Checks to run before you shortlist event marketing agencies and platforms

What to take away

The ASA now keeps a public list of advertisers that have had complaints upheld and not complied, so a shortlist check takes minutes, not weeks.
The ICO expects online safety and data protection to be designed into campaign tracking, not bolted on after the brief.
The Data Protection Act 2018 sets the statutory frame your supplier contracts must sit inside.
Inclusion criteria for any shortlista named legal entity, a dated method, a lawful basis for data, and a route to exit.
This list does not rank providers or claim testing of any product; it gives the checks to run before you invite anyone to pitch.

Check the advertiser record first

Before you read a single proposal, check whether the supplier appears on the non-compliant online advertisers list published by the Advertising Standards Authority. An upheld complaint that remains unresolved is a fact about the business, not a matter of taste. For an English agency brief, that check sits alongside Companies House filings and any published client references.

Pre-proposal supplier checks

ASA non-compliant advertisers list
Companies House filings
Published client references
Agency or software? Questions change

Ask yourself what the shortlist is for. If you are comparing agencies, the event marketing agency reviews in England page sets out what a defensible review record looks like. If you are comparing software, the questions change: data residency, export formats, and who owns the attendee record after the contract ends.

Apply one method to every candidate

The event marketing reviews and comparison methods for 2027 guide explains how to score providers on the same criteria so the comparison survives scrutiny. Pick your criteria before you see any pitch deck. Write them down. Then score every candidate against the same sheet.

Same scoring sheet for all

Registered UK entity
Named data protection contact
Documented sub-processor list
Subject access request evidence
Criteria written before pitch decks

Useful criteria for an English brief include: a registered UK entity, a named data protection contact, a documented sub-processor list, and evidence of how the supplier handles a subject access request. None of these require a trial. They are documents you can request.

Data protection is part of the shortlist

Any campaign that captures attendee data needs a lawful basis and a retention rule. The ICO guidance on online safety and data protection explains how those duties apply to online services, and the same thinking applies to registration pages and follow-up email. The statutory backdrop is the Data Protection Act 2018, which your contract should reference by name.

If a supplier cannot say where attendee data is stored or how long it is kept, that is not a detail to settle later. It is a reason to move to the next candidate.

Before and after: what a shortlist check changes

Before and after

Before the check

Advertiser record: Reputation taken on trust
Data handling: Assumed to be compliant
Contract: Standard terms accepted
Scoring: Impressions compared

After the check

Advertiser record: Public complaint record reviewed
Data handling: Lawful basis and retention documented
Contract: Data clauses and exit route agreed
Scoring: Same criteria applied to all

For example, a team paying £6,000 a month for campaign delivery might discover during the check that the data processing agreement was never signed. The cost of fixing that after launch is higher than the cost of asking first.

Red flags that end a conversation

A refusal to name the legal entity behind the trading name is a red flag. So is a proposal with no dated figures, or one that cites an award without a year. Vague claims about reach are common; a supplier that cannot separate measured results from estimates is harder to hold to account.

Watch for sub-processors added after signature without notice. Watch for retention periods described as "as long as needed". Both are contract points you can settle in writing before you commit budget.

Set your own inclusion criteria

Geography matters here. Rules cited for England may differ in Scotland, Wales or Northern Ireland, so confirm which jurisdiction a supplier's compliance statement covers. A shortlist built for an English campaign should say so.

Finally, decide how many providers to approach. Three to five is usually enough to compare without exhausting your team. Give each the same brief, the same deadline and the same scoring sheet.

Common questions

Do I need to check the ASA list for every provider?

It is a quick public check and the ASA publishes the list precisely so advertisers can do due diligence. Treat an unresolved entry as a question to raise, not an automatic rejection.

Can a software provider be on the same shortlist as an agency?

Only if your criteria suit both. Agencies and platforms are scored differently, so keep separate sheets unless the brief genuinely overlaps.

What documents should I request before scoring?

Ask for the legal entity name, a data processing agreement, a sub-processor list and a retention schedule. These are standard requests and a serious supplier will have them ready.

How long should a shortlist check take?

For a small campaign, a few hours of document review is usually enough. The aim is to remove obvious risk before you spend time on pitches.