Reviews
Part of How to review branding agencies: declared evidence and like-for-like criteria
Branding agencies selection checklist: gates before signing
A branding agencies selection checklist for the buyer ready to appoint: rights, accessibility, privacy, security and contract gates, each with a stop rule.
Once a preferred agency is chosen, five gates remain before anyone signs: rights, accessibility, privacy, security and contract. Each gate has its own evidence and its own stop rule, and a strong portfolio cannot offset a failed one. Use pass, fail, conditional and unknown rather than one blended score.
The checks assume an engagement delivered to an organisation in England and come from desk research. They are not legal, tax or procurement advice, so named UK reviewers must apply the sources to the actual parties, work and channels. No candidate proposal, contract or system was tested.
What to take away
- A strong portfolio cannot offset an uncertain contracting party, missing rights or a failed privacy control.
- Commissioned copyright does not automatically belong to the commissioner, so trace the chain of title.
- Treat untested accessibility material as unknown, not conformant, until an evaluator checks it.
- Contract labels do not decide who is controller or processor. What each party actually does decides it.
- Stop award when bids use incompatible units or a material term remains unapproved.
Five gates and where each one stops
Five gates sit between a preferred agency and a signature. Each one asks for named evidence and names the point at which appointment stops. A pass on one gate never buys a pass on another, and a gap in any of them is a reason to pause.
| Gate | Ask the agency for | Stop when |
|---|---|---|
| Rights | Inventory of work, creators and third-party licences | A required right cannot be traced |
| Accessibility | Named evaluator, sample, tools, defects, retest route | A claim of conformance rests on no test |
| Privacy | Purposes, fields, roles, retention, deletion | Nobody can say why the data is used or by whom |
| Security | Systems, access roles, recovery and offboarding evidence | The buyer could not get work back or cut off access |
| Contract | Proposals on one currency, VAT basis and billing unit | Bids differ in unit, or a key term awaits approval |
Confirm the contracting entity and the signatory's authority before any of these gates. Match the company details across the proposal, contract and bank records, and stop if either remains unclear. Vendor due diligence covers that step in full.
Legal identity gate checks
- Full company name and number
- Registered and trading addresses
- VAT details where relevant
- Parent, subcontractors, invoicing entity
- Match fields to proposal and contract
- Record Companies House page and date
Creative fit and team come first
Judge creative fit on the work the credited team will do for you, not on the agency's best-known project. Ask how the agency would understand your organisation, audience and brief, and how its proposed strategy connects to the creative work it shows.
- Ask what the agency itself delivered and what the credited team will deliver for you.
- Discuss sector experience, roles, availability, who leads the work and how continuity is handled.
- Clarify what any pitch involves and how speculative work may be used before comparing proposals.
Meet the people who would work on the account and consider whether communication and working styles fit. Assess pitch work for understanding of the brief, quality of thinking and collaboration. A polished pitch from a different team is not evidence of what you will receive.
Rights: trace the chain of title
Commissioning a work does not make the commissioner its owner. The Intellectual Property Office's guidance says that the first legal owner of copyright is the creator, not the commissioner, unless the parties agree otherwise in writing. Contract wording therefore decides what you can use.
- Inventory names, strategy, artwork, type, images, copy, code, research and working files.
- Identify creators, pre-existing material, third-party licences, territory, duration and permitted changes.
- Specify assignment or licence, moral-rights handling, warranties, infringement route and handover evidence.
The Copyright, Designs and Patents Act 1988 is the relevant UK copyright legislation. A named UK IP lawyer should review the actual chain of title and wording. Stop release when a required right cannot be traced, even if the creative work is finished and approved.
Accessibility and equality
Treat untested accessibility material as unknown, not conformant. Define the users, artefacts, channels, target standard and legal scope first. Then name the evaluator, sample, tools, manual checks, defects and retest route, and require accessible source files with clear correction responsibilities.
The Equality Act 2010 applies in England, so assess the relevant duties in light of the organisation, service and users. The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 cover public-sector websites and mobile applications, not all private branding work.
W3C's conformance evaluation method for web content covers scope, representative sampling and evaluator expertise. It is a way to structure an evaluation. It does not decide English legal duties or certify an agency, so the legal question stays with a named reviewer.
Privacy: who decides what
Controller and processor roles follow what each party actually does, not what the contract calls it. The ICO's guidance on controllers and processors makes the allocation fact-specific. Map people, fields, sources, access, retention, rights, transfers and deletion before any personal data moves.
Separate research, service administration, analytics and direct marketing purposes, because each needs its own route. For UK processing, check the UK GDPR and the Data Protection Act 2018 against the actual processing. Stop personal-data use if the purpose, role or lawful route is unresolved.
Security: can you get your work back
The practical test is recovery. Record the agency's systems, repositories, devices, access roles, suppliers and processing locations. Then ask for incident, vulnerability, backup, recovery, offboarding and deletion evidence, and test access and export with synthetic, authorised material.
The NCSC's supplier assurance questions offer a structured starting point for assessing an agency's security arrangements. They do not certify the agency's answers or replace proportionate technical review by someone who can read them. Stop if the buyer cannot recover work or remove access safely.
Money and contract terms
Compare proposals only after putting them on one footing: one currency, VAT treatment, billing unit, period, quantity, inclusions and exclusions. Check assumptions, expenses, changes, cancellation, late payment and exit costs. Do not invent an average fee or infer value from an agency's client list.
Settle parties, scope, acceptance, team, subcontracting, confidentiality, data terms, liability, insurance, termination and continuity in the commercial contract. Use independent finance, tax, procurement and commercial legal reviewers. Stop award when bids use incompatible units or a material term remains unapproved.
Before you sign
- Compare what the agency delivered itself with what the credited team will deliver.
- Inventory proposed names, artwork, images, copy and code, with creators and licences.
- Name the accessibility evaluator, sample, tools and retest route.
- Map personal data purposes, fields, access, retention and deletion.
- Test access and export with synthetic, authorised material.
- Put every bid on one currency, VAT basis and billing unit.
- Log each gate's owner, evidence, result and expiry.
Common questions
Does commissioning a branding agency transfer copyright to the buyer?
No. Unless the parties agree otherwise in writing, the creator is the first legal owner. The buyer gets rights through a written assignment or licence, so wording and warranties matter more than the invoice or the brief.
Can an untested accessibility statement count as conformant?
No. A statement without an independent check tells you what the agency hopes is true. Record the result as unknown until someone qualified has examined a sample and reported defects, and settle the legal scope separately with a UK reviewer.
Who is the controller when an agency handles research data?
It depends on the facts. A party that decides why and how the data is used is acting as a controller whatever the contract says. Look at who instructs whom in practice, and pause the work until that is written down.
When should security stop an appointment?
When the agency cannot show how you would retrieve files and end its access if the relationship stopped. Ask for its incident, backup and offboarding evidence, and try an export on dummy material before any live files are shared with it.
