Tools and providers
Part of How to choose privacy first measurement tools and providers
Measurement vendor due diligence: what documents prove
Read each document a measurement vendor supplies for what it proves: company record, certificates, assurance reports, accessibility and deletion proof.
Every vendor hands over documents, and each one proves less than it appears to. A company record proves identity, a certificate proves a scope and a deletion notice proves only the systems it names. Due diligence reads each document for the claim it supports and the question it leaves open, then writes both down.
What to take away
- Each document supports one claim, and the file records the document, owner, scope, date and exception.
- A live company registration confirms identity only, not competence, solvency or regulatory compliance.
- A certificate or report covers a stated service and period, not every deployed configuration.
- Leave a field unresolved when proof is missing rather than accepting an unsupported yes answer.
- Date each document and set an expiry, because a satisfactory answer at purchase can go stale.
Match each document to the claim it supports
Put the documents in one table before reading them closely. Each row names what the document supports, what it leaves open and the question to ask next. A blank cell in the last two columns means nobody has thought about the limit yet, and that cell is the risk.
| Document | What it supports | What it leaves open | Ask next |
|---|---|---|---|
| Company registration record | Identity of the legal entity | Competence, solvency or regulatory compliance | Does the trading name match the entity that signs and is paid? |
| ISO/IEC 27701 certificate | A certified privacy information management system | Which service and configuration you will actually use | What is the stated scope? |
| ISO/IEC 27001 certificate with statement of applicability | Which controls the supplier selected | Whether every deployed configuration is secure | Which controls extend to subcontractors? |
| SOC 2 Type II report | Controls over the covered service for the stated period | Anything outside that service and period | What are the exclusions? |
| Penetration-test date | That a test took place | That every deployed configuration is secure | What did the test cover? |
| Accessibility statement | The declared standard, test date and known failures | Whether your users can finish their tasks | Can the tasks be tested with assistive technology? |
| Deletion certificate or export test log | Deletion or export for the systems it names | Systems and backups it does not mention | Does it cover active systems and backup handling? |
Leave a field unresolved when proof is missing, rather than accepting an unsupported yes answer. The file records the document, owner, scope, date and exception for each claim, so a reviewer can see which answers rest on evidence and which rest on a promise.
Treat the company record as an identity check
A live company registration confirms identity and nothing more. Match the trading name to the legal entity, registered address and company number, and obtain the proposed contracting entity and payment details through a verified channel. Competence, solvency and regulatory compliance need other evidence.
Companies House's Find and update company information service makes all the public data it holds on companies available free of charge, so the identity check costs nothing. Then check insolvency, insurance and authority documents appropriate to the deal.
Verify the contracting entity
- Match trading name to legal entity
- Confirm registered address and company number
- Obtain entity and payment details via verified channel
- Check insolvency, insurance and authority documents
- Treat live registration as one identity input
Where the vendor acts as a controller, the ICO's register of data controllers should show its data protection fee entry.
Data roles must be determined from conduct, not from labels in the contract, and the ICO's role guidance says the distinction depends on responsibilities. The data protection page covers the roles in measurement. The contract questions cover what to ask once identity is settled.
Test the security evidence for scope, not the badge
A certificate or assurance report supports a claim about a defined scope. Check whether the vendor holds an ISO/IEC 27701 privacy information management certificate, or an equivalent privacy assurance, and read which service it covers. A badge names a scheme, while only the scope shows what was examined.
For security assurance, ask for a SOC 2 Type II report covering the service and period, or an ISO/IEC 27001 certificate with its statement of applicability. Do not convert a certification badge or penetration-test date into proof that every deployed configuration is secure.
Examine administrator access, authentication, logging, encryption and vulnerability handling, and check whether material controls extend to subcontractors. A report about the vendor does not automatically cover them. Grading the evidence state keeps a claim, a document and a tested result apart.
Test the accessibility statement with tasks
An accessibility statement declares a standard, and a task test shows whether it holds. Request the statement, the testing standard such as WCAG 2.2 Level AA, the test date and known failures. Then test dashboard navigation, filters, charts, forms, documentation and exports with agreed assistive technologies.
The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 apply to public sector bodies, not to a private English buyer. GOV.UK guidance for those bodies says a site or app will meet the legal requirements if it meets the WCAG 2.2 AA accessibility standard. A private buyer can still ask the vendor for the same standard.
Record workarounds, remediation owners and contract consequences for each failure found. A statement from the vendor does not settle the buyer's own duties, so obtain advice on those separately.
Ask for deletion and exit proof that names each system
Acceptable exit evidence names exactly what it covers. A deletion certificate should name each system, the date and the method, or a signed export test log can record row counts, field totals and a checksum for the recreated report. Either way, the evidence covers active systems and stated backup handling.
- Export a representative dataset plus definitions, configuration and audit history.
- Recreate one important report outside the service.
- Delete trial data and obtain evidence covering active systems and stated backup handling.
- Remove temporary users, keys, integrations and network routes.
The rehearsed exit in an implementation plan gives these steps a place. For the method, ask for a standard such as NIST SP 800-88 or ISO/IEC 27040 for media sanitisation and data erasure, and record the certificate format, scope and audit method.
Date every document and set change triggers
A satisfactory answer at purchase can become stale. Schedule evidence expiry dates instead of treating the initial file as permanent, and require notice of new sub-processors, hosting locations and independent data uses. Define which security incident, control exception or ownership change needs reassessment.
Connect each trigger to an owner, response time and right to suspend collection, restrict access or leave the service. Test that escalation route during renewal rather than discovering it after a material change. The selection checklist keeps PECR, security and accessibility in separate gates.
End with a risk register that names the unresolved question, owner, deadline and stop condition. Privacy, security, accessibility and commercial reviewers should sign only their qualified scope. Due diligence reduces uncertainty; it cannot guarantee the vendor's future compliance or performance.
Common questions
What does a company registration prove about a vendor?
Identity only. It confirms the legal entity, registered address and company number, not competence, solvency or regulatory compliance. Match the trading name to the entity that signs and is paid, and obtain payment details through a verified channel.
Does a certificate or assurance report prove the service is secure?
Not by itself. A SOC 2 Type II report covers the service and period it names, and an ISO/IEC 27001 certificate comes with a statement of applicability. Neither proves that every deployed configuration is secure, and a penetration-test date does not either.
What counts as acceptable deletion evidence?
A deletion certificate naming each system, the date and the method, or a signed export test log that records row counts, field totals and a checksum for the recreated report. It should cover active systems and stated backup handling.
Why is a satisfactory answer at purchase not permanent?
Treat the initial file as time-limited. Set triggers for new sub-processors, hosting locations and independent data uses, and schedule evidence expiry dates. A material incident, control exception or ownership change should prompt reassessment.
