Operations
Part of Running a customer data journey with people, not systems, making the decisions
An observable customer data platform workflow, from versioned request to rollback
Follow an observable CDP workflow for one England data journey, with owners, identity exceptions, suppression checks, rollback evidence and restart authority.
Run one customer data journey as a sequence of observable states. The example here is an England membership organisation moving authorised account records through an identity decision, correction and suppression controls, then into an approved audience export. Production data and activation remain off until each owner accepts the evidence.
What to take away
- Treat the customer data journey as a sequence of observable states, not a single build task.
- Production data and activation stay off until every named owner accepts the recorded evidence.
- Identity decisions must show identifiers, rule version, ambiguity state, decision and reviewer.
- A correction creates a new state and a marketing objection updates suppression before audience generation.
- Only all required gate passes permit controlled release, with rollback authority resting on the journey owner.
1. Open a versioned request
The journey owner records the business decision, affected population, source, destination. It records purpose, requested date, stop authority. Attach the current data map and schema, and name the controller decision-maker and factual data owner separately from the supplier.
Versioned request intake
- Business decision and affected population
- Source and destination recorded
- Purpose and requested date
- Stop authority named
- Data map and schema attached
- Controller and data owner named
ICO's controllers and processors guidance says roles depend on real activities, but qualified counsel must decide the position for the actual arrangement.
Reject an intake that says only "create a single customer view". It needs one bounded output and an accountable user of that output.
2. Admit the source
The data steward checks collection authority, provenance, received time, field meaning, retention status and permission to use the record for this journey. Mark each value as observed, supplied, derived or inferred. Quarantine fields whose origin or meaning is missing.
Create fictional fixtures for an evidenced duplicate, two similar people who must stay separate, a stale inference and a contested fact. The ICO's accuracy principle guidance supports recording source and status and considering accuracy challenges. It is under review after the Data (Use and Access) Act, so the reviewer must recheck it before release.
3. Make identity decisions visible
Store the identifiers compared, rule or model version, ambiguity state, decision and reviewer. An uncertain candidate enters an exception queue instead of being forced into a match. The queue owner can approve, reject or ask for evidence; they cannot silently change the rule.
A correction creates a new state with the request, authentication route, affected fields and downstream copies. A marketing objection creates or updates suppression before any audience generation. The ICO says there is an absolute right to stop personal data being used for direct marketing in its right to object guidance. The fact-specific scope still needs privacy and PECR review.
4. Build and inspect the export
Generate the audience from the accepted version only. Record eligible population, query, exclusions, timezone and count reconciliation without treating the count as evidence of lawfulness. The destination owner checks field names, suppressed states, rejected rows and purpose restrictions in a non-production destination.
If tags, pixels or other device storage or access technologies contributed data, stop for a separate review against the ICO's final storage and access technologies guidance, updated 29 April 2026. A platform flag cannot settle that question.
5. Decide, run and watch
Privacy, identity quality, security, accessibility, contract and exit gates each return PASS, FAIL or UNRESOLVED. Only all required passes permit a controlled release. Operations records the version, approvers, destination and monitoring owner.
Watch unmatched events, ambiguous joins, delayed corrections, suppression propagation and destination rejection. Route exceptions to their named owner. The NCSC's SaaS security guidance supports explicit attention to service identities, audit information, incidents and recovery, but it does not certify a service.
Rollback and restart
The operations owner can halt exports and revoke the service identity. The data steward reconciles affected records; the destination owner confirms containment. Restore the last accepted package in isolation and compare identities, correction states and suppression. Restart authority belongs to the journey owner only after every failed gate is retested and the evidence record identifies the new version.
Before you act
- Record the business decision, affected population, source, destination and purpose.
- Mark each value as observed, supplied, derived or inferred.
- Quarantine fields whose origin or meaning is missing.
- Route uncertain identity candidates to an exception queue.
- Generate the audience from the accepted version only.
- Halt exports and revoke the service identity on rollback.
Common questions
What must an intake request contain before it is accepted?
The journey owner records the business decision, affected population, source, destination, purpose, requested date and stop authority. The current data map and schema are attached, and the controller decision-maker and factual data owner are named separately from the supplier. An intake saying only create a single customer view is rejected.
How should an uncertain identity match be handled?
The identifiers compared, rule or model version, ambiguity state, decision and reviewer are stored. An uncertain candidate enters an exception queue instead of being forced into a match. The queue owner can approve, reject or ask for evidence, but cannot silently change the rule.
What happens after a gate fails and rollback is triggered?
The operations owner halts exports and revokes the service identity. The data steward reconciles affected records and the destination owner confirms containment. The last accepted package is restored in isolation and identities, correction states and suppression are compared. Restart authority belongs to the journey owner only after every failed gate is retested.
