Tools and providers
Part of A buyer's guide to PPC agency tools and providers
When to run due diligence on a PPC agency
A practical guide to when to vet a PPC agency, with buying-stage checks for company status, credentials, data protection, access, fees and exit terms.
What to take away
- A UK advertiser choosing a PPC agency should treat due diligence as a fixed set of checks, not a gut feel built on a polished pitch.
- Verify the legal entity at Companies House, then confirm who owns the ad accounts and whether the agency's claims are evidenced in writing.
- Check data protection paperwork, platform certifications and access rights before any contract is signed.
- Agree a handover and exit position early, because rebuilding a lost account history costs far more than the checks themselves.
- Keep every answer in one dated file so a second reviewer can reach the same decision.
When to run the checks
- Before shortlistingconfirm the supplier's legal identity, relevant experience and any platform credentials it claims.
- Before the pitchask for evidence from the people who would work on your account, and clarify the proposed platforms, reporting and account-access model.
- Before signingcomplete the data-protection and insurance checks, confirm account ownership, and agree fees, change control and exit terms.
- At renewalrefresh checks on the delivery team, platform credentials, data handling, insurance and any proposed changes to fees or scope.
- On contract expiryconfirm access removal, data exports and handover responsibilities. Allow two to three weeks for due diligence once documents are requested, as described below.
Company and capability checks
Confirm the legal entity and its status
If the supplier is a limited company, start with the registered company, not the trading name on the proposal. Search Companies House for the entity that will invoice you. Check its filing history, accounts and any change of name. If the trading style does not match the contracting entity, ask why. Ask for current evidence of professional indemnity and cyber insurance, and check that the cover applies to the services and data involved.
Company and capability checks
- Search Companies House for invoicing entity
- Check filing history, accounts, name changes
- Match trading style to contracting entity
- List platforms team will use
- Confirm certifications behind each platform
- Show LinkedIn Campaign Manager reporting
- Source video specs from YouTube formats
For a wider view of supplier structures and what they charge for, see PPC agencies tools and supplier guide for 2027.
Test the platform claims you are paying for
Ask for the specific platforms the team will use and evidence of relevant credentials. For Google Ads, ask about Google Partner status and the named team's Google Ads Search certification; for Microsoft Advertising, ask about Microsoft Advertising Partner status; and for Meta, ask about Meta Business Partner status. Confirm that the credentials are current and apply to the agency or people who will work on your account. For LinkedIn work, confirm the team knows LinkedIn Campaign Manager and can show reporting from it. If video is in scope, ask which YouTube video ad formats they propose and why.
Compliance and access
Data protection evidence
Paid search can involve personal data through conversion tracking, remarketing lists and lead forms. Ask how the agency handles its obligations under the UK GDPR and Data Protection Act 2018, including lawful basis, retention and subject rights, and whether PECR applies to cookies or electronic marketing in scope. Check whether the agency is required to pay the ICO data protection fee and, where it is, verify its entry on the ICO's register of fee payers; exemptions apply. The ICO's direct marketing checklist is a sensible test of whether answers are complete. Vague replies about consent are a red flag, not a negotiating point.
Account ownership and access rights
Decide now who owns the Google Ads, Microsoft Advertising, Meta and LinkedIn accounts, and who holds admin rights. Insist on your own billing profile and a named owner inside your business.
Confirm what happens to historical data, audiences and conversion tags if the relationship ends. Implementation planning matters here: the notes on PPC agencies tool implementation in England explain the sequence that avoids a stalled migration.
Commercial and exit terms
Fees, media and change control
Separate management fee from media spend in every quote. Ask what the fee covers, how it is calculated, what triggers a review, how out-of-scope work is priced and who approves changes. Compare proposals on the same scope and fee basis; fees vary with the work agreed, so do not treat the £400 a month example as a market benchmark. Check whether platform rebates or volume incentives exist and whether they are passed on.
Handover and exit checklist
Agree a handover pack before you sign: account access, naming conventions, negative keyword lists, asset libraries and a written process for the final two weeks. Agree accessible exports for reports and account data where available, and name the contact who stays through transition. Keep the Google Ads account under your business's control and grant agency access through its manager account; for Meta, confirm your business controls Meta Business Manager and can remove the agency's partner access.
Set notice periods that match your budget cycle, and confirm who pays outstanding platform invoices. A supplier that resists these terms is telling you something useful.
Glossary
- Vendor due diligencethe checks run before appointing a paid search supplier.
- Change controlthe written route for approving work outside the agreed scope.
- Handover packthe files, access and documentation transferred at the end of a contract.
- Lawful basisthe reason under data protection law for processing personal data.
Common questions
How long should due diligence take?
For most UK advertisers, two to three weeks is realistic once documents are requested. The constraint is usually how quickly the supplier returns evidence, not the checking itself.
Do I need a separate data protection review?
Yes, if remarketing lists, lead forms or conversion tracking are in scope. Ask your own adviser to confirm the lawful basis rather than relying on the agency's summary.
What is the single strongest warning sign?
Reluctance to give you admin access to your own ad accounts. Ownership and access should be settled in writing before the first invoice is paid.
Can I run these checks on a small supplier?
The checks scale down, not away. A sole trader can still confirm their legal entity, insurance and the access terms you will rely on.
