How to check a prospecting software commercial contract before signing

What to take away

This is a checklist, not a ranking. It covers prospecting software commercial contracts bought by B2B teams based in England, and it names no supplier as a winner.

What criteria and geography should a reader apply?

Check the governing-law and jurisdiction clauses rather than assuming which courts apply: this checklist focuses on England and Wales, while Scotland and Northern Ireland have different court systems. The relevant UK rules include the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). A governing-law clause does not make otherwise unlawful processing lawful.

1. What lawful basis does the contract assume?

Many contracts call the supplier a processor and leave the lawful basis to you. Under the UK GDPR, identify a basis before processing begins; legitimate interests needs a documented balancing test. Check that the contract identifies each party’s role and responsibility for notices, objections and data rights: a label in the contract does not decide a party’s actual role.

The ICO's guide to lawful basis lists seven options and their supporting records. If the contract is silent, ask which basis the supplier expects and how it obtained the data. Where the supplier processes personal data for you, ask for an Article 28 UK GDPR data processing agreement (DPA) covering documented instructions, confidentiality, security, assistance with data rights, audits and return or deletion at the end of the service. Check the ICO register and whether your organisation must pay the ICO data protection fee; exemptions apply. The ICO can investigate and use enforcement powers, including monetary penalties, under the Data Protection Act 2018.

Ask for a retention schedule that states a period and deletion trigger for each data category; a clause with no duration or trigger is incomplete. Require deletion or return at the end of the service, a usable export beforehand and confirmation of deletion, including how backup copies are handled.

The supplier should fill in each bracketed period and trigger. These are schedule fields to agree with the supplier, not statutory retention periods.

2. Do the volume and sector promises match real demand?

Pricing usually assumes a number of contacts in a set of industries, so check the assumptions. The ONS employment bulletin gives employment by industry, which lets you test whether a sector is large enough for the volumes you are buying. For example, a team paying £1,500 a month for 25,000 sector contacts should size that sector first.

Check the sector mix against your own pipeline before accepting a bundled volume. A list weighted to industries where you never sell adds cost rather than coverage.

3. Which channels are licensed?

Some contracts permit email outreach alone, while others bundle social selling and paid media, so read the permitted use clause line by line. Check that the order form states the actual price for each channel, any add-on or overage charge, and any renewal increase; do not rely on an unstated price or verbal assurance.

PECR treats corporate subscribers differently from individual subscribers. Unsolicited B2B email can generally be sent to corporate subscribers without PECR consent, but the sender must be identified and a valid opt-out provided. Sole traders and some partnerships are individual subscribers: prior consent is generally needed unless the narrow soft opt-in applies. That opt-in requires details obtained directly during a sale or negotiations, marketing your own similar products or services, and an opt-out both when details are collected and in each message. UK GDPR still applies when the contact details are personal data. For live marketing calls, check numbers against the Telephone Preference Service (TPS), the Corporate Telephone Preference Service (CTPS) and your own suppression list.

Paid social sits in a different legal space from cold email. LinkedIn's text ads page explains how that format is bought and where it appears; it is not permission to use prospect data for cold email. Check the contract expressly permits each intended channel, including social selling tools and paid media, and states whether exports or reuse across channels are allowed.

Check whether the licence covers sub-processors and contractors, since an agency running outreach for you needs naming in the agreement. Ask for the current named sub-processor list, each provider’s role and processing location, plus a change-notice clause that gives you time to object or exit before a new sub-processor handles the data.

4. How does the contract handle term, renewal and exit?

Auto-renewal clauses are quiet and common, so check the notice window, the renewal price mechanism and what happens to data at exit. The contract should state the notice deadline and any uplift in figures or by a clear formula; windows of 30 to 90 days are common, so set a diary reminder well before yours opens. As a drafting prompt, ask for written notice before renewal and no price change except as expressly stated in the order form.

Check whether data you enriched belongs to you or reverts to the supplier. Ask for a termination for convenience right; without one, a change of strategy means paying the remaining term. The exit clause should say when the supplier must provide an export in a usable format, return or delete your data, and confirm deletion, including from backups.

5. What happens when accuracy or uptime fails?

Check the remedies the contract actually offers: a useful ladder may include correction or replacement of inaccurate records, a retest, service credits, a refund or termination for repeated failure. Look at the accuracy commitment, the invalid rate the supplier will stand behind, and the liability cap. Require the contract to state the cap as an actual monetary figure and explain how it is calculated; there is no single cap figure that can safely be treated as standard across suppliers. Compare it with the quoted subscription price and the loss you could face, and check which claims or losses are excluded from the cap. Service credits against subscription fees may leave you with little recovery for other losses.

How should a team score contract terms before signing?

Use one rubric for every supplier so the comparison survives scrutiny. Score each area 1 to 5, apply the weight, and keep the working. Weight lawful basis and data rights highest: a lapse there cannot be repaired by a service credit.

Use the table as a starting point for a commercial review, not legal advice. If a clause leaves the lawful basis, permitted channels, data-transfer mechanism or remedy unclear, resolve that point with the supplier and take qualified advice on your own facts before signing.

Common questions

Do I need a solicitor to review a prospecting software contract?

Not always. A low-value subscription on standard terms may need only a commercial review, but large volumes or a multi-year term justify a solicitor or in-house counsel.

Can a supplier hold prospect data outside the UK?

UK GDPR does not ban transfers, but it requires an appropriate transfer route and safeguards where applicable, together with a record of the assessment. Ask where data is hosted, who can access it and which transfer mechanism the contract uses. Where the transfer relies on appropriate safeguards, check for the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), and ask for the transfer risk assessment.

What notice period should I expect on renewal?

There is no statutory default. Windows of 30 to 90 days are common, so set a diary reminder well before the window opens.