How to choose an SEO agency in South Africa: audit-first

Answer first: the one-sentence decision rule
Choose the vendor that (a) scores 12/15 or higher on a five‑dimension procurement rubric (audit quality, Search Console ownership, POPIA‑aware measurement, contracts & exit terms, red‑flag transparency), (b) supplies dated Search Console evidence for the issues they cite, and (c) signs or accepts your DPA/POPIA clauses for analytics before any measurement work begins. This is a practical acceptance test — treat the 12/15 threshold as a recommended procurement filter, not law.

Why audit‑first matters (and what a good audit looks like)

An audit shows what must be fixed, how long it will take, and whether the agency understands your platform and compliance constraints. Local buyer guides emphasise audits, named teams and transparent reporting as baseline procurement checks, so insist on an evidence‑led audit rather than generic advice (Algorithm Agency — buyer guide).

A useful audit must include:

• A dated crawl and index report stating the tool and run date.
• A prioritised backlog (High / Medium / Low) with estimated hours or ticket sizes.
• Dated evidence (Search Console exports, crawl screenshots) that reproduce the agency’s claims.
• A week‑by‑week 90‑day remediation plan with owners and estimates.

Quick acceptance test to demand in writing: within 14 days of engagement the agency must hand over (a) a crawl/index PDF, (b) the top 10 technical issues with severity, and (c) a week‑by‑week 90‑day delivery plan mapped to named owners.

Search Console & account ownership: procurement must‑haves

Google Search Console is the single most reliable source of technical evidence. Make these non‑negotiables part of your RFP and kickoffs.

• The client must be a verified owner of the Search Console property; agencies get delegated access only. Google documents owner vs user roles — verified ownership preserves continuity if suppliers change (Google Search Console — owners and permissions).
• Ask for a dated screenshot of the Users & permissions view showing the client as a verified owner and the agency’s access level.
• Contract clause: the agency will not retain verification tokens and will remove any agency‑owned verification method on exit; they must assist transfer or removal within a specified window.

Always request dated Search Console screenshots (Users & permissions, Coverage report) during the pitch. If the agency can’t produce dated proof, treat their audit claims as unsupported.

Short remediation steps if you discover the agency is the only verified owner:

1. Capture the current Users & permissions view (dated screenshot).
2. Add your org email as a verified owner immediately; then remove agency tokens.
3. If verification relies on DNS under agency control, require written transfer instructions and proof of completion before work continues.

POPIA‑aware measurement: what to require in a proposal

POPIA treats online identifiers and analytics as potential personal information. Your procurement must check contractual and technical controls.

• Written processing arrangements: POPIA requires clear written processing agreements describing purpose, retention and recipients. Require the agency to sign or accept your DPA before analytics work begins (Information Regulator — POPIA guidance).
• Consent gating and cookie controls must be documented in the proposal. The agency should state which scripts will not fire before opt‑in and which interactions are essential. Practical mitigations (Consent Mode v2 and server‑side tagging) are trade‑offs that must be explained in writing (GrowthPulse — cookie consent & analytics trade‑offs).
• Admin settings checklist to require in the audit: current retention windows, data‑sharing settings, Google Signals/ad features status, and a recommended low‑exposure configuration.
• Ask the agency to produce a short “measurement impact” note that explains what attribution loss to expect from consent declines and how modelling or server adjustments will be used.

Do not accept “we’ll sort POPIA later.” If the agency treats POPIA as “install a cookie banner” only, mark that as a low score on the measurement dimension.

Contracts, deliverables and exit terms you should insist on

Put these minimum clauses into every SOW:

• Initial term: 3 months with month‑to‑month thereafter and a 30–90 day termination notice.
• Ownership: client owns content, strategy documents, Search Console and analytics accounts; agency gets delegated access only.
• DPA & breach notification: agency must accept your DPA or sign theirs and must notify you within the POPIA timeframe on any breach.
• Scope clarity: list deliverables and monthly volumes (for example: "4 long‑form articles; 8 technical tickets; 12 hours CRO work").
• Exit assistance: agency must provide a handover checklist and remove third‑party verification tokens within seven business days of termination.

Avoid performance guarantees tied to metrics the agency can’t control (rankings, organic revenue without agreed attribution). Require approvals on any third‑party tools that will store or process your data.

Red flags & rapid vetting checks

Immediate deal‑breakers: guaranteed rankings, refusal to provide dated Search Console evidence, unwillingness to sign DPA terms, or insistence on sole account ownership. If any appear, stop the process.

Rapid vetting checklist to run in a pitch:

• Names and roles: who will work on your account and what percent of their time?
• Dated Search Console screenshot and a sample anonymised month‑3 report.
• Scope specificity: counts, formats, timelines or vague promises?
• Link‑building methods: secretive or “fast links” promises = high risk.

Red flags to walk away from include guaranteed rankings, sole ownership of tooling, opaque link sources, secretive teams, and unusually low retainers that don’t match local cost realities. Local buyer guides reiterate these signals as common procurement traps (Algorithm Agency — buyer guide).

90‑day plan + scoring table (the bidder acceptance test)

Use this 0–3 rubric across five dimensions. Score 12+ is a recommended shortlist threshold (a practical procurement filter you can test).

Recommended 90‑day delivery plan (paste into RFP)

• Week 1: Kickoff, verified access granted, dated exports from Search Console & analytics, crawl run, top‑10 technical issues list.
• Weeks 2–4: Fix top 5 technical high‑severity issues (canonical, indexation, sitemap, robots, redirect loops).
• Weeks 5–8: Content fixes, metadata rollout, CRO tests, form & event tracking.
• Weeks 9–12: Post‑fix QA, reporting handover, measurement stabilisation, and roadmap for next 90 days.

Treat each weekly deliverable as a ticket or sprint item with an owner and estimate. This template is the exact thing to ask for in an initial scope.

Next steps you can run right now

1. Score the vendor immediately on the five‑dimension rubric and disqualify any below 12 (treat 12/15 as a recommended threshold).
2. Request dated Search Console screenshots (Users & permissions, Coverage) and a signed commitment to accept your DPA before any analytics work.
3. If they pass, convert their audit into the 90‑day plan above and require weekly sprint commits and an agreed handover checklist.

If you want a partner who can accept your DPA, implement Consent Mode/server‑side tagging, and convert an audit into an accountable delivery plan, see Luminum’s implementation pages for measurement and connected systems (Luminum solutions and implementation) and our lead capture solutions for accountable reporting (Luminum lead capture system).