Tools and providers
Part of A buyer's guide to PPC agency tools and providers
When to run vendor checks on a paid search agency
A practical checklist for PPC agencies vendor due diligence before signing: company checks, platform access, data protection evidence and handover terms.
What to take away
- A Manchester retailer shortlisting three paid search suppliers should treat due diligence as a fixed set of checks, not a gut feel built on a polished pitch.
- Verify the legal entity at Companies House, then confirm who owns the ad accounts and whether the agency's claims are evidenced in writing.
- Check data protection paperwork, platform certifications and access rights before any contract is signed.
- Agree a handover and exit position early, because rebuilding a lost account history costs far more than the checks themselves.
- Keep every answer in one dated file so a second reviewer can reach the same decision.
Company and capability checks
Confirm the legal entity and its status
Start with the registered company, not the trading name on the proposal. Search Companies House for the entity that will invoice you. Check its filing history, accounts and any change of name. If the trading style does not match the contracting entity, ask why.
Company and capability checks
- Search Companies House for invoicing entity
- Check filing history, accounts, name changes
- Match trading style to contracting entity
- List platforms team will use
- Confirm certifications behind each platform
- Show LinkedIn Campaign Manager reporting
- Source video specs from YouTube formats
For a wider view of supplier structures and what they charge for, the guide to PPC agencies tools and supplier guide for 2027 sets out the models you will meet.
Test the platform claims you are paying for
Ask for the specific platforms the team will use and the certifications behind them. For LinkedIn work, confirm the team knows LinkedIn Campaign Manager and can show reporting from it. If video is in scope, ask how they build formats and where they source specs, starting with YouTube video ad formats. Claims here are cheap; evidence is not.
Compliance and access
Data protection evidence
Paid search touches personal data through conversion tracking, remarketing lists and lead forms. Ask for the lawful basis for each audience, retention periods and the process for handling subject requests. The ICO's direct marketing checklist is a sensible test of whether answers are complete. Vague replies about consent are a red flag, not a negotiating point.
Account ownership and access rights
Decide now who owns the Google Ads, Microsoft Advertising, Meta and LinkedIn accounts, and who holds admin rights. Insist on your own billing profile and a named owner inside your business.
Confirm what happens to historical data, audiences and conversion tags if the relationship ends. Implementation planning matters here: the notes on PPC agencies tool implementation in England explain the sequence that avoids a stalled migration.
Commercial and exit terms
Fees, media and change control
Separate management fee from media spend in every quote. Ask what triggers a fee review, how out-of-scope work is priced and who approves changes. For example, a team paying £400 a month in management fees should still see a written change process, not an informal email. Check whether platform rebates or volume incentives exist and whether they are passed on.
Handover and exit checklist
Agree a handover pack before you sign: account access, naming conventions, negative keyword lists, asset libraries and a written process for the final two weeks. Ask for a named contact who stays through transition.
Set notice periods that match your budget cycle, and confirm who pays outstanding platform invoices. A supplier that resists these terms is telling you something useful.
Glossary
- Vendor due diligencethe checks run before appointing a paid search supplier.
- Change controlthe written route for approving work outside the agreed scope.
- Handover packthe files, access and documentation transferred at the end of a contract.
- Lawful basisthe reason under data protection law for processing personal data.
Common questions
How long should due diligence take?
For most England advertisers, two to three weeks is realistic once documents are requested. The constraint is usually how quickly the supplier returns evidence, not the checking itself.
Do I need a separate data protection review?
Yes, if remarketing lists, lead forms or conversion tracking are in scope. Ask your own adviser to confirm the lawful basis rather than relying on the agency's summary.
What is the single strongest warning sign?
Reluctance to give you admin access to your own ad accounts. Ownership and access should be settled in writing before the first invoice is paid.
Can I run these checks on a small supplier?
The checks scale down, not away. A sole trader can still confirm their legal entity, insurance and the access terms you will rely on.
