B2B demand generation providers: data and contract checks

What to take away

Treat due diligence as a pass or fail gate that runs before any scoring.
Ask every provider for a written account of lead sources, lawful basis and retention for each data set.
Direct marketing to business contacts falls under PECR and UK GDPR rules enforced by the ICO, so name a compliance owner in the contract.
Agree exit terms for data and live campaigns before you sign, not when you leave.

Run the gates before you compare anyone

Run pass or fail gates before you compare any provider. For an England-based buyer, the typical gates are a UK-registered entity, two contactable client references and a written statement of how leads are sourced and stored.

Inclusion and exclusion rules

UK-registered entity confirmed
Two contactable client references
Written lead sourcing and storage statement
Data-handling terms in contract
State which market you are buying for

Exclude anyone who will not put data-handling terms in the contract. Confirm the entity at Companies House too, and read the filing history for late accounts or name changes. A recent change of name needs a plain explanation.

Geography matters because rules differ in detail. Data protection and electronic marketing law apply across the UK, and compliance screening should cover any sector rules for the market you serve.

Ask for the data paper trail

Demand generation depends on the buying group, so ask where the data comes from. Request a written description of lead sources, the lawful basis and the retention period for every data set the provider will use. A provider that cannot write this down has not decided how it handles data.

Ask how the provider builds and refreshes audience data, and who owns the records when the contract ends. The ICO's guidance on direct marketing and privacy explains the consent, soft opt-in and objection rules for business-to-business electronic marketing under PECR.

Someone on your side needs to judge these answers, ideally before proposals arrive. The Chartered Institute of Marketing's data and insights training courses cover research skills relevant to B2B audience work. A reviewer who can read a data-source table spots gaps that a sales call glosses over.

Name the owner and agree the exit

Put a named person accountable for compliance in the contract, with their role stated. Data questions land on a person, not a department, so the contract should say who answers when a record is challenged. Our guide to data protection duties sets out the basics.

Settle the exit while the relationship is friendly. The contract should cover four things:

Data returnyour records come back in a usable format on request.
Deletionwritten confirmation that your data is deleted when the work ends.
Handoverlive campaigns pass to you or to the next supplier without a gap.
Subprocessorsa full list, including offshore research or enrichment suppliers.

Check references and public claims

Ask for two client references from the last 18 months and a sample of the reporting those clients received. Redact names if needed, but the structure should be visible. Customer interviews work best when you agree your questions in advance.

Check public claims against the ASA's searchable database of rulings, which records ads it has investigated and the outcomes. That is useful when a provider's marketing promises more than its delivery model supports.

A due diligence checklist you can run

Use this before any provider reaches a shortlist. It is a screening tool, not a ranking.

Legal entity confirmed at Companies House, with filing history checked.
Two contactable references from comparable buying groups, with questions agreed in advance.
Written description of lead sources, lawful basis and retention for every data set.
Named person accountable for compliance, with their role stated in the contract.
Exit terms covering data return, deletion and handover of live campaigns.
Subprocessor list, including offshore research or enrichment suppliers.
Public claims cross-checked against the ASA rulings database.
A written answer to the questionwhat would make you walk away from this account?

Two rules keep the checklist honest. Score evidence, not presentation, and record the date and author of every entry so a colleague can audit the decision.

Pass first, then score

Keep the gate separate from the score. Providers that pass go forward to scoring, and providers that fail do not win a second chance on price. That way a strong pitch cannot buy back a missing contract term.

Example criterion weightings

Evidence quality30%
Compliance25%
Delivery fit25%
Commercial terms20%

An example weighting is evidence quality 30 per cent, compliance 25, delivery fit 25 and commercial terms 20. Our review methodology article shows how to build one, and the selection checklist applies it to a shortlist.

If you are comparing agencies, agency reviews in England shows how to apply the same tests to retainer models.

Common questions

What disqualifies a provider immediately?

Refusal to name a compliance owner, refusal to put data terms in the contract, or references you cannot contact. Any one of these makes the rest of the evidence unreliable.

How many providers should reach a shortlist?

Three or four is workable. More than that and evidence checks become shallow. Fewer and you lose the comparison that makes scoring meaningful.

Can a provider that uses offshore suppliers pass?

Yes, if it lists them, says what data they see and the contract covers them. An unlisted offshore supplier is the problem, not the location.

Does geography change the checks?

Only where rules diverge. Data protection and electronic marketing law are UK-wide, but confirm the provider's registered entity and any sector rules for your market.