Checks to complete before appointing a property-media supplier, identity through exit

Use this property creators selection checklist before a quote becomes a commitment. It covers one supplier handling media about identifiable property in England. This is a selection framework, not an assessment of any candidate. A failed mandatory gate means pause, not a lower overall score.

What to take away

A failed mandatory gate means pause the selection, not a lower overall score.
Register facts prove identity only, so request separate proof for competence, insurance and authority.
One approval does not answer both the ASA and FCA disclosure questions.
Reopen the selection when the entity, product edition, team, contract, data map, rights or regulator position changes.
Approve only the stated configuration for the stated period.

Identity and service boundary

Write the precise input, output, England area, property types, channels, users, deadline and exclusions.
Record the legal name, trading name, company number where applicable, address, contracting party and subcontractors.
Reconcile the proposal with Companies House's public company information, the contract and privacy notice.
Mark register facts as identity evidence only. Request separate proof for competence, insurance and authority.

An unexplained entity mismatch stops selection until resolved. Do the same when a sales deck describes a broader service than the contract delivers.

Property evidence and approval

Give every property claim a source owner, URL or record, geography, observation date, retrieval date, qualifier and reviewer.
Check that scripts, captions, thumbnails and shortened posts preserve approved wording.
Require correction, withdrawal and archive procedures with named authority.

HM Land Registry describes Price Paid Data as information about specified sales for value lodged in England and Wales, subject to exclusions and revision. Reject any workflow that silently converts such a record into a valuation, current asking price or media-attributed result.

Commercial and regulated communication

Label editorial, commissioned, sponsored, gifted and affiliate material separately.
Test disclosure at first encounter, including previews, reposts and cropped formats.
Route any mortgage, investment or other regulated proposition to the named FCA financial-promotion reviewer.
Where a regulated financial promotion is involved, check the named firm and relevant permissions on the FCA Register. Identify whether section 21 of the Financial Services and Markets Act 2000 (FSMA) applies, and obtain evidence of approval by an authorised person where required.
Apply the CAP Code to advertising claims and disclosures, alongside ASA/CAP social-ad guidance; retain substantiation for objective claims.

ASA/CAP's social-ad guidance addresses recognisability, while the FCA's FG24/1 guidance covers social-media financial promotions. One approval does not answer the other question.

Personal data and direct marketing

Map enquiry details, filming permissions, addresses, identifiable interiors, analytics identifiers and audience lists.
Identify controller decisions, processor instructions, sub-processors, access locations, retention and the lawful route for each use.
Separate research or service contact from later electronic marketing permission.
Demand incident notice, data-subject assistance, audit, return, deletion and overseas-transfer evidence.
Where the supplier is required to pay the data protection fee, obtain its ICO registration number and verify it in the ICO register of fee payers. If it claims an exemption, record the reason.
For electronic direct marketing, check the applicable PECR consent or soft opt-in basis, suppression list and unsubscribe route before using an audience list.

Compare the proposed terms with the ICO's controller and processor contract guidance. The ICO says that material is under review following the Data (Use and Access) Act, so the privacy reviewer must recheck it at signature and publication.

Rights, accessibility and security

List the owner, permission, licence territory, media, term, alteration rights and withdrawal route for every asset and appearance.
Treat the IPO's digital-images copyright notice as a review prompt, not a substitute for the actual licence.
Specify captions, transcripts, audio description, keyboard use and alternative formats for the intended audience.
Request security-control scope, issuer, date, expiry, remote access, incident rehearsal, backup and restore evidence.
For filming in occupied homes, agree who will enter, verify their identity and follow the access protocol. Ask whether the commissioning agent requires a DBS (Disclosure and Barring Service) check or equivalent vetting; do not treat a certificate as blanket clearance.
Where needed, obtain signed appearance or model releases and property or location releases from the person with authority. Specify channels, paid promotion, territory, term, edits and onward use.
For every music track, record the composition and recording rights holders and retain synchronisation and master-use permissions. Check whether applicable PRS for Music or PPL licences also cover the planned public use.
Where aerial filming is proposed, obtain the pilot's Flyer ID, the operator's Operator ID and evidence of valid insurance; check the CAA drone filming requirements. Check any CAA operational authorisation required for the planned flight.

GOV.UK's accessible communication formats explains that different needs require different formats. NCSC supply-chain principles support continuing supplier assurance. Neither source proves that a candidate passed a user test or a security test.

For web deliverables, state whether WCAG 2.2 AA is the acceptance target and request test evidence. If the supplier claims Cyber Essentials or ISO/IEC 27001 certification, verify the named entity, scope and validity on the certificate; a certification claim does not replace checks of the proposed controls.

Contract, trial and exit

Normalise deliverables, revisions, dependencies, acceptance, payment, tax, liability, insurance, termination and continuity.
Use identical synthetic or specifically authorised test assets, tasks, devices, configurations and evidence rules for every shortlisted option.
Test export, correction, withdrawal, deletion and restore before relying on the service.
Record unknowns, conflicts, funding and all untested behaviour beside the decision.
Obtain current professional indemnity and public liability insurance certificates and policy schedules. Check the insured legal entity, dates, territorial scope, exclusions and whether the stated media work and any drone filming are covered.
Ensure the contract expressly covers IP ownership or licence and raw files; permitted reuse; indemnities and liability; approval, correction and takedown; termination and transition; service continuity and export; data return and deletion; and subcontractor controls and change notice.

Approve only the stated configuration for the stated period. Reopen the selection when the entity, product edition, team, contract, data map, rights, property purpose or regulator position changes. Keep the purchase on hold until every specialist has signed their own non-compensating gate.

Before you act

Write the precise input, output, area, property types, channels, users, deadline and exclusions.
Give every property claim a source owner, geography, observation date, retrieval date and reviewer.
Label editorial, commissioned, sponsored, gifted and affiliate material separately.
Map enquiry details, permissions, addresses, interiors, analytics identifiers and audience lists.
List the owner, permission, licence territory, media, term and withdrawal route for every asset.
Test export, correction, withdrawal, deletion and restore before relying on the service.

Common questions

What should happen when an entity mismatch is unexplained?

The article says an unexplained entity mismatch stops selection until resolved. Do the same when a sales deck describes a broader service than the contract delivers.

How should Price Paid Data records be treated in a media workflow?

HM Land Registry describes Price Paid Data as information about specified sales for value lodged in England and Wales, subject to exclusions and revision. The article says to reject any workflow that silently converts such a record into a valuation, current asking price or media-attributed result.

Why must the privacy reviewer recheck ICO guidance at signature and publication?

The ICO says its controller and processor contract guidance is under review following the Data (Use and Access) Act. The article therefore requires the privacy reviewer to recheck that material at signature and publication, comparing the proposed terms against it.