A buyer checklist that keeps PECR, security and accessibility in separate gates

A privacy first measurement selection checklist should prevent one attractive feature from masking an unanswered risk. Use separate approval gates. A privacy reviewer cannot sign for security, and an accurate report cannot cure an unlawful collection route.

This checklist was compiled by the site's research desk on 5 September 2026 for an organisation in England. The evidence inspected was limited to the cited public guidance. There was no supplier funding, affiliate arrangement, demonstration or hands-on test. Product behaviour, contracts and buyer suitability remain untested. The verdict is to hold selection until each applicable owner records a decision.

What to take away

Keep privacy, security and accessibility in separate approval gates so one cannot sign for another.
Do not score candidates until the purchase fields, reviewers and discovery terms are fixed.
Hold selection until each applicable owner records a decision on the evidence.
Test accessibility with disabled users and assistive technologies, not just a standard.
Recheck versions, terms, subprocessors, prices and guidance on the decision date.

Define the purchase

Name the business decision, service users, measurement purpose, England or UK population and required date.
List mandatory events, calculations, source systems, reporting delay, retention and exit data.
Assign privacy, PECR, security, accessibility, statistical, commercial and contract reviewers by name.
Record discovery terms, inclusion rules, exclusions, contacts and conflicts for every candidate.

Do not score until these fields are fixed. Otherwise criteria tend to change around a preferred supplier.

Define the purchase first

Name decision, users, purpose, population, date
List events, calculations, sources, delay, retention
Assign privacy, PECR, security, accessibility reviewers
Record discovery terms, inclusion, exclusions, conflicts
Do not score until these fields are fixed

Inspect collection and PECR

Map cookies, pixels, scripts, SDKs, link decoration, local storage and server-side access by purpose and party.
Test behaviour after acceptance, refusal and withdrawal on the approved browser and device matrix.
Record any claimed exception, its conditions and the reviewer who accepts the analysis.

The ICO's final storage and access guidance shows why the actual operation and purpose matter. Hold if the supplier cannot explain a device operation or if observed behaviour differs from the approved map.

Review personal-data responsibilities

Document purposes, fields, lawful basis, transparency, minimisation, retention, rights handling and DPIA position.
Determine controller, joint-controller and processor roles from real decisions and activities.
Compare any processor agreement with the required topics, including instructions, confidentiality, security, subprocessors, assistance, audit and exit.

The ICO's contracts guidance is under review and does not provide commercial contract advice. Require professional review of the final documents.

Keep security independent

Ask for architecture, tenant separation, authentication, privileged access, logging, incident handling, resilience and secure-development evidence.
Identify every subprocessor and how material changes are notified.
Agree which controls the buyer configures and how configuration is checked again.

Use the NCSC cloud security principles as questions, not as a certificate. Stop if a critical risk has no owner, evidence or contractual route.

Test measurement quality

Give every metric an event, numerator, denominator, population, unit, period, time zone, inclusions, exclusions, owner and caveat.
Run known synthetic events, duplicate cases, late arrivals and boundary dates.
Reconcile a defined period with an independent operational source.
Label observation, modelling, attributed credit and causal evidence separately.

Withhold the report if a denominator is missing, joins multiply records unexpectedly or the supplier cannot identify its calculation version.

Test accessibility with users and technology

Identify critical dashboard, administration, consent and export tasks.
Check keyboard operation, focus, labels, error messages, zoom, contrast and chart alternatives.
Include relevant assistive technologies and disabled users in the test plan.
Record known failures, workarounds, remediation owner and retest date.

W3C's WCAG 2.2 recommendation is a technical standard with testable criteria, but conformance for one page does not establish that the contracted product and all its outputs are accessible.

Rehearse portability and exit

Export the required period, fields, definitions and permissions into a buyer-controlled location.
Reconcile counts and identifiers, then test whether the receiving system can use the files.
Record row limits, aggregation, omitted imports, retention after notice, deletion evidence and backup treatment.
Analyse restricted transfers and onward access where personal information is involved.

The ICO's 2026 international transfers guide sets out a three-step analysis and responsibility questions. Hosting in one country does not answer every transfer issue.

Record the bounded verdict

Choose evidence shortlist, restricted trial, hold or reject for the stated use. Name approvers, dissent, conditions and expiry. Recheck product version, terms, subprocessors, certifications, prices, guidance and critical test results on the decision date. Do not publish a "best" label until the method, evidence and commercial interests are visible to the reader.

Before you act

Name the business decision, users, purpose, population and required date.
Map cookies, pixels, scripts and storage by purpose and party.
Assign privacy, PECR, security, accessibility, statistical, commercial and contract reviewers by name.
Test behaviour after acceptance, refusal and withdrawal on the approved matrix.
Reconcile a defined period with an independent operational source.
Export the required period, fields, definitions and permissions before exit.

Common questions

Why should a privacy reviewer not sign off security or accessibility?

The article says a privacy reviewer cannot sign for security, and an accurate report cannot cure an unlawful collection route. Each applicable owner must record a decision, so one attractive feature cannot mask an unanswered risk in another gate.

What should happen if a supplier cannot explain a device operation?

Hold the selection. The article says to hold if the supplier cannot explain a device operation or if observed behaviour differs from the approved map. The ICO storage and access guidance shows why the actual operation and purpose matter.

How should a buyer treat WCAG 2.2 conformance claims?

W3C's WCAG 2.2 recommendation is a technical standard with testable criteria, but the article says conformance for one page does not establish that the contracted product and all its outputs are accessible. Test critical tasks with users and assistive technologies.