Tools and providers
PR agency onboarding checklist: what to verify before a tool goes live
A buyer-side checklist for PR agency onboarding: contract, data protection, migration and go-live checks to complete before any tool is connected.
What to take away
- Confirm the PR agency client onboarding process in writing before any tool is connected, with named owners on both sides.
- Check the contract, data protection roles and intellectual property terms before you grant access to your systems.
- Test a sample data migration, agree rollback steps and set go-live criteria that carry evidence.
- Keep the build controlled once checks pass, using a rehearsed route for access and approvals.
Define the onboarding scope before tools are discussed
Start with a written scope. Ask which platforms the agency will use and which will touch your data.
A media monitoring tool such as Cision, Meltwater or Brandwatch may need your domain, logo files and press list. A project board in Asana, Trello or Monday.com may need staff names and email addresses. The practical detail is set out in A PR workflow in six steps.
Do not open access until the scope is signed off by both sides.
The pre-rollout verification checklist
Work through these steps in order. Each one produces a document you can keep.
- Name a technical owner at the agency and at your business.
- List every data item the agency needs and the lawful basis for holding it.
- Request a sample export from your current system and check field mapping by hand.
- Agree approval states for outbound content, from draft to published.
- Write down rollback steps and the date the agency will delete or return data.
- Set the go-live date only after steps 1 to 5 are signed.
Pre-rollout verification checklist
| Check | Evidence to request | Sign-off |
|---|---|---|
| Data protection roles | Processor agreement and ICO registration | Your data lead |
| Migration sample | Matched field list with counts | Technical owner |
| Content approvals | Written workflow with named approvers | Comms lead |
| Exit and rollback | Dated plan with contacts | Both parties |
Contract, data and access checks
Check the contract before access is granted. The ICO guidance on UK GDPR sets out what a processor agreement must contain, including purpose limits and breach notification.
If the agency handles crisis communications, confirm it applies the ASA advertising codes to claims and comparisons.
Directors signing for a limited company should confirm authority under the Companies Act 2006. Check the company number and the registered name on Companies House.
Access levels and approval states
Grant least-privilege access first. A media monitoring seat does not need admin rights. Give the agency a named user account rather than a shared login. Set approval states in the tool: draft, review, approved, published. Record who can move content between states. Review the list at day 30.
Example: a stalled go-live in Manchester
A Manchester B2B software firm signed an agency retainer in March. The agency asked for CRM access on day two.
Nobody had checked the processor agreement or the field mapping. The first import duplicated 4,000 contact records and the go-live slipped by three weeks.
A simple sample export would have caught the mismatch before access was granted.
Verification before access is cheaper than a botched import.
Data migration verification and go-live criteria
Data migration verification means proving that what left your system matches what arrived. Ask for row counts, a field map and a list of dropped or merged records. Check a random sample of 20 contacts by eye.
Go-live criteria should be written and measurable. Examples include all named users logging in, the first report matching source data, and one tested rollback.
Once the client is verified, the next stage is a controlled build. PR agencies tool implementation covers access states, synthetic testing and exit evidence for England-based agencies.
Common questions
What should a PR agency onboarding checklist cover first?
Scope, named owners, data items and the lawful basis for holding them. Contract terms and access levels come next. Migration testing and go-live criteria close the list.
Who owns the go-live decision?
The client owns it. The agency can recommend a date, but your technical owner and data lead should sign before any tool goes live.
How do we verify data migration?
Request a sample export, compare row counts and check a random sample by hand. Keep the field map and the list of dropped records as evidence.
What if the agency cannot meet the checks?
Pause access and ask for the missing evidence in writing. A delayed go-live is cheaper than a data breach or a duplicated contact list.
