Data vendor due diligence asks about the company behind a dataset: who it is, where its data comes from, how it checks its own suppliers and whether its answers hold up. The questions below come from enforcement orders, regulators' guidance and the voluntary questionnaires that FISD, a financial information industry association, publishes for data buyers through its Alternative Data Council [11]. Checks on the dataset itself, its datasheet, license and a measured sample, are in buying training data. This explainer is research, never legal advice.
In a 2014 study of nine data brokers, the FTC found that they "obtain most of their data from other data brokers rather than directly from an original source" [8]. In 2021 the SEC brought what it called its first enforcement action charging an alternative data provider with securities fraud, settled without admitting or denying the findings [1]. Its order describes representations made "in response to diligence questionnaires from trading firms" and finds them false and misleading [2].
Data vendor due diligence starts with who the vendor is
FISD's Data Vendor Tear Sheet asks whether the vendor is an originator, "the entity that has overall responsibility for a given data item", or an aggregator that pulls in data from other sources [15]. For an aggregator, every question about sources applies again to its suppliers.
Name the legal entity that signs. California's privacy agency advised in December 2025 that "Each data broker must register, including subsidiaries of parent companies", and that brokers must list all their websites and trade names [22]. The advisory is staff guidance [22]. Look up the signing entity in the state's registry along with its parent and trade names [21, 22].
Check the owners. The 2023 interagency guidance for banks lists ownership structure, "including identifying any beneficial ownership", and sanctions by the Office of Foreign Assets Control on the third party or its owners among its due diligence factors [28]. It is supervisory guidance without the force of law [28].
Ask for the track record. FISD's 2024 questionnaire asks whether, in the last five years, the company or, as far as it knows, its providers received a cease and desist order, were sued, received a subpoena or were investigated by a regulator or law enforcement [12]. FISD's identification factors add tenure, headquarters jurisdiction, officers and outside counsel, and state that "understanding the vendor and its compliance practices may be just as important as understanding the data itself" [16].
Ask who signed off. The questionnaire asks for at least two named reviewers of the answers, one from legal or compliance where such a department exists, and an effective date [12].
Where the data comes from and how the vendor checks its suppliers
The FTC's 2014 study found that most brokers chose sources by reputation. A few evaluated "the legitimacy, stability, and quality of their sources", and a few asked each source for its own sources [8]. Most of the brokers wrote into their source contracts that the source warrants it legally obtained the data [8]. Only two brokers required a warranty that people had notice and a chance to opt out, and contracts said little on accuracy beyond best efforts [8].
Ask for that chain in writing. FISD's questionnaire asks who provides the underlying information, what diligence the vendor performs on whether those providers "have the legal right to do so", and for redacted copies of its contracts with primary data providers [12]. For bought data it asks for the terms that show the vendor's right to resell or license the data and to sell products derived from it [12].
Some vendors run their supplier checks under an order. FTC orders against X-Mode Social and Outlogic in 2024 and against Gravy Analytics and Venntel in 2025 require a written supplier assessment program, an assessment within 30 days of a new data sharing agreement or first collection and annually after that, records of suppliers' responses, and an end to using data collected without consent [5, 7]. Each order ends 20 years after it was issued, or later if a violation is alleged in federal court [5, 7]. They bind only those respondents and show what a program looks like on paper.
The Gravy complaint shows a weak one. The FTC alleged that Gravy Analytics "continued to use data obtained from data suppliers that provided ambiguous or non-responsive information" to its questionnaires, and that Venntel relied on Gravy Analytics to confirm consent [7]. The respondents neither admitted nor denied the allegations [7]. Ask what the vendor does when a supplier's answer is vague.
Lineage ties the chain together. FISD describes data lineage as the source of a data set and "the transfers, reviews and transformations applied to the data before it arrives at the customer", and its example questions ask whether a vendor backfills data, interpolates missing values or removes outliers [20].
Personal data: ask for the evidence behind the promise
Where records describe people, a contract clause is the start. France's data protection authority, the CNIL, wrote in June 2024 that a re-user relying on consent obtained by a third party must be able to prove it, an obligation that "cannot be fulfilled by the mere presence of a contractual clause" [25]. It recommends an agreement stating the source, the context of collection, the legal basis and the information given to the people concerned [25].
California's privacy act, in the text its privacy agency posted in August 2024, requires a business that sells personal information to sign an agreement that limits the sale to "limited and specified purposes", and bars the buyer from reselling it unless the consumer received explicit notice and a chance to opt out [23]. Ask whether model training sits inside those purposes. Under the GDPR, a controller that obtained data from someone other than the person must tell the person "from which source the personal data originate" [24]. Ask how the vendor meets that duty.
How the vendor uses generative models
FISD's 2024 questionnaire added a question on whether the vendor uses generative tools "in the production of your Data", and an appendix about them [12, 13]. The appendix asks whether the vendor runs public or internal versions, what inputs go in, whether output is reviewed "for accuracy and/or bias" and whether the tool was trained on data licensed from a third party [12]. FISD's January 2025 considerations add the role the models played in producing the data, the vendor's testing and monitoring of accuracy, and its fine-tuning method [17].
Test the answers before you rely on them
A questionnaire answer is the vendor's claim. FISD asks vendors to answer after "a reasonable investigation" [12]. Its identification factors add the buyer's own review of litigation history and news, and a record of the diligence steps taken [16]. Ask for written policies with their dates. In the App Annie order, a policy agreed around late 2014 was not documented until April 2017 [2].
Keep a record of what was checked. In April 2022, SEC examination staff observed advisers "that could not demonstrate, such as by producing documentation" that their policies had been consistently implemented [3]. The alert states the views of SEC staff and has no legal force [3]. The 2023 banking guidance adds that experience with a third party "is not an adequate proxy" for due diligence, and that limits on what could be checked should be documented [28].
Test the sample against the claims. FISD's questionnaire asks for a sample of fewer than 100 rows, from more than three months ago [12]. A buyer can score it the way a pilot of document extraction accuracy scores a tool, on labeled records the buyer controls. Where records name companies, the tear sheet asks about entity mapping [15], and entity resolution across sources shows how matches are measured.
A vendor's methods can become the buyer's case to answer. Refused a license by Thomson Reuters, Ross Intelligence bought roughly 25,000 "Bulk Memos" from LegalEase to train its search tool [9]. In February 2025 a federal trial court found actual copying of 2,243 Westlaw headnotes and granted summary judgment for Thomson Reuters on fair use [9]. The Third Circuit affirmed on interlocutory appeal in September 2026 [34].
Delivery, changes and security
Ask what notice the vendor gives. FISD's 2021 service level recommendations ask vendors to inform subscribers at least 90 days before a major change, and count a change in upstream provider that triggers compliance review as one [19]. The questionnaire asks about third-party dependencies, such as an upstream license that expires [12]. On security, the banking guidance asks whether the scope and results of a vendor's SOC reports are relevant to the activity [28]. NIST's generative profile recommends contracts for generative AI systems that specify content ownership, usage rights, quality standards, security requirements and provenance [32].
After onboarding and at the end
The FTC orders repeat supplier assessments every year [5, 7]. NIST's Cybersecurity Framework 2.0 has supplier risks monitored "over the course of the relationship", with plans for what happens after an agreement ends [30]. Banking regulators' proposed guidance, published in September 2026 with comments due by 16 November 2026, ties the depth of diligence to the risk a relationship presents [29].
Rillor's data marketplace offers ready-made datasets to license for model training and research, each stating what it holds, where it comes from and how it stays current, with use, term and onward sharing set in a written data agreement before access starts.
Read the full report
The full report sets out each question group, ends its findings with a checklist table and lists all 34 sources.