purpose, including lawful basis, transparency, retention and rights handling. A vendor's privacy notice is evidence about its stated activity, not the buyer's lawful-basis decision. Check the ICO's data protection fee register and record whether the agency or vendor is registered or says it is exempt. Review outreach and audience matching separately under privacy and PECR.

If the agency or a subprocessor is outside the UK, add transfer mapping, check adequacy or the IDTA, and note which regulator has reach.

Check influencer advertising and audience integrity

For UK campaigns, require the agency to map its review process to the CAP Code, ASA guidance and applicable CMA guidance on influencer endorsements. Establish who checks that advertising is clearly and upfront disclosed, using wording such as #ad where appropriate, who monitors live posts, and how missing disclosures are corrected and escalated. Ask for anonymised examples of the workflow rather than accepting a policy statement.

Test audience quality separately from reach claims. Ask how the agency identifies fake followers and engagement fraud, validates audience authenticity, and supports demographic or geographic claims with data and stated limitations. Require documented brand-safety checks, exclusions and escalation procedures, and establish how suspected manipulation affects creator selection and reporting.

Test security and account control

Request the current security schedule, scope of any independent report, subprocessors, hosting locations, privileged-access process, authentication, logs, incident route, recovery evidence and change notification. Map every connection to client-owned social and advertising accounts.

NCSC supply-chain principles support understanding protected assets, supplier access and subcontractors. A certification does not prove that this configuration or integration is safe. Use synthetic data to test roles, revocation and recovery.

Ask for the ISO/IEC 27001 certificate or a SOC 2 Type II report, and check the scope and date.

Examine accessibility and evidence quality

Request an accessibility statement or conformance report for the precise version, test method, date, known defects and remediation. Test critical buyer and creator tasks with relevant disabled users and assistive technology. Unknown public evidence should remain unknown, not be converted into an assurance.

For a UK-facing service, ask for a WCAG 2.2 AA conformance report and the test method used.

For automated discovery, safety or sentiment fields, demand definitions, source population, validation design, error treatment, geography, update interval and human correction. Do not use a supplier score as proof of age, identity, audience composition or suitability.

Reconcile contract and commercial units

The contract pack should cover service scope, acceptance, data roles, creator confidentiality, IP, account ownership, changes, incidents, support, liability, renewal, suspension and termination. The ICO's processor-contract guidance was marked under review when checked, so reconcile it with current law and specialist advice.

Require a quote with currency, VAT basis, billing period, users, usage units, implementation, support, overages, renewal and exit. Keep licence cost apart from agency service, creator consideration, media, internal labour and tax. No price or threshold is supplied here.

Prove exit before approval

Export a synthetic record containing source, contact history, authority, claim approval, rights, consideration and audit events. Check identifiers, attachments, format, completeness and re-import usability. Then test deletion, backup treatment, subprocessor handling and account disconnection.

Use a clearly labelled dummy record named SYNTHETIC-CREATOR, not a real person. For example, give it a buyer-created test profile as its source, a logged test contact as its contact history, a synthetic permission record as its authority, and test-only claim approval, rights and consideration; include audit events for creation, export, re-import and deletion.

Run the test and accept it only if the evidence shows that:

Example pass entry: the export and re-import matched the test record, its audit events and attachment were present, access stopped after disconnection, and the supplier provided evidence describing deletion and backup handling.

Worked example: if the export test loses audit events, hold approval and request a fix, a re-test date and a named owner. Reject if the vendor cannot evidence the fix.

Assign an owner to monitor product notices, legal-document versions, subprocessors and source-platform dependencies. A material change should reopen the affected privacy, security, accessibility, commercial or continuity gate. Record the previous evidence and effective date so the buyer can tell whether an approval belongs to the current service.

Reject or hold the vendor if a legal, privacy, security, accessibility, rights, commercial or exit gate lacks evidence. Due diligence reduces uncertainty; it does not certify compliance, accuracy or results.

Before you act

Common questions

What should the dossier cover?

Use a template with sections for identity, data provenance, security, accessibility, commercial terms and exit. Version it, date it and name an owner. Effort depends on the number of data sources, account connections and contract redlines; a single service usually needs two review cycles.

How should creator data be traced?

Check how a creator objects to profiling and how long suppression lasts. Ask for the source population and update interval for each field, and for the validation design behind any inferred attribute.

What must be tested before approval?

Run a two-part test. First, export and re-import a synthetic record and check audit events. Second, disconnect a test account and confirm deletion and backup treatment. Record the result against the exit gate, with a named owner for any fix.