Reviews
Part of How to review customer data platform routes in England: five routes, six gates and a fixture test
Why our review of customer data platform agencies admits no names yet
An honest England CDP agency-review record with an empty admitted set, explicit desk-only limits and evidence requirements for identity, access, delivery and exit.
Verdict: HOLD. This review of customer data platform agencies admits no names yet. The admitted agency set is empty because no exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. This is not a negative review of any agency.
Subject: Agencies that might implement or operate one England membership data journey with controlled source records, identity decisions, corrections, suppression and an approved audience export.
Review date: 6 September 2026.
Reviewer: No named human reviewer or qualification was provided.
Method: Desk review of an empty candidate file against current official UK evidence requirements.
Conflicts and funding: None declared. No supplier access, payment, affiliate link or sample.
Hands-on boundary: No agency engagement, interview, reference call, platform account, configuration, data transfer, export or restore was observed.
What to take away
- No agency is admitted because no legal entity, dossier, client-authorised evidence or hands-on work was supplied.
- Named candidates include Merkle, Accenture Song, Thoughtworks, Slalom, Deloitte Digital, BJSS and Made Tech. None is admitted.
- No performance conclusion, score, ranking or recommendation is published for any named agency.
- A broad claim to provide CDP implementation is not a testable scope for review.
- Public case studies and review sites are supplier claims unless independently verified.
- Contract labels alone cannot establish who is controller and who is processor.
- Any later finding expires when the entity, subcontractor, location, tool edition, access model or scope changes.
Named agencies and the empty admitted set
Several real agencies could be considered for CDP implementation work in England. None is admitted to this review because no dossier, permissioned evidence or hands-on observation was supplied. The names below are candidates and exclusions, not findings or rankings.
| Agency | Public facts a buyer can check | Why it is not admitted |
|---|---|---|
| Merkle | Part of Dentsu, with a UK presence in London. Publicly lists customer experience, data and CRM services. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| Accenture Song | Part of Accenture, with UK offices including London. Publicly lists customer experience, marketing and commerce services. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| Thoughtworks | Technology consultancy headquartered in Chicago, with UK offices including London. Publicly lists data engineering and customer data work. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| Slalom | Consulting firm with a London office. Publicly lists data and analytics services. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| Deloitte Digital | Part of Deloitte UK. Offices across England, including London, Manchester, Birmingham and Leeds. Publicly lists customer and marketing transformation. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| BJSS | Leeds-headquartered technology consultancy. Publicly lists data, cloud and software engineering. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
| Made Tech | London-headquartered digital consultancy. Works with UK public sector organisations. | No exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. |
The table names candidates, not admitted agencies. A dossier must still identify the platform edition. Examples include Salesforce Data Cloud, Adobe Experience Platform, Tealium, Segment and BlueConic. Other examples are Optimizely Data Platform, mParticle, Amperity and Treasure Data.
Public-fact review finding: Merkle, Accenture Song, Thoughtworks, Slalom, Deloitte Digital, BJSS and Made Tech each show at least one UK office or UK service listing. Public-fact review finding: none supplied the minimum dossier. Provisional result for each named candidate: HOLD.
What an agency dossier must identify
The file needs the contracting legal entity and the exact service. It needs England availability, delivery locations and named tools. It also needs staff and subcontractor access, the support boundary, the commercial unit and exit obligations. The GOV.UK company-information service can provide certain register facts. Those facts do not prove service ownership, competence, solvency or delivery quality.
Minimum admissible dossier: 1 exact legal entity, 1 named platform edition, 1 England delivery location, 1 permissioned reference, 1 fixture result and 1 named reviewer.
Typical planning range where no public figure exists: 1 to 3 weeks to assemble a complete dossier; 1 to 2 days to run the common fixture once access is ready.
Scope must separate these services
Separate service
- CRM
- Named scope
- Warehouse or lake
- Named scope
- Identity resolution
- Named scope
- Preference management
- Named scope
- Tags or device access
- Named scope
- Analytics and activation
- Named scope
Not testable
- CRM
- Broad CDP claim
- Warehouse or lake
- Broad CDP claim
- Identity resolution
- Broad CDP claim
- Preference management
- Broad CDP claim
- Tags or device access
- Broad CDP claim
- Analytics and activation
- Broad CDP claim
The service scope must separate CRM, warehouse or lake, identity resolution and preference management. It must also separate tags or device access, analytics and activation. Clean-room work and managed integration are separate again. A broad claim to provide 'CDP implementation' is not a testable scope.
Evidence needed from an authorised project
Permissioned records should show the buyer's data journey, source authority and schema. They should show the identity rule and its uncertainty, correction and suppression states, and the destination. They should also show acceptance evidence, changes, incidents, rollback and exit. References need client permission and a declared selection method. A public case study is a supplier claim unless independently verified.
If a review site or testimonial is used, record how it was collected and moderated. The CMA's guidance for businesses and agencies warns against fake and misleading consumer reviews. It does not validate enterprise delivery claims or authorise disclosure of client information.
A reference should identify the service period, edition, buyer-authorised evidence and person permitted to speak. Ask about corrections, unresolved identity exceptions, privilege removal, incident handling and export rather than request a general satisfaction score. If confidentiality prevents inspection of the underlying record, disclose that limit instead of treating the account as verified performance.
Access and data-role questions
Map who decides the purposes and essential means, who follows instructions and who may use subprocessors. The ICO's detailed controller and processor guidance is under review following DUAA. Contract labels alone are not enough.
Ask which people and service identities can reach production records, how privileges are removed, what logs the buyer receives and how incidents are handled. The NCSC's supplier assurance questions supply an official UK question set for governance, access, recovery and dependencies. Agency answers still need evidence.
Common fixture and independent gates
An admitted agency should run the buyer's predeclared fictional fixture through its proposed service. The fixture should separate similar identities and join an evidenced duplicate. It should handle stale and contested fields.
It should propagate correction, objection, suppression and deletion. It should respect refused tracking and revoke privileged access. It should expose a log event and support accessible admin tasks. It should export and restore in isolation.
Privacy and PECR, identity accuracy, security, accessibility, contract and exit remain independent gates. The test proves only the observed configuration and date. It cannot prove staff competence in every project or guarantee outcomes.
Evidence required to reopen the review
Appoint a named reviewer. Supply exact agency and service records, first-party terms and permissioned references. Add data-role analysis, security and accessibility evidence. Add common-fixture results, support records and exit proof. Until then, no service-performance conclusion, score, ranking or recommendation can be published.
Any later finding expires when the agency entity, subcontractor, delivery location, tool edition, access model or contracted scope changes. Retain excluded dossiers with their reasons, so an absent name is never misrepresented as a failed engagement.
Before you act
- Supply the contracting legal entity and exact service.
- Separate CRM, warehouse, identity resolution and activation in scope.
- Obtain client permission and a declared selection method for references.
- Map who decides purposes and who follows instructions.
- Run the buyer's predeclared fictional fixture through the proposed service.
- Appoint a named reviewer before reopening the review.
Common questions
Why does the review admit no agency names?
The admitted agency set is empty because no exact legal entity, service dossier, client-authorised evidence or hands-on work was supplied. The review states this is not a negative review of any agency. No service-performance conclusion, score, ranking or recommendation can be published until evidence is supplied.
Named candidates such as Merkle, Accenture Song, Thoughtworks, Slalom and Deloitte Digital appear as exclusions from the admitted set. They are not admitted findings or rankings.
What must an agency dossier identify?
It needs the contracting legal entity and the exact service. It also needs England availability and delivery locations. It needs named tools and staff and subcontractor access. It needs the support boundary, commercial unit and exit obligations. Company register facts do not prove service ownership, competence, solvency or delivery quality.
What does the common fixture test prove?
It proves only the observed configuration and date. It cannot prove staff competence in every project or guarantee outcomes. Privacy and PECR, identity accuracy, security, accessibility, contract and exit remain independent gates that still need evidence.
