Tools and providers
Creator discovery platforms: six legal and contract checks before you choose a supplier, from Companies House to PECR
Six named checks before you buy a creator discovery platform in England: Companies House, processor contracts, DPIA, PECR, child performance licences and copyright.
Creator discovery software promises a faster search for creators, but it also moves personal data, marketing messages and creative rights through a supplier. Start the job in a buyer-owned spreadsheet, as the strategy and planning record describes. Software should earn its place by doing the job more safely, not by showing a larger search result.
What to take away
- Look the supplier up in the Companies House register before you read its brochure.
- A processor contract must say the processor may only process personal data on the controller's documented instructions.
- A DPIA is required where processing is likely to result in a high risk to individuals.
- PECR covers electronic marketing messages by phone, fax, email or text, and cookies.
- Children under 14 working in television, theatre or modelling need a performance licence.
Check 1: who the supplier is
Companies House company information, available free on GOV.UK, shows the registered address and date of incorporation, plus officers and previous names. Record the search date and compare the legal name with the one on the order form.
A supplier that cannot name its legal entity cannot sign the contract in the next check. Hold the purchase until the entity is confirmed.
Check 2: the processor contract
What the contract must say is set by UK GDPR Article 28(3): the contract must say that the processor may only process personal data in line with the controller's documented instructions. A discovery platform that imports creator profiles is processing personal data on your behalf in many set-ups.
Ask for the processor terms before the trial, and match them to your own UK rules and compliance notes. A supplier that treats itself as a controller of your search data needs a separate conversation.
Check 3: the impact assessment
Article 35(1) of the UK GDPR requires a DPIA where a type of processing is likely to result in a high risk to the rights and freedoms of individuals. Decide before the trial whether profiling creators at scale falls into that category, and record the reasoning.
A synthetic test pack, kept next to your manual register, lets you try the platform without real creator data. Use duplicate identities, expired fields and conflicting records, and keep the results with the DPIA file.
Check 4: marketing messages under PECR
The Privacy and Electronic Communications Regulations (PECR) guide is for organisations that wish to send electronic marketing messages by phone, fax, email or text, use cookies, or provide electronic communication services to the public. Outreach tools inside a discovery platform fall into that scope.
Ask the supplier which channels its outreach feature uses and who controls sending. Keep that answer in the vendor due diligence record before any message goes out.
Check 5: child creators and performance licences
Children under 14 can work in areas like television, theatre and modelling, and children working in these areas will need a performance licence. If the platform lists child creators, your process needs a licence check before contact.
The Children (Performances and Activities) (England) Regulations 2014 apply to the granting of licences for children resident in England by local authorities in England, so the licensing authority is the child's local council. Treat safeguarding as a gate that no supplier score can override. Exclude child profiles from outreach by default until a named person has confirmed the licensing position.
Check 6: rights in creator work
Copyright protects a creator's work and stops others from using it without their permission. A discovery platform that shows creator content in previews does not give you the right to reuse it.
Under section 1 of the Copyright, Designs and Patents Act 1988 it is a property right in original literary, dramatic, musical or artistic works, sound recordings, films and broadcasts. Write down what the supplier may display, what you may store and what must be deleted at exit. Put that into the commercial contracts review.
Put the checks into one record
| Check | Named source | Evidence to keep |
|---|---|---|
| Supplier identity | Companies House company information | Registered name, address, search date |
| Processor contract | UK GDPR Article 28(3) | Signed terms with documented-instructions clause |
| Impact assessment | UK GDPR Article 35(1) | DPIA decision and date |
| Marketing messages | ICO guide to PECR | Channel list and sender control |
| Child creators | GOV.UK performance licence rule | Licence check before contact |
| Creator rights | GOV.UK copyright guidance | Display and storage permissions |
Compare these answers across suppliers using the same business models questions and one synthetic test. Keep the manual register as the fallback if no supplier passes.
Before you act
- Look up each supplier in the Companies House register.
- Get the processor terms and check the documented-instructions clause.
- Record the DPIA decision before any trial.
- Ask which outreach channels the platform uses under PECR.
- Exclude child profiles until the licence position is confirmed.
- Write down display, storage and exit rights for creator content.
Common questions
Does a discovery platform need a DPIA?
Article 35(1) requires one where processing is likely to result in a high risk to individuals. Record your reasoning either way, and review it if the platform adds profiling features.
Can I contact any creator the platform lists?
Not without checks. Electronic marketing messages fall under PECR, and a child working in television, theatre or modelling needs a performance licence.
In this guide
- Selecting creator discovery software: a manual baseline register and six independent gatesSelect creator discovery software for one England brief: build a manual register first, then test candidates such as Aspire, GRIN and Traackr through six gates.
- Creator discovery tools: Modash and GRIN list prices side by side for UK buyersCreator discovery tools Modash and GRIN publish plan prices in US dollars. See both price ladders, how each bills, and the UK data and ad checks to run first.
- Creator discovery platforms supplier routes for one briefCreator discovery platforms supplier routes for one England brief: ten routes named, which fits which buyer condition, one price normalised, and the gates.
- Creator discovery platforms vendor due diligence checklistA creator discovery platforms vendor due diligence checklist for checking creator data, audience quality, platform access, campaign features and evidence.
- Implementing a creator discovery tool on synthetic records and proving exit before entryImplement a creator discovery tool with synthetic creator records, independent approval gates, controlled states, correction tests and proved exit.
