Customer data platforms commercial contracts: eight areas

Method: issue selection from current official data, cyber, company and IP records. Scope: This review of customer data platforms commercial contracts covers proposed CDP contracts for organisations operating in England, with cited data-protection guidance applying across the UK. Inclusions: terms that affect the defined data journey and exit.

Exclusions, ranking and conflicts: no supplier rankings, standard wording, prices or sector-specific terms; non-ranked; no supplier supplied funding, documents or access. These eight areas are questions for qualified counsel, not model clauses or conclusions about enforceability.

What to take away

Before you act

1. Party, service and edition

Name the contracting legal entities, exact service, edition, geography and included functions. The GOV.UK Companies House information service identifies public register details such as registered address and filing history. Those facts do not prove capability, authority to contract or service quality. Example: require the order form to state the legal entity name, company number, registered office and signatory authority.

2. Data roles and instructions

Describe purposes, decisions and processing by activity instead of declaring every supplier a processor. Where the facts establish controller-to-processor processing, use the ICO's contracts and liabilities guidance to review instructions, confidentiality, security, subprocessors, assistance, audit, return and deletion. Example: require the processing schedule to list each activity, purpose, data category, retention period and subprocessor.

3. Access, transfers and security

List hosting, remote support, subprocessors, onward access, incident assistance and audit evidence. The ICO's international transfers guidance frames restricted-transfer questions. NCSC supplier assurance questions add practical prompts on incidents, data return and termination without certifying a supplier. Example: list hosting region, support locations, subprocessor names and audit report dates in a schedule.

4. Data, IP and model rights

Allocate rights in source data, mappings, configuration, identity rules, profiles, inferences, model inputs and outputs. State any proposed reuse or training expressly. IPO guidance on sui generis database rights explains that database rights and copyright can protect different aspects. Example: list source data, mapping, configuration, identity rule, profile, inference, model input and output in an IP schedule.

5. Service, change and commercial terms

Define deliverables, acceptance evidence, support, change notice, suspension, continuity, liability and remedies. Record currency, VAT treatment, billing unit, period, term, limits, renewal and overage only from the applicable contract. Leave values blank when unavailable. A service level is not a security or accessibility finding.

Example: attach a blank rate card for billing unit, VAT treatment, term, renewal date and overage rate.

6. Export, deletion and termination

Specify export formats, provenance, configuration, logs, suppression records, assistance, timing, charges, deletion evidence and post-termination access. Test a synthetic restore before dependence grows. Stop if the buyer cannot recover the meaning needed to operate, audit or honour correction and suppression. Example: define an export fixture as CSV, JSON and Parquet files with a data dictionary, checksum and row counts.

7. Accessibility and operating evidence

Define the critical configuration, review, correction and export tasks that authorised users must complete. Require evidence for the contracted edition and buyer configuration, not a generic accessibility statement. The Equality Act 2010 is primary legislation with Great Britain scope, including England. Example: apply a profile correction and confirm the export shows the corrected value.

Record which party fixes an inaccessible workflow, supplies an alternative and preserves data meaning in exports. Service credits or other remedies need legal and commercial review and do not prove the task is usable.

8. Change, continuity and acceptance

State how the supplier may change functions, models, subprocessors, terms or support and what notice and buyer response apply. Define acceptance through versioned authorised fixtures, including false joins, correction, suppression and recovery. The NCSC's guidance on using SaaS securely supports examining customer configuration responsibilities. It does not supply a contractual standard or uptime promise.

Example: a restore-test acceptance fixture could require a known record set, a deliberate false join, a correction and a deletion, with expected row counts. Name operational ownership during suspension, insolvency, migration and termination. The buyer should know which records and skills preserve continuity if supplier assistance ends.

Give privacy, security, accessibility, IP, commercial, finance, tax and procurement reviewers separate authority. One favourable term cannot cancel a failed gate elsewhere. Reopen review when the legal entity, edition, data journey, subprocessor, price basis or exit process changes.

Common questions

What should counsel verify about the contracting party?

See section 1 for party, service and edition checks.

How should data roles be described in a CDP contract?

See section 2 for data roles and instructions.

What should be agreed for export, deletion and termination?

See section 6 for export, deletion and termination terms.