Vendor due diligence for UGC marketplaces: build a dated evidence ledger

What to take away

Run due diligence on the exact legal entity, UK service and edition you will buy, and keep the results in a dated evidence ledger that separates claims from records.
Each row records the request, the supplier's response, the independent source, the test evidence and the reviewer, plus an expiry date and a status.
Public profile data is not permission for reuse or outreach. Payment does not by itself transfer copyright in the content.
A low price cannot cancel a missing right or a safeguarding failure. An unresolved compulsory gate means HOLD before signature.
Named reviewers sign off separately. Cover commercial, privacy, advertising, IP and safeguarding. Then add accessibility, security, finance and tax.

Identity and contracting entity checks

Pull the Companies House record for the legal name and company number on the proposal. Match the registered address, the contracting entity in the terms and the trading name. Ask who signs, and evidence that person's authority to bind the supplier.

The company information service is evidence of filed facts only. It does not prove the supplier built the product, owns its creator network or holds the rights it sells. Treat reach, matching and analytics claims as unanswered rows until you see test evidence on your own sample brief.

Record the service scope, the creator consideration and the platform charges separately. Then record production, media, currency and the billing unit. Keep renewal and cancellation apart from price, since a cheap unit rate with a lock-in is a different buy.

Example ledger row for one England commission

The row below is a blank template, not a supplier record. Keep the supplier unnamed and the brand fictional.

Example ledger row

Request: Signed confirmation of the contracting entity, the service edition and the terms date
Supplier response: Written reply from the named account contact, with a document reference
Independent source: Companies House filing from a dated search
Test evidence: Screenshot of a data export produced on your own sample brief
Reviewer, expiry, status: Privacy lead, 12 months, unresolved

Build the full ledger from that template, one row per claim, dated, with the reviewer named. Anything without a row stays unresolved.

Data protection and contact permissions

Request a field register covering provenance, purpose, definition, timestamp and recipients. Add correction, suppression and deletion to the same register. Fix controller and processor roles from what each party actually decides, then document instructions, subprocessors and transfers.

The ICO's guidance on contracts and liabilities between controllers and processors covers these contract topics. Under PECR, keep research, service messages, creator recruitment and marketing separate. Record which route is permitted before any contact.

Rights, claims and safeguarding

Map who holds each right, one asset version at a time. The schedule should cover script, performance, video, stills and music. It should also list artwork, trademarks, edits and territory, plus channels, term and reuse rights.

The IPO's commissioned-work guidance explains why payment does not necessarily transfer copyright. Keep an objective source for every claim, and check disclosure before publication.

The advertising rules check shows how recognition, claims and rights fit inside one advert. Department for Education guidance applies to specified child performances and activities in England and calls for case review.

Treat age as unresolved until an approved, minimised check resolves it. Do not infer age or protected traits from appearance or profiles.

Security, accessibility and exit checks

Require role-based access, authentication, logs and incident contacts. Add recovery and prompt access removal. The NCSC's cloud supply-chain guidance asks buyers to map supplier access and downstream dependencies.

Test the workflow and the final asset with an accessibility specialist, using fictional data and an unbranded file. GOV.UK's "Make things accessible" guidance targets public programmes but supplies useful evidence questions.

Exercise correction, suppression, export, deletion and account removal. Record the format, completeness, timing and residual dependency.

Payment, VAT and platform reporting

Identify the legal payee and payer for the supplier fee, creator consideration, deductions and any media spend. Keep currency, VAT basis, billing unit and period as separate fields.

HMRC's guidance on collecting and verifying seller information sets due diligence expectations for a reporting platform operator. Check that the February 2026 edition is still current at publication. A tax adviser decides whether the service and transaction fall in scope.

The seven contract categories article helps you place each payment and rights obligation with the right document. Keep a correction and complaint route with named owners, and rehearse failed payment, cancelled work and supplier unavailability.

Common questions

What should each ledger row contain?

Each row carries the request, the supplier's response, the independent source, the test evidence and the reviewer. It also holds an expiry date and a pass, fail or unresolved status. Date the row and tie it to the exact entity, service and edition.

Why does payment not transfer copyright?

The IPO's commissioned-work guidance explains that paying a creator does not automatically move the copyright. Map who holds each right, then license script, performance, video, stills and music first. Add artwork, trademarks, edits, territory and term in the same schedule.

How should age and child performance be handled?

Treat age as unresolved until an approved, minimised check resolves it, and never infer age or protected traits from a profile. Department for Education guidance applies to specified child performances and activities in England and calls for case review.

When is a certificate or policy enough?

It supports a ledger row but does not answer configuration-specific questions on its own. Retest export, access revocation and deletion before signature and again after a relevant service change.