Operations
Part of Running a customer data journey with people, not systems, making the decisions
Why this customer data platform launch review ends in a hold
Read an honest CDP launch-review record for England that discloses missing evidence, unperformed testing, reviewer gaps and the resulting HOLD verdict.
What to take away
- The review ends in a hold, because no supplier legal entity, edition number, named reviewer or configured journey was supplied.
- The evidence base is public guidance only, so no performance, price or fitness claim about any platform can be made.
- Seven gates decide the outcome, and each needs a named owner plus a dated artefact.
- A future pass would apply to one configuration, one journey and one review date.
What was in scope, and what was not
The review subject was a proposed England membership journey. It would take an authorised account source, make an identity decision, preserve corrections and marketing suppression, then export an approved audience. The review date was 6 September 2026.
Method was a desk comparison of the buyer's evidence dossier against current UK guidance. A dossier is a folder the buyer builds: one section per control, each entry naming the document, its date and the person who signed it.
Nothing was accessed. The review did not open a platform interface, supplier account, API or contract, and no subprocessor list, production dataset, destination or restore environment was examined. No hand interaction happened either, including match, correction, objection, suppression, deletion, rollback or restore.
Conflicts: no supplier paid for inclusion, supplied access or offered an affiliate arrangement. Named UK privacy, PECR, security, accessibility, governance and commercial reviewers still need to sign off.
Why seven gates, and not another framework
These seven follow the order in which launches stall. Privacy and PECR decide whether a journey may run. Identity and rights decide whether it stays lawful. Security, accessibility and contract exit decide whether it survives production and termination.
Missing release evidence
- Purposes, sources, roles and retention undocumented
- No tag, pixel or storage configuration identified
- No identity schema, rule or ambiguity treatment
- Correction, suppression and deletion states unproved
- No access, log, incident or recovery evidence
- No accessibility task, tester or defect record
- No legal parties, subprocessors or exit terms
Why seven gates
| Gate | Question it answers | Artefact that closes it |
|---|---|---|
| Lawful basis and transparency | Why is each source processed, and what were individuals told? | Purpose and lawful basis per source, with notice text and date |
| PECR and storage access | Which tags, pixels or local storage touch a device? | Device inventory with the consent or exemption route |
| Identity and accuracy | How are records matched, merged and corrected? | Versioned match-rule record with an ambiguity threshold |
| Individual rights | How are correction, objection, suppression and deletion executed? | State model per right, with destination confirmation |
| Security and supplier assurance | Who can reach the data, and how is recovery proved? | Access inventory plus a dated restore test |
| Accessibility | Can an administrator complete the tasks unaided? | Task list, assistive method and defect record |
| Contract and exit | Who is accountable, and what happens on termination? | Signed order, role split, subprocessors and export terms |
The providers list is this site's shortlist register. It stays empty until a supplier clears every gate, and its published entry format shows what a cleared record would contain.
Example: a gate artefact that would pass
An identity gate artefact is short. Rule MR-014, version 3, signed 2 September 2026, matches on a normalised email plus a hashed account number. It merges only above a threshold of 0.92 and queues everything else for a human.
MR-014 v3, 2 September 2026. Sources: account and newsletter systems. Match key: normalised email plus hashed account number. Threshold: 0.92. Merge outcome: one golden record with source flags. No-merge outcome: two records, exception queue, 14-day review. Owner: identity lead.
A supplier assurance return is equally plain. Each row carries the question reference, the supplier answer, the evidence document, the buyer's verification method and the date checked. A blank verification column is an unresolved gate, not a pass.
Evidence examined
The review examined public guidance only. The ICO's data protection by design and default page was updated on 5 February 2026 and sets lifecycle expectations. It does not show that a named journey meets them.
On identity, the ICO's accuracy guidance supports recording source and status and correcting inaccurate information. No proposed match rule existed to compare against it.
The NCSC's supplier assurance questions cover governance, access, incidents, recovery and cloud dependency. No supplier response or buyer verification was supplied. These questions do not certify a service.
Marketing uses face a further test. The advertising checklist lists the audience checks that must pass before a campaign runs.
Before you act
- Name the supplier legal entity, the edition and the review date.
- Build the dossier by control, with document names and dates.
- Fill each gate row with an owner, a status and an artefact.
- Map the journey version and the identity rule it depends on.
- Test authorised fixtures for ambiguity, correction, objection, suppression and deletion.
Common questions
Is this customer data platform launch approved?
No. The verdict stands at hold, and the reason is the missing record described above rather than any finding about a product.
What evidence was examined?
Public guidance only: the ICO pages on data protection by design and accuracy, and the NCSC supplier assurance questions. No interface, contract, dataset or test environment was opened.
What would change the verdict?
A named supplier, edition and journey date, plus a completed dossier and a dated artefact for each of the seven gates. Each gate would then record pass, fail or unresolved.
Does the hold imply anything about a supplier?
No. No supplier was named, so no inference about any provider follows from the gaps. The hold describes the evidence, not a market.
