Operations
Part of Running a customer data journey with people, not systems, making the decisions
The non-compensating quality checks to clear before a customer data journey runs
Use a non-compensating CDP quality checklist for identity, rights, security, accessibility, contracts, recovery and exit before an England journey runs.
Use PASS, FAIL or UNRESOLVED for every line. Do not calculate a weighted score. A deadline, lower price or executive preference cannot offset a failed privacy, identity, rights, security, accessibility, contract or exit gate.
The checklist assumes one controlled membership journey: an authorised account source, a documented identity decision, correction and suppression states, and an approved audience export. The governing rules are the UK GDPR and the Data Protection Act 2018, with the Privacy and Electronic Communications Regulations (PECR) covering direct marketing and the ICO as supervisory authority. It does not assess a named supplier or provide legal advice.
What to take away
The journey runs only when every privacy, identity, rights, security, accessibility, contract and exit gate passes. A FAIL or UNRESOLVED item keeps the affected journey on HOLD until the defect is recorded and retested.
Scope and authority
- The request names the decision, journey owner, controller decision-maker, factual data owner and destination owner.
- The current data map distinguishes CRM, warehouse or lake, identity resolution, preferences, tags or device access, analytics, activation, clean-room and managed-integration functions.
- Every source has collection authority, provenance, schema version, field definitions and retention status.
- Observed, supplied, derived and inferred values are labelled rather than blended.
- The reviewer has recorded England applicability and any wider UK processing or destination.
- A lawful basis is named for each purpose under UK GDPR Article 6, and a condition under Article 9 where special-category data is involved.
- Where consent is relied on, it meets the UK GDPR Article 7 standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
- A data protection impact assessment is recorded before any high-risk processing under UK GDPR Article 35.
- Records of processing are kept under UK GDPR Article 30.
- The controller is registered with the ICO and any applicable data protection fee is paid.
On 5 February 2026, the ICO updated its guidance about data protection by design and default.
Scope and authority checks
- Name decision, journey, controller, data and destination owners
- Map CRM, warehouse, identity, preferences, tags, analytics, activation
- Record collection authority, provenance, schema version, retention
- Label observed, supplied, derived and inferred values
- Record England applicability and wider UK processing
Identity, corrections and objections
- The identity rule identifies inputs, version, ambiguity treatment and human decision authority.
- Similar people remain separate in the fictional fixture unless evidence supports a join.
- Duplicate, stale and conflicting attributes enter an owned exception queue.
- A correction can be traced through permitted copies and destinations.
- Direct-marketing suppression propagates before the next export and cannot be overwritten by a later import.
- Direct-marketing consent and objections follow PECR and the ICO's direct-marketing rules, so an objection is honoured before the next contact.
- A deletion instruction identifies copies, backups, processors, evidence retained and unresolved duties.
- A subject access, rectification, erasure, restriction or objection request is answered within one month, and any refusal cites the UK GDPR exemption relied on.
The ICO's individual rights resources cover changing, deleting, restricting and stopping uses of personal information.
Access, security and incidents
- Human accounts and service identities have separate owners and least-privilege records.
- Privileged changes and exports produce usable, protected logs.
- Access removal is tested with a fictional account.
- Incident routes name containment, evidence preservation, privacy assessment and recovery owners.
- A personal data breach that meets the threshold is notified to the ICO within 72 hours of awareness, and every breach is recorded whether or not it is reported.
- The supplier's dependencies, recovery claims and notification route have supporting evidence.
- Supplier security claims are tested against a named framework such as ISO/IEC 27001 or SOC 2.
The NCSC's supplier assurance questions cover governance, access, cloud dependencies, incidents, recovery and independent assurance.
Accessibility and operational use
- A keyboard and assistive-technology test scope covers identity exceptions, correction, suppression, export review and incident evidence.
- Errors are exposed in text and do not depend only on colour.
- Exported evidence is readable without reconstructing the interface.
- Conformance is judged against the WCAG 2.2 AA success criteria through keyboard-only and screen-reader testing, not automated checks alone.
- Defects have an owner, severity basis and retest record.
GOV.UK's public-sector accessibility guidance describes WCAG 2.2 AA and continued responsibility where work is outsourced. Public-sector websites and apps in scope must also publish an accessibility statement under the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018.
Contract, continuity and exit
- The dossier identifies the legal supplier, exact edition, data roles, subprocessors and transfer route.
- Change, support, incident, audit, retention and deletion terms match the required operation.
- Processor terms meet UK GDPR Article 28, and any restricted transfer names an adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
- The buyer has tested a controlled export and isolated restore, including suppression and provenance.
- Rollback authority, credential revocation and destination containment are documented.
- Exit evidence covers data return, deletion confirmation, logs and continuity of rights handling.
Any FAIL or UNRESOLVED item keeps the affected journey on HOLD. Record the defect, evidence needed, owner and retest trigger rather than substituting an overall score.
Worked example: a direct-marketing suppression gate fails because a later import overwrites an objection. The retest trigger is a corrected suppression rule, a fresh import test and a check of the next export.
The same test applies to the other gates. A rights gate fails when an erasure request is actioned in the CRM but not in the warehouse copy and the one-month deadline passes. The retest trigger is a traced deletion across every copy, a recorded response to the requester and a re-run of the exception report.
Sources and limits
- The ICO's controller-processor contracts guidance is marked under review following the Data (Use and Access) Act. Recheck it on publication day and obtain legal advice on the actual agreement.
- The gate criteria are drawn from the UK GDPR, the Data Protection Act 2018 and PECR, alongside the ICO, NCSC and GOV.UK guidance named above; confirm current versions and any transitional arrangements on publication day.
- The ICO design guidance supports lifecycle controls, but only the actual facts can establish what measures are appropriate.
- Detailed application and exceptions for individual rights need current qualified review.
- NCSC answers still need evidence; the question set is not a certification.
- GOV.UK accessibility guidance has statutory scope for public-sector websites and apps; other buyers need a separate equality and accessibility review.
Common questions
What happens if a checklist item fails or stays unresolved?
The defect, the evidence needed, the owner and the retest trigger are recorded. A deadline, lower price or executive preference cannot offset a failed gate, and no overall score replaces the gate result.
Does the checklist assess a named supplier or give legal advice?
No. The article states it does not assess a named supplier or provide legal advice, and detailed application needs current qualified review.
Which guidance does the article cite, and what limits does it note?
It cites ICO guidance on data protection by design, individual rights and controller-processor contracts, plus NCSC supplier assurance questions and GOV.UK accessibility guidance. The Sources and limits note records the review status and evidence limits.
