Tools and providers
Part of Retail media software procurement: reading official supplier records without verdicts
Retail media vendor due diligence, closing only the questions that have evidence
Retail media vendor due diligence for England covers supplier identity, security evidence, shopper-data responsibilities, service disruption and exit planning.
Retail media vendor due diligence should establish what an England retailer is entrusting to the supplier and which evidence supports that decision. Start with the specific advertising service, not a generic company assurance pack. A vendor handling campaign administration may have different access from one processing retailer purchase data.
The checklist below is a proposed desk-review workflow, researched on 6 September 2026. It reports no completed security assessment, certification check or legal clearance. Use qualified security, privacy and commercial reviewers for the actual arrangement.
What to take away
- Close only the questions with evidence.
- Start with the specific advertising service, not a generic company assurance pack.
- Record unresolved questions about retention, deletion and supplier reuse.
- List the UK assurance evidence types you will accept.
Identify the accountable parties
- Obtain the proposed contracting entity and the product or service schedule.
- Record the retailer property and the advertising functions within scope.
- Identify support providers and other parties with access to relevant systems.
- Match each assurance document to the entity and service it covers.
A trading name on a product page may not answer all those questions. Ask the supplier to clarify the contractual chain in writing. Keep the answer with the proposed agreement so the review does not rely on an account manager's informal description.
Identify accountable parties
- Obtain proposed contracting entity and service schedule
- Record retailer property and advertising functions in scope
- Identify support providers with system access
- Match each assurance document to entity and service
- Ask supplier to clarify contractual chain in writing
Examine dependencies and evidence scope
The NCSC supply-chain security principle explains why a cloud provider's dependencies matter to service security. Request enough information for your assessor to understand those dependencies and their relationship to the advertising workload.
Examine dependencies and evidence scope
- Request dependency information for the advertising workload
- Inspect certificate issue date, expiry and covered services
- Record assessor interpretation separately from supplier claim
- Ask how material supply chain changes are communicated
- Set internal owner to decide on further review
Concrete UK evidence types to request include Cyber Essentials certification, an ISO/IEC 27001 certificate, a SOC 2 report with its period and trust criteria, and the supplier's ICO registration number.
If a certificate or audit report is supplied, inspect its issue date, expiry or review period, covered services and exclusions. Record the assessor's interpretation separately from the supplier's claim. An assurance document for another environment should not silently become evidence for the system the retailer plans to use.
Ask how material changes in the supply chain will be communicated. Set an internal owner to decide whether a change needs further review. This is a suggested oversight arrangement, not a claim that every supplier uses the same notification process.
Check administrator permissions and advertiser isolation
Request a demonstration or suitable evidence of the proposed administrator and advertiser permissions. Ask how the supplier prevents access to another advertiser's information and who can export retailer reports. Document the response without treating a screenshot as a penetration test.
Inspect permissions and service identities
- Request evidence of administrator and advertiser permissions
- Ask how one advertiser's data is isolated
- Name who authorises and removes access
- Include support access and automated credentials
- Require separate production decision before keys
Include support access and automated credentials in the review. Name who authorises access, removes it and investigates unexpected activity. Require a separate production decision before providing keys or live shopper information to a prospective vendor.
Map processor roles and transfer locations
For processing on the retailer's behalf, UK GDPR Article 28 addresses processor guarantees and contractual duties. Ask the privacy reviewer whether the described relationship is in fact processing on behalf of a controller, then assess the documents against that role.
The ICO international-transfer guide covers personal information sent or made accessible to separate organisations overseas. Map the actual entities and access locations before deciding which transfer rules apply. A hosting location alone does not describe the complete relationship.
Record unresolved questions about retention, deletion and supplier reuse. An illustrative expectation is a stated retention period for campaign data, such as 13 months, and deletion within 30 days of termination.
Do not turn a general privacy notice into proof that your proposed audience processing is authorised. Contract terms, lawful basis and operational behaviour need to be considered together by the appropriate specialist.
Ask about disruption and departure
Obtain the process for reporting an incident affecting the retailer's advertising service. Clarify the information available to your incident team and how the supplier will support investigation. Any promised response time should come from the actual agreement, not an assumed industry standard.
An illustrative expectation is notification within 72 hours of confirming an incident, with an initial impact summary and named contact. The contract should state the actual time and escalation route.
Request an exit description naming the report export format, such as CSV, and the access-removal confirmation the supplier will provide. Have the solicitor examine the proposed termination terms. Record which tasks the retailer would still need to perform after the supplier's service ends.
Close only the questions with evidence
Prepare an exceptions register with the missing evidence, responsible reviewer and next action. A completed row might read: missing evidence, current SOC 2 report for the campaign platform; owner, information security lead; next action, request the report and set a review date.
Keep security guidance distinct from law and contractual promises. Advance the purchase only through the retailer's actual approval process, and refresh this checklist's sources before using it for a later procurement.
Before you act
- Obtain the proposed contracting entity and service schedule.
- Record the retailer property and advertising functions in scope.
- Ask how material supply chain changes will be communicated.
- Request evidence of administrator and advertiser permissions.
- Prepare an exceptions register with missing evidence and next actions.
Common questions
What should due diligence establish about a retail media vendor?
It should establish what an England retailer is entrusting to the supplier and which evidence supports that decision. Start with the specific advertising service, not a generic company assurance pack. A vendor handling campaign administration may have different access from one processing retailer purchase data.
How should assurance documents be treated during review?
Inspect each document's issue date, expiry or review period, covered services and exclusions. Record the assessor's interpretation separately from the supplier's claim. An assurance document for another environment should not silently become evidence for the system the retailer plans to use.
What should happen before providing keys or live shopper information?
Require a separate production decision before providing keys or live shopper information to a prospective vendor. Include support access and automated credentials in the review. Name who authorises access, removes it and investigates unexpected activity.
