Review Contractor Samples Before Sharing Live Data

A contractor asks for your full lead list to demonstrate research quality. That is more access than an initial skills assessment usually needs. A carefully designed synthetic sample can test identity judgment, source interpretation, uncertainty, and handoff quality before any live contact information is shared.

Keep the sample decision separate from contracting, data-use review, and system access. Passing a small exercise does not authorize broad data transfer or prove that the contractor's tools and handling arrangements are appropriate.

Define the skill you need to observe

Choose a bounded deliverable, such as an evidence-linked company-location note. Avoid an unpaid open-ended project disguised as a sample. Agree the sample scope, compensation if applicable, deadline, permitted methods, and what the result will be used to decide.

Provide labelled synthetic source extracts rather than real contact records. Use invented names and nonfunctional example identifiers. If realism requires actual company-level public sources, assess permitted use and avoid adding unnecessary personal data.

Do not ask the contractor to scrape profiles, bypass access restrictions, guess private contact details, or use shared credentials. A willingness to do those things is not a desirable capability.

A fictional five-case sample pack

An invented buyer evaluating a research contractor supplies these cases:

• C1: one clear company and an operating location directly supported by the supplied source.

• C2: two similarly named companies with different identifiers; the correct output keeps them separate.

• C3: a planned facility whose opening is not confirmed.

• C4: conflicting current responsibility statements that require an unresolved result.

• C5: a record containing a stated handling restriction that must survive the handoff.

The contractor is asked to return the answer, supporting source reference, limitation, and next internal action for each. The pack contains no live personal contact information and no authorization to message anyone.

The reviewer assesses each case against the expected behavior, not against a preferred writing style. C2 merged into one confident account is a blocking defect even if the document looks polished. C4 left unresolved with a precise verification question can be a successful result.

Review the process behind the output

Ask which tools were used, what information was entered into them, and whether any material was retained or shared beyond the agreed scope. The purpose is to verify the sample workflow, not to demand private credentials or proprietary secrets.

Check whether the contractor can explain the evidence boundary. If they claim to have verified a fictional company on the live web, investigate the claim rather than treating extra detail as initiative. Synthetic material should remain clearly identified as synthetic throughout the exercise.

Give focused feedback and, if appropriate, a new small case that tests the corrected behavior. Repeating the original failed case may show memorization. Preserve the limitation that a short sample does not establish production-scale accuracy or compliance.

Make access a separate, staged decision

The NIST CSRC Glossary: Least privilege defines least privilege as limiting access to what assigned tasks require. For a contractor, that means the smallest approved dataset and capabilities needed for the next agreed stage, not automatic access to the entire CRM after a good sample.

Before any live transfer, have the responsible owners review the recipient, purpose, fields, tools, storage, onward sharing, retention, and end-of-work handling. Applicable contractual and privacy requirements need their own qualified review. This article does not determine that a particular transfer is lawful.

A limited next stage might use a controlled view of a small assigned account set, with no bulk export and no independent sending. Whether your systems support that arrangement must be checked; do not promise a control based only on a product's marketing label.

Document a decision with limits

The fictional evaluation may conclude: evidence interpretation acceptable on the five synthetic cases; identity escalation needs another exercise; no live-data access approved yet. That is more useful than a broad vendor verified badge.

If the sample fails on restrictions or identity, pause the proposed live-data step and explain the specific gap. If it passes, continue the separate due-diligence and access process rather than treating success as permission to skip it.

A good sample review protects both sides. The contractor knows what competent work means, and the buyer can evaluate the relevant judgment without using a production contact list as a test file.

Continue with Plan a First Sales Hire's Research Training or Create a Useful Sales Research Service-Level Agreement.