Tools and providers
Part of Choosing a creator stack for family publishing with privacy and exit checks built in
Checking a family-content vendor's data chain, security and exit before live information goes in
Check a family-content vendor's identity, data chain, security, access, accessibility, delivery and exit evidence before approving live information.
Complete this checklist before a supplier receives subscriber details, private messages, contracts or unpublished family media. Record the answer, supporting document, reviewer and date. A missing answer stays open; a reassuring sales statement is not evidence of a control.
What to take away
- A missing answer stays open and a reassuring sales statement is not evidence of a control.
- Do not equate UK storage with a settled transfer analysis; remote access can also matter.
- Keep the safeguarding decision separate from parental permission and supplier capability.
- Approve only the documented use, not the supplier in the abstract.
- Use proportionate evidence rather than demanding paperwork that does not address the actual family-content risk.
Identity and service boundary
- Match the legal entity, trading name, address and company number across the quotation, terms and invoice.
- Describe the exact service, plan, users, inputs, outputs and excluded uses.
- Identify who owns configuration, support and renewal inside the publisher.
The free Companies House register can assist with UK entity checks, but its guidance warns that the record is not a complete account of a company's legal position.
Information and privacy chain
- List every category of personal information the service may receive.
- Decide whether the supplier is a controller, processor or occupies another role for each activity.
- Name subprocessors and support locations, including remote access.
- Record retention, deletion, backup and account-closure arrangements.
- Escalate any unresolved international transfer.
The ICO's processor-contract guidance covers instructions, confidentiality, security, subprocessors, rights assistance, audits and end-of-contract terms. The page is under review following the Data (Use and Access) Act 2025 and does not replace contract advice.
Do not equate UK storage with a settled transfer analysis. The ICO's January 2026 restricted-transfer test examines the applicable processing, the receiving organisation and whether it is a separate legal entity; remote access can also matter.
Security and operational access
- Require individual accounts and minimum necessary permissions.
- Check multi-factor authentication, administrator recovery and access logs.
- Ask how supplier staff gain privileged access and how it is revoked.
- Agree incident reporting contacts, content and timing.
- Identify backup frequency, restoration evidence and the customer's duties.
The NCSC's supplier assurance questions include privileged access, cloud services, breach notification and shared responsibilities. Use proportionate evidence, such as dated independent assurance where appropriate, rather than demanding paperwork that does not address the actual family-content risk.
Child and family safeguards
- State whether real children may appear in uploaded material.
- Prohibit live child data during demonstrations and trials.
- Limit downloads, public links and artificial-intelligence reuse.
- Record the route for removing a child's material from active storage and backups.
- Keep the safeguarding decision separate from parental permission and supplier capability.
NSPCC Learning's July 2026 organisational guidance on photographing and filming children raises purpose, consent, storage and image-misuse questions. It is useful practice guidance, not a legal clearance for a particular production.
Accessibility and delivery proof
- Test the working interface with the people assigned to use it.
- Inspect a real export type using fictional or cleared material.
- Check captions, reading order, colour, keyboard use and assistive-technology compatibility where relevant.
- Define acceptance, correction time and support escalation in writing.
GOV.UK's accessibility introduction applies to government services, not automatically to every publisher, but it explains why automated checks alone are insufficient.
Exit before signature
- Specify usable export formats, assistance, charges and timescales.
- Decide how the team will verify deletion and revoke integrations.
- Preserve an emergency route for publishing and audience contact.
- Name events that permit suspension or termination.
Approve only the documented use, not the supplier in the abstract. Keep the checklist on editorial hold until qualified reviewers close privacy, contractual, accessibility and safeguarding issues.
Before you act
- Match legal entity, trading name, address and company number across documents.
- List every category of personal information the service may receive.
- Require individual accounts and minimum necessary permissions.
- Prohibit live child data during demonstrations and trials.
- Test the working interface with the people assigned to use it.
- Specify usable export formats, assistance, charges and timescales.
Common questions
What should I do if a supplier gives a reassuring sales statement instead of evidence?
Record the answer, supporting document, reviewer and date. A missing answer stays open; a reassuring sales statement is not evidence of a control. Keep the checklist on editorial hold until qualified reviewers close privacy, contractual, accessibility and safeguarding issues.
Does storing data in the UK automatically settle the international transfer analysis?
No. Do not equate UK storage with a settled transfer analysis. The ICO's January 2026 restricted-transfer test examines the applicable processing, the receiving organisation and whether it is a separate legal entity; remote access can also matter. Escalate any unresolved international transfer.
How should child safeguarding decisions be handled in relation to parental permission?
Keep the safeguarding decision separate from parental permission and supplier capability. State whether real children may appear in uploaded material. Prohibit live child data during demonstrations and trials. Record the route for removing a child's material from active storage and backups.
