How to review customer data platform delivery routes

A membership export becomes the test case

For a customer data platforms product review, an England membership team has one authorised account source and needs controlled identity decisions, correction and suppression before an approved audience export. It compares delivery mechanics, not brands, across one bounded membership journey: a manual Microsoft Excel and incumbent CRM baseline, hosted products, buyer-built work and managed integration.

The team did not intend to name a winning route. It wanted to establish whether each option could handle the same membership journey within a fixed scope, with buyer work and dependencies visible. It therefore fixed the job and review fixture before treating wider product capability as relevant.

The test boundary comes before route descriptions

First, the reviewer fixed the required functions and output, then asked whether every route could do identical work. An identity service could not fairly be compared with an export-only spreadsheet unless the scope was narrowed or the additional buyer work was counted.

CRM, warehouse or lake, identity resolution and preference management remained separate columns. Device technology, analytics, activation and clean-room functions stayed outside the boundary. The reviewer considered the five delivery routes for this journey and credited no capability beyond the agreed scope and its test.

The team then fixed one fictional fixture for every admitted route: similar identities that should remain separate, an evidenced duplicate, stale and contested fields, correction, objection, suppression, deletion and refused tracking. It also checked revoked access, log retrieval, accessible administration, export and isolated restore.

The fixture made the comparison repeatable, but did not imply that any route had passed. Each result could speak only to the exact configuration tested on the review date, not another edition or setup. The shared records served as evidence for comparison, not as replacements for independent legal, security or operational review.

The dossier keeps product mechanics apart from proof

Each option received a dossier covering functions, legal entity, source authority, identifiers, join logic and uncertainty. It also recorded corrections, objections, suppression, deletion, UK data rules, subprocessors, international transfers, security, accessibility, support and change.

Missing evidence stayed visible instead of being treated as a pass; the supplier dossier kept those records distinct from product descriptions.

Product notes described mechanics only. Twilio owns Twilio Segment, priced on monthly tracked users and better suited to event-stream collection than batch profile management. Salesforce Data Cloud runs on Salesforce Hyperforce and is sold in credits. Adobe Real-Time CDP sits within Adobe Experience Platform and runs on AWS and Azure.

Tealium AudienceStream is a real-time audience CDP based in San Diego and sold on quote. Treasure Data, owned by SoftBank, offers a free trial and quote-based enterprise pricing. mParticle, in New York, focuses on mobile app data and has a free tier. None of those descriptions came from the shared fixture results.

Controller or processor status follows the processing activities actually carried out, not a label. ICO guidance warns that its material may change because of the Data (Use and Access) Act 2025. A qualified legal reviewer must assess the actual processing and revisit the guidance before clearance, rather than relying on an earlier interpretation.

The register records conditions, not results

After the common review, dossier IDs had not been entered and accepted. The register kept buyer work, external dependencies and evidence state distinct, so each candidate remained on HOLD; product descriptions could not act as test results or as a reason to rank options.

The reviewer kept the legal check separate as well. ICO accuracy guidance supports attention to source, status and correction, while its data protection principles material carries a DUAA review notice. The qualified legal reviewer must revisit that material on clearance day, rather than relying on an earlier reading.

Independent gates remain independent

The team marked privacy and PECR, identity and rights, security, accessibility, contract and exit as separate gates, each with PASS, FAIL or UNRESOLVED status. No option could offset a failed gate with lower cost or easier operation, and buyer weights and thresholds stayed blank while evidence was outstanding.

National Cyber Security Centre SaaS guidance addresses service identities, audit information, incident response and recovery, but gives no verdict on a candidate. ICO contract guidance for relevant processor arrangements covers instructions, rights assistance, audit and end-of-contract handling. That material is under review after DUAA, so its status must be checked at clearance.

Commercial units remain unreconciled

Profiles, events, destinations, seats and storage remained different billing units; service hours were logged separately. For each exact route, the reviewer recorded currency, VAT presentation, billing period, term, included usage, overage, renewal and exit. The cost record had to match the scope of the delivery comparison.

Event-based CDPs such as Segment typically quote per monthly tracked user, while enterprise CDPs such as Adobe Real-Time CDP and Treasure Data are quote-only. Annual contracts typically start in the tens of thousands of pounds; currency and VAT presentation change the total. If a necessary commercial definition is missing, its cost stays unknown until finance reconciles the quotation with expected workload.

The case ends with every route on hold

The scenario ended without a named winner: all five routes remained on HOLD, and none had been tested for performance. Recorded mechanics were not findings. The register could accept evidence IDs after review, but did not support a ranking or a claim of suitability for the membership journey.

The manual route was a baseline, not a presumed loser. Existing systems might avoid another copy; buyer-built work might increase internal responsibility; hosted and managed routes brought different supply-chain dependencies. These remained descriptions of mechanics until exact dossiers and common results existed, not comparative findings.

The quality checks remained non-compensating. Operational responsibility sat with the people making decisions, not with a system label. If routes could not meet the same journey, units and fixture, the team would publish separate comparisons rather than force an overall result; operational roles remained part of the decision.

Rules carried forward from the review

The case leaves reusable controls, not a product verdict. Keep the journey, agreed scope and fixture fixed; do not let price offset a failed critical gate; and leave cost unknown when a necessary commercial definition is absent until finance can reconcile the quotation with expected workload.

A qualified legal reviewer must assess controller or processor status from actual processing and revisit ICO material when the comparison is cleared. Finance must reconcile quotations with expected workload. Operational roles stay part of the decision, and no route can be named the winner until reviewers accept the common evidence for the agreed scope.