Appointment setting services: UK due diligence checklist

What to take away

Start with the entity

Due diligence begins with the seller's identity, not its pitch. Ask for the registered company number and check it against the register. Confirm the name on the contract matches the name that invoices you.

Watch for trading names that differ from the registered entity. You need to know which company owes you a service and which one holds the data.

A vague answer is itself a signal. Most of these businesses are small, and public filings usually show turnover, directors and any charges.

Provider models differ, from brokers that sell leads to firms running their own sales team. The tools and supplier guide sets out how those models compare on structure and pricing.

Map the data chain

Outbound prospecting relies on personal data, so the agency must explain its lawful basis for contacting people. Ask how its processing complies with UK GDPR and the Data Protection Act 2018; PECR also governs direct-marketing emails and calls. The ICO sets out the options for choosing your lawful basis for direct marketing and the conditions attached. Ask for the agency's ICO registration number and verify it against the ICO's register where registration is required; registration alone does not demonstrate compliance.

Ask where the data came from, how consent or legitimate interests were recorded, and how suppression lists are maintained. Request a sample of the audit trail, not a policy document. Ask the agency to identify the UK GDPR Article 6 lawful basis or bases it uses: consent, contract, legal obligation, vital interests, public task or legitimate interests. If it relies on legitimate interests, request its legitimate interests assessment and how it supports the proposed direct marketing.

For live marketing calls, ask how the agency identifies the recipient type and screens against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) as applicable. Check how it records consent where needed and honours objections and suppression requests.

Ask for a list of sub-processors, data storage and access locations, and international data transfer checks. If data is transferred outside the UK, ask what transfer mechanism applies, including whether an adequacy regulation, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses is used, and what assessment supports it.

If the agency claims every contact is opted in, test that claim. B2B contact data is rarely that clean, and an honest supplier will say so.

Test the advertising evidence

Ask how paid campaigns are structured, which platforms are used and how targeting is documented. LinkedIn Campaign Manager is a common tool for B2B lead generation campaigns, so ask whether the team uses it day to day.

Request a redacted view of a live campaign and the cost per qualified meeting. Redactions are fine. Refusals are not.

Check market context

Your target buyers behave differently by size and sector. Government survey work such as the Small Business Survey reports gives a sense of how smaller firms adopt new suppliers and where they report barriers.

Sample the meetings

Pick ten meetings the agency booked last quarter. Listen to the recordings, or call the buyers and ask what they expected.

You are checking three things: whether the contact was genuine, whether the meeting matched the brief, and whether the notes were accurate. A short sample beats a dashboard.

Agree the exit before the start

The contract should say who owns the prospect data, how it is returned and what happens to meetings already booked. Notice periods of 30 to 90 days are common, but the process matters more than the figure.

Ask what happens if the agency is acquired or stops trading. For example, a team paying £4,000 a month for two seats needs to know how quickly it can move that work elsewhere.

Implementation is where these terms get tested. The tool implementation notes cover the handover steps that stop a new supplier losing your first month.

Glossary

Common questions

The answers below cover documents, lawful basis, references and campaign evidence to check before signing.

What documents should I request first?

Start with the company number, the last filed accounts and a data processing agreement. Also request evidence of relevant insurance, the service-level agreement (SLA), a current sub-processor list, security controls and breach-notification and cooperation terms. These documents help you assess the supplier's identity, finances and responsibilities if something goes wrong.

How do I check an agency's lawful basis for outreach?

Ask for the specific basis it relies on, then compare that with the ICO guidance. If the answer is a generic privacy policy with no mention of outbound sales, keep asking.

Should I ask for client references?

Yes, but ask for references from clients with a similar buyer profile. A glowing reference from another sector proves less.

What if the agency refuses to share campaign data?

Treat it as a commercial risk. You can accept a redacted sample, but a flat refusal leaves you unable to verify performance or defend the spend.