Tools and providers
Part of How to choose creator contracts tools and providers for your agency
What creator contracts vendor due diligence means for campaign delivery
Vendor due diligence for creator contracts: what to check on data handling, disclosure evidence and exit terms before you sign a supplier for a campaign.
What to take away
- Vendor platforms now bundle contract storage with disclosure checks, so due diligence has shifted from drafting quality towards data handling and evidence trails.
- That shift matters because supplier terms decide what you can lawfully share with a brand, and how quickly you can prove an ad was labelled.
- Ask each supplier to show where their template records personal data as defined in UK law, and what happens to it when a campaign ends.
- Run one live brief through the workflow before signing anything. Demos hide the awkward steps.
- Tax and employment status sit outside this checklist and need a qualified adviser.
Why data questions come before drafting questions
The UK GDPR and Data Protection Act 2018 form the UK's data protection framework, with the Information Commissioner's Office (ICO) as regulator. The Data Protection Act 2018 sits alongside the UK GDPR; together, they govern personal data and the roles of controllers and processors. If a supplier's template uses different words for the same concepts, you cannot tell who is responsible when a creator's contact details end up in a brand's marketing database.
Ask the vendor to map their fields onto that vocabulary. Which fields hold personal data? Who controls each one? How long is it kept after a deal closes?
Retention is the second question. Ask how long creator contact details stay in the tool after a campaign closes, and who can still see them.
A supplier that answers vaguely in a sales call will be vague in a dispute too, and the exposure sits with you. To see how DocuSign and Adobe Acrobat Sign answer those questions in practice, the supplier comparison for England lays their answers side by side, with the same fields, retention and export columns.
| Vendor | Personal data fields | Default retention | Export |
|---|---|---|---|
| DocuSign | Signer name, email, IP address, authentication events, envelope custom fields | Life of account unless an admin sets a purge; typical policies run 2 to 7 years | PDF with certificate of completion, CSV audit trail; no setup or export fee on standard plans |
| Adobe Acrobat Sign | Signer name, email, IP address, audit events, agreement custom fields | 2 years by default, configurable | PDF, CSV audit report; no setup or export fee on standard plans |
The checklist to run before any demo
Work through this in order and write the answers down.
Pre-demo vendor due diligence checklist
- Legal entityregistered name and number
- Sub-processorslist every third party
- Templatessponsorship agreement and side letters
- Disclosure workflowwho marks posts as ads
- Exitexport format and cost
- Liabilitywho carries mislabelled post risk
- Legal entitycheck the registered name and number against Companies House, and review its filing history.
- Sub-processorslist every third party that touches campaign data, including hosting and email tools.
- Templatesrequest the sponsorship agreement, any side letters and the creator-facing summary.
- Disclosure workflowfind out who marks a post as an ad and where that decision is logged.
- Exitconfirm what you can export, in what format, and at what cost.
- Liabilityestablish which party carries the risk for a mislabelled post.
In the sponsorship agreement, check the disclosure clause for who must label a post as an ad, the approval clause for who signs off content and when, and the indemnity clause for who bears specified losses if something goes wrong. Also check the take-down clause: who can require a post to be removed and how the request is handled.
Disclosure evidence and category claims to verify
Disclosure evidence
Ads must be identifiable as ads. The CAP Code requires marketing communications to be obviously identifiable, and ASA and CMA influencer disclosure guidance explains how creators should disclose advertising. Ask the supplier to show a post, from brief to publication, where the disclosure label was recorded, who approved it and when.
A compliant log entry can read: Post: Instagram Reel; Label: Paid partnership with [Brand], applied before publication; Approver: [Brand manager initials]; Timestamp: 2026-03-14T17:40Z. The tool should export that entry with the post record.
For motoring claims, the ASA's motoring advertising guidance lists the evidence expected; add that evidence to the checklist item for substantiation.
Category rules and claims
Creators who make claims about regulated products need evidence behind them. Check whether the tool stores substantiation alongside the brief, or whether that lives in someone's inbox. For electronic records, BS 10008 covers evidential weight and legal admissibility; ask the supplier how its logs support an evidential trail.
Decision table
Choose
- Two-person team, few deals
- Shared drive plus a signed template
- Agency running monthly campaigns
- Tool with disclosure logging and export
- Brand-side marketing team
- Supplier with clear controller terms
- Regulated product claims
- Workflow that stores substantiation
- Content in Wales, Scotland or Northern Ireland
- Same checklist, tag Scotland alcohol rules, Wales HFSS rules, NI gambling rules
Avoid
- Two-person team, few deals
- Platform with a setup fee
- Agency running monthly campaigns
- Tools that lock exports behind a plan
- Brand-side marketing team
- Suppliers who cannot name sub-processors
- Regulated product claims
- Chat-based approvals
- Content in Wales, Scotland or Northern Ireland
- Assuming one UK-wide template fits
Common questions
Does due diligence change for Scottish or Welsh campaigns?
The core checklist does not change, because data protection and advertising codes apply across the UK. Devolved rules can differ. In Scotland, alcohol promotions face the Licensing (Scotland) Act 2005 and the Alcohol etc. (Scotland) Act 2010.
In Wales, the Public Health (Minimum Price for Alcohol) (Wales) Act 2018 and the Food (Promotion and Placement) (Wales) Regulations 2023 apply. In Northern Ireland, the Licensing (Northern Ireland) Order 1996 and the Betting, Gaming, Lotteries and Amusements (Northern Ireland) Order 1985 set separate alcohol and gambling rules.
Can a platform replace legal advice?
No. It can hold evidence and record decisions, but it cannot decide employment status or liability.
For broader buying context, see the related tools and supplier guide; this article focuses on the checks to make before signing.
