The customer data platform costs a headline fee tends to leave out

A headline licence or subscription for a customer data platform rarely covers the buyer's own work or later commitments. This list identifies eight cost categories to investigate for one England customer-data journey.

What to take away

Admission method and boundaries

Research date: Official records were checked on 6 September 2026.

Geography: an organisation operating in England, using UK-wide official guidance where stated.

Scope: cash and economic-cost categories attached to authorised collection, identity work, profile handling, analytics, activation and exit.

Inclusions: a category entered only where an official source establishes the underlying task or decision boundary.

Exclusions: provider prices, market averages, staffing assumptions, prevalence, savings and costs unrelated to the defined journey.

Ranking: non-ranked. Order does not imply size or likelihood.

Conflicts: no supplier funded the review or provided access, data or a quotation.

Money fields: the figures below are labelled typical ranges as of 2026.

1. Data mapping and design work

A buyer must map sources, identifiers and purposes. It must also map profile fields, inferences, recipients and retention before estimating implementation. The ICO's updated data protection by design and default guidance treats privacy as lifecycle work.

Mapping workshops and record updates typically cost £4,000 to £15,000 as of 2026. The range depends on source count, identifier types, inference rules and retention periods. Specialist data protection or data engineering day rates typically run £500 to £1,200.

2. Identity correction and rights operations

Ambiguous joins, stale attributes, objections, suppression and deletion create review and propagation tasks. ICO individual-rights guidance separates rectification, erasure, restriction, portability and objection. It is under review after the Data (Use and Access) Act, so publication-day rechecking is another explicit task.

Routine rights requests typically cost £25 to £80 each. Complex cases with identity, suppression or propagation work typically cost £250 to £1,000. Annual identity correction and suppression reviews often run £5,000 to £20,000 for a mid-market buyer. Volumes depend on customer base, objection rate and channel count.

3. Contract and subprocessor review

The service description may not settle instructions, security and rights assistance. It may also leave subprocessors, audits and end-of-contract handling open. ICO processor-contract guidance covers those subjects and is also under review.

Legal and commercial effort typically costs £3,000 to £12,000 for a first CDP contract review. External counsel often charges £250 to £600 an hour. The range turns on subprocessor count, international transfers, audit rights and termination assistance.

4. Security monitoring and recovery

Access configuration, service identities, protected logs, incident response and restore exercises require buyer resources. NCSC guidance on secure SaaS use describes these operating controls without supplying a staffing level or service cost.

First-year buyer resources typically cost £8,000 to £30,000. Managed monitoring often runs £1,500 to £6,000 a month. The range depends on user count, log volume, recovery time objective and recovery point objective.

5. Supplier evidence gaps

Answers about cloud dependencies, privileged access and incident handling may need follow-up evidence or controlled tests. The NCSC's supplier assurance questions help frame enquiries, but they do not certify a supplier.

Follow-up evidence or controlled tests typically cost £2,000 to £10,000 per supplier. A penetration test of a CDP integration often quotes £4,000 to £15,000.

6. Accessibility tests and alternatives

Administrative screens, correction routes and exports need testing as configured. For applicable public bodies, GOV.UK accessibility requirements guidance discusses WCAG 2.2 AA and outsourced-service responsibility. Other buyers still need their own scope review.

An accessibility audit for those screens typically costs £3,000 to £10,000. Remediation can add £5,000 to £25,000 depending on component count and legacy code.

7. VAT cash timing and advice

A quoted amount may include, exclude or omit VAT information, while recovery depends on the buyer's circumstances and records. HMRC's page on reclaiming VAT on business expenses sets official boundaries.

The review recorded the 20% standard VAT rate and HMRC late payment interest at the Bank of England base rate plus 2.5 percentage points as the rates current on 6 September 2026. If the headline fee is quoted net, the gross cash exposure is 20% higher, subject to recovery. Recheck the rates with HMRC before relying on them.

8. Evaluation and decision evidence

Operational dashboards cannot establish causal benefit. In its current Magenta Book, HM Treasury treats process, impact and value-for-money evaluation as different questions. It is government guidance, not a private-sector costing rule, but it exposes analysis and counterfactual work that should not be assumed free.

Evaluation design and review typically costs £5,000 to £25,000 for a single CDP decision. Independent impact evaluation can run £20,000 to £80,000. The range depends on counterfactual method, data access and review cycles.

Put the gaps into the budget

For every applicable item, record currency, VAT basis, unit, quantity and period. Add owner, evidence, uncertainty and a stop trigger. Add renewal, export, isolated restore, transition and deletion as separate buyer lines.

A hidden category becomes manageable when it has a source and owner.

Before you act

Common questions

Why might a buyer need to recheck individual-rights guidance on publication day?

The ICO individual-rights guidance is under review after the Data (Use and Access) Act. Publication-day rechecking is another explicit task.