What B2B demand generation vendor due diligence means for agency buyers

What to take away

Why the checklist changed

Vendors now bundle AI assistants, scoring models and content generation into standard tiers. That changes what you verify. Two years ago a buyer checked list sources and reporting. Today the same buyer must also ask which model reads their CRM records, where inference runs and whether opt-out is possible.

Procurement teams that skip this step end up with tools nobody can audit. That is a commercial risk, not just a legal one.

Model usage clauses also move during a contract term. A supplier can swap subprocessors mid-term unless your agreement names them and requires notice.

The rules you are checking against

In the UK, vendor due diligence on personal data runs on UK GDPR and the Data Protection Act 2018, with the Information Commissioner's Office (ICO) as the regulator. PECR sits alongside them and governs electronic marketing, so it is the law behind your opt-out and suppression questions.

For a pilot or a full contract you are looking at Article 28 of UK GDPR: the processor terms a data processing agreement has to contain. Where a vendor moves records outside the UK, the transfer needs a lawful mechanism of its own — an adequacy finding, the IDTA or the Standard Contractual Clauses.

Data provenance questions

Start with where contact records originate. Contact data usually comes from a third-party provider — Cognism, ZoomInfo, Lusha or Apollo, for example — so ask which one supplied your records, on what lawful basis, with what collection date and refresh cycle. A vendor that cannot name its sources is one you cannot defend to your own compliance lead.

Ask where records are stored and which countries they transfer to, because a transfer outside the UK needs a lawful mechanism of its own — an adequacy finding, the IDTA or the Standard Contractual Clauses. Get that in writing before any records move.

Then ask about suppression. PECR governs email marketing and opt-outs in the UK, so if a prospect opts out of your emails, does the vendor's shared model still score them? Get the answer in the contract schedule.

AI and automation checks

Marketing platforms such as HubSpot's marketing automation suite publish what their AI features do, which gives you a baseline for questioning smaller vendors. Shortlists usually also include 6sense, Demandbase, Marketo and Outreach, so put the same AI questions to each. Compare that published behaviour with what each supplier tells you.

For agent-style tools, Salesforce's explanation of why teams choose Agentforce sets out the operational benefits vendors tend to pitch. Use it to separate genuine workflow gains from marketing language.

Creative and placement standards

Demand generation spend often flows into native and sponsored placements. The IAB UK native distribution principles give you a benchmark for disclosure and creative quality.

Ask a vendor how they label sponsored content and whether they follow those principles. Vague answers usually mean weak placement quality.

Commercial terms to test

Request a pilot with a defined exit. Check notice periods, data export formats and whether lead records stay yours after termination. A supplier that holds your pipeline hostage at renewal is expensive regardless of the monthly fee.

For example, a team paying £2,500 a month on a twelve-month term is committing £30,000 before any performance review. That figure is illustrative, not a market rate.

Ask how the minimum spend works if you pause activity for a quarter, because quiet periods still generate invoices.

What changes when you buy through an agency

Agency buyers inherit a second layer of contracts. Ask who actually signs with the vendor: the agency, the client, or both. White-label and reseller arrangements often put the agency between you and the platform, so the platform's terms, and its sub-processor chain, reach you only second hand.

Client pass-through matters at renewal. If the agency holds the licence and the data, an exit can mean rebuilding the account from scratch. Ask for the sub-processor list, the flow-down of your Article 28 processor terms, and written confirmation that lead records belong to the client.

Decision table

Scoring and shortlisting

Score each vendor against the same six criteria: data provenance, AI controls, integration, reporting, exit terms and references. Weight exit terms heavily if your contract value exceeds your annual training budget.

Take two references from clients who left the vendor, not only current ones, because the exit experience tells you more than the onboarding story.

Where two vendors score equally, run the comparison method in our B2B demand generation supplier comparison to break the tie on evidence rather than sales rapport.

Common questions

How long should vendor due diligence take?

Allow two to four weeks for a shortlist of three. Most of that time goes on written data answers and reference calls, not demos.

Do I need legal review for a pilot?

Yes if personal data is processed. Even a short pilot needs a data processing agreement carrying the processor terms Article 28 of UK GDPR requires, and a defined retention period.

What disqualifies a vendor immediately?

Refusal to name data sources, no export option, or training on your data without an opt-out. Any one of these should end the conversation.

Can a demand gen agency run this for us?

An agency can gather evidence, but you should own the scoring criteria. Delegating the whole decision usually means inheriting the agency's existing commercial relationships.