Press release distribution vendor due diligence checklist

Use this press release distribution vendor due diligence checklist to review the evidence for an exact UK-available service supporting one authorised announcement by an organisation operating in England. It is a question-led review, not a supplier score; leave an unchecked or contradictory field on HOLD until evidence resolves it.

What to take away

Due diligence exposes unanswered questions rather than producing a supplier score.
An unchecked or contradictory field stays on HOLD until evidence resolves it.
A dashboard label is not evidence of the next event in the delivery chain.
Missing evidence in one lane cannot be averaged away by strong evidence in another.
Test exit with an authorised fixture or synthetic record before dependency grows.

Identity and offer

Record the legal name, company number, registered office, previous names, contracting entity and invoice issuer.
Name the authorised signatory, using the buyer's own team roles.
Reconcile trading name, terms, privacy notice, data agreement and support provider.
Fix the edition, plan, add-ons, UK availability, evidence date and change-notice route.
Save first-party evidence for every material capability instead of relying on a directory or testimonial.

A register overview of a company lists registered details, but the accuracy of the information filed is not checked. A register entry does not prove trading status, quality, solvency or suitability, so date the lookup and repeat it before signing.

Deliverable and endpoints

Define submission, acceptance, rejection, delivery, syndication, indexing and monitoring in the supplier's own vocabulary.
Identify who controls each endpoint and which record proves each state.
Keep paid placement and technical transmission separate from editorial publication; see media outreach routes.
Reject reach, readership, coverage or outcome claims that lack compatible evidence and definitions.

The contract should say which status is purchased. A dashboard label is not evidence of the next event in the chain.

Request a redacted example of the promised delivery record and its field definitions. If the buyer cannot reconcile that sample with the proposed acceptance event, the service description is incomplete.

Contacts, processing and transfers

Obtain media-list provenance, collection dates, stated purposes, accuracy controls, objection handling and suppression evidence.
Map the buyer, supplier and subprocessor decisions for account, contact, content, analytics and monitoring data.
Check locations, remote access, transfers, retention, export and deletion.
Record any ICO review notice on the guidance you rely on and name the owner of the recheck.

The ICO guidance on contracts states that a written contract is required whenever a controller uses a processor. A processor that uses a sub-processor needs a written contract with it as well, and must delete or return all personal data at the end of the contract.

Content, rights and accessibility

State who authorises factual claims and who may change approved text.
List the licences for copy, images, video, quotations, logos and monitoring extracts.
Record supported formats, transformations, inspection method and accessibility evidence.
Keep the original and the correction history available outside the supplier account.

A supplier that can upload an image has not been given permission to use it. Ask who created each asset and on what terms. Alternative formats take time to produce, so build them into the timetable before launch. Check the supplier's output in each format you need rather than assuming it.

Security, continuity and proof

Ask for named security ownership, access controls, authentication, audit logs and support-access records.
Inspect incident notification, protected backup, account recovery and service-change evidence.
Define who can suspend transmission, revoke access, restore the source and authorise restart.
Request the current scope of any independent assurance rather than inferring it from a badge.

The NCSC supplier assurance questions ask who has responsibility for cyber security at the supplier and whether it has plans and processes to cope with an incident and recover from it. They do not certify an organisation.

Commercial and exit file

Capture currency, VAT statement, charge unit, period, quantity, term, renewal, support and correction costs.
Define dispute evidence, credits, export format, suppression continuity, deletion and surviving licences.
Test exit with an authorised fixture or synthetic record before dependency grows.
Leave buyer weights and acceptance thresholds blank for accountable owners.

Whether VAT applies to a given contract is for a qualified tax reviewer. Settle correction, retention and exit in the commercial contract before you sign.

Named rules and registers to check

Each row below names the rule or register behind a lane, so the dossier can point to a document instead of a supplier's promise.

Authority / rule	Evidence to request
Companies House register	Dated lookup of the contracting entity
UK GDPR Article 28	Written processor contract and sub-processor terms
Data Protection (Charges and Information) Regulations 2018	Proof the supplier pays the ICO data protection fee, or an exemption
PECR	Consent and suppression records for the contact list
NCSC Cyber Essentials	Certificate level and the scope it covers
NCSC supplier assurance questions	Written answers on security ownership and incident recovery

Ask which controls and which parts of the service a Cyber Essentials certificate covers. A sub-processor must also be bound by a contract that imposes the same data protection obligations as the processor has.

Keep the lanes independent

Legal, privacy and PECR, rights, accessibility, security, procurement, finance, commercial and editorial decisions stay independent. Missing evidence in one lane cannot be averaged away by strong evidence in another. The UK rules and compliance guide maps which lanes apply to an announcement.

Lane / Gap that keeps the file on HOLD

Identity: Contracting entity and invoice issuer do not match
Deliverable: Status purchased is not defined in the contract
Data: No sub-processor list or deletion term
Security: Independent assurance has no stated scope
Exit: Export and deletion never tested

For related selection considerations, see the tools and supplier guide; record each open gap in this due-diligence file with an owner and a date.

Before you act

Record legal name, company number and authorised signatory.
Save first-party evidence for every material capability.
Request a redacted example of the promised delivery record.
Map buyer, supplier and subprocessor data decisions.
Leave acceptance thresholds blank for accountable owners.

Common questions

Does a Companies House entry prove a supplier is sound?

No. The accuracy of the information filed is not checked, and a register entry does not prove trading status, quality, solvency or suitability. Save first-party evidence for every material capability as well.

How should a buyer treat reach or readership claims?

Reject them unless the supplier gives compatible evidence and definitions. The contract should state which status is purchased, because a dashboard label does not evidence the next event in the chain.

Why test exit before dependency grows?

Once a team relies on a service, leaving it costs more. An authorised fixture or synthetic record shows whether export, suppression continuity and deletion work before real data is involved.