Prospecting software vendor due diligence: ICO processor, NCSC and Cyber Essentials checks

What to take away

Vendor due diligence is the structured checking of a supplier's data, security, pricing and contract terms before you sign.
A prospecting vendor that handles personal data is usually your processor, so test its guarantees under the UK GDPR.
Ask for security evidence in stages, and ask whether the vendor holds Cyber Essentials.
Model the full cost, not the seat price.
Agree exit terms before onboarding, including export formats and deletion dates.

Start with the data supply

Ask how records are collected, verified and retired. A supplier that cannot describe its refresh cycle is one you cannot forecast with. Request a sample from the vendor and run the nine tests in the prospecting software quality checklist yourself.

Test the data supply

Ask how records are collected
Ask how records are verified
Ask how records are retired
Request a sample of 200 records
Test bounce rates yourself
Test job-title accuracy yourself

A business contact's name and work email are still personal data. If you process personal data for direct marketing, even in a business context, the UK GDPR applies. Ask the vendor which source and which lawful basis sit behind each record, and read prospecting software data privacy basics before you import a list.

Security and access questions

Prospecting tools hold contact data and connect to your CRM, so they sit inside your supplier risk. Ask for the latest penetration test summary, the subprocessor list and the breach notification window. The guide to how to audit security claims shows how to test each answer.

Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes. It is aligned to five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Ask whether the vendor holds the certificate and what the certificate covers.

Security questions to ask

Latest penetration test summary
Subprocessor list
Breach notification window
Where data is hosted
Processing outside the UK
Role-based access and audit logs
Ex-employee access removal speed

Confirm where data is hosted and whether any processing happens outside the UK. Check role-based access, audit logs and how quickly an ex-employee loses access. A vendor that answers vaguely here will be slow to fix problems later.

Test the vendor as a processor

Under the UK GDPR a controller must only use a processor that can give sufficient guarantees. Whether the guarantees are sufficient depends on the circumstances and the risk to individuals, as the ICO processor guidance explains.

Ask for the vendor's privacy policy, record management policy and information security policy. Then check the contract. Article 28(3)(h) requires the processor to allow for and contribute to audits and inspections, carried out by the controller or a third party the controller appoints.

Evidence to request / What it tells you

Privacy, record management and information security policies: Whether the vendor can document how it handles personal data
Audit and inspection clause: Whether you can verify its answers later
Cyber Essentials certificate and its scope: Whether a baseline of five technical controls is in place
Source and lawful basis per record: Whether the list is safe to use for outreach
Subprocessor list and hosting location: Where your data travels and who else touches it

Pricing and contract checks

Model the full cost, not the headline seat price. Add data credits, enrichment calls, onboarding fees and any charge for API access. The budget guide lays out how to model seats, pricing models and hidden costs.

Illustrative example: ten seats at £40 a month cost £400 a month, or £4,800 a year. Add a £2,000 annual platform fee and the first-year cost is £6,800, or £680 a seat. The seat price alone would have understated the bill by more than a quarter.

Read the renewal clause and the notice window, and ask what happens if you exceed your contact limit mid-term. Get the overage rate in writing. Use the commercial contract checks before you sign.

Re-run the checks at renewal

The NCSC supply chain security guidance says to review supplier security artefacts at renewal, when there are significant changes, or in response to major incidents. Keep the vendor file current so each renewal starts from evidence.

Ask for evidence of security status in stages. Take basic assurances at the first gate, then request more detail as the shortlist narrows. Do not impose unnecessary workload on every applicant at the start.

Integration and workflow fit

A tool that does not fit your workflow tends to go unused. Map your current sequence first, then test whether the vendor supports it without custom work. The CRM integration routes show what native connectors and middleware can and cannot do.

Check the CRM sync direction. Two-way sync sounds better than it often is, because field conflicts need an owner. Ask who resolves duplicates when both systems hold the same contact.

Contract exit and data portability

Ask what you get back if you leave. You want a full export of contacts, activity history and suppression lists in a usable format. Confirm the deletion timeline and whether you receive written confirmation.

Check whether suppression lists survive the exit. If opted-out contacts are lost, you risk contacting people who already said no. That is a compliance problem, not just an admin one.

Before you sign

Record the source and lawful basis for each type of contact data.
Collect the vendor's privacy, record management and information security policies.
Confirm an audit and inspection clause in the data processing terms.
Ask whether the vendor holds Cyber Essentials and what it covers.
Build a first-year cost model with credits, fees and overage rates.
Agree export formats, suppression list handling and deletion dates.

Common questions

How long should due diligence take?

Allow for security review and reference calls, which usually set the pace rather than pricing talks. Start them before the commercial negotiation so the answers can shape the terms.

Do I need legal review for a small contract?

Yes, at least for data processing terms and auto-renewal clauses. Small contracts still carry long notice periods and deletion obligations.

What is the biggest red flag?

A vendor that cannot explain where its contact data comes from. Data provenance sits behind both deliverability and compliance.

Should I run a paid pilot first?

Where possible, yes. A time-boxed pilot with agreed success measures gives better evidence than any demo.