Scope the service
Separate export, cleaning, annotation, privacy review, legal advice and sales representation. Ask what the vendor can demonstrate and what remains your responsibility.
Review access and handling
Minimise access to production systems. Agree permitted processing, subprocessors, security, retention and deletion, and use a reviewed sample when possible.
Set acceptance criteria
Measure quality against a defined test set and document exceptions. A processing certificate is not a guarantee that all rights or privacy issues are resolved.
Use this as a preparation framework. It is not legal advice, a valuation or a promise that a buyer will accept your data.