Reviews
Part of How to review customer data platform routes in England: five routes, six gates and a fixture test
Customer data platforms selection checklist: entity and edition
Customer data platforms selection starts with the supplier: confirm the legal entity and exact UK edition, log dated evidence and set triggers that reopen it.
Contracting entity : The legal company that would sign the agreement for the service under review.
UK edition : The specifically named service edition offered to the buyer in the UK.
Evidence ID : A reference that identifies the record supporting one checklist line.
Status : PASS, FAIL or UNRESOLVED, without an overall score that can offset a failure.
Expiry : The point at which a record must be checked again, set according to that evidence.
Recheck trigger : An observable event that prompts review of a line or part of the dossier.
Fixture : A predeclared fictional test case used to observe a named edition and configuration.
Terms that govern a candidate
Keep the selection gate binary at its required checks, not as an averaged score: each line must be PASS, FAIL or UNRESOLVED, supported by an evidence ID, owner, date, expiry and recheck trigger. Privacy and PECR, identity accuracy, rights, security, accessibility, contract and exit failures cannot be balanced away.
- Record the legal entity and its company identifier.
- Name the exact UK-available service and edition.
- Match first-party product, terms and support records to that edition.
- Version the England buyer journey, destination and decision.
- Record separately whether the scope includes CRM, warehouse or lake, identity resolution, preference management, device access, analytics, activation, clean room or managed integration.
Candidate identity and scope
- Legal entity and company identifier
- Exact UK-available service and edition
- First-party product, terms, support match edition
- England buyer journey versioned
- Functions kept separateCRM, warehouse, identity
Until all five identity and scope lines pass, product evidence does not count. A demonstration, security page or price quote is not enough if it relates to another entity or edition. Check that the records under review describe the same service and contracting company the buyer would actually choose.
Trace the offer to the company
Use the contracting entity to connect the legal company with the exact UK edition being considered. A company identifier establishes which entity the register describes, but the supplier's own current records must also connect that entity to the offered service, its terms and its support arrangements.
Use the Companies House company information register for narrow details about the contracting party. GOV.UK says the service provides some information free, including a registered address, incorporation date, and current and resigned officers. Record what the register shows and the date you checked it.
Registration is not product evidence. A company number does not establish that the registered entity sells the edition under review. Match first-party product pages, terms and support records against both the contracting entity and the edition, rather than treating a company listing as proof of the service offer.
If a first-party record names another entity or leaves the edition unclear, mark the line UNRESOLVED and ask the supplier in writing. The contract terms should identify the same legal entity and service recorded against the register line before the buyer treats the connection as settled.
Keep each finding traceable
Use the same six fields for every dossier line: checklist item, evidence ID, owner, evidence date, expiry and recheck trigger.
The blank rows below show the record shape, not a finding about a particular supplier or edition. Set the expiry from the evidence, and name the person responsible for checking it.
| Checklist item | Evidence ID | Owner | Evidence date | Expiry | Recheck trigger |
|---|---|---|---|---|---|
| Legal entity and company identifier | [evidence ID] | [owner] | [date] | [set from the evidence] | Change of registered name, address or officers |
| Exact UK-available edition | [evidence ID] | [owner] | [date] | [set from the evidence] | Revised product terms or edition name |
GOV.UK says free email alerts can tell you when a company updates its details, including a director or address change. Treat an alert as an observable event for the company-record line. Record the event and review the relevant evidence rather than assuming that an alert itself confirms the product edition.
Reopen evidence when its basis changes
Set expiry according to the evidence, not a generic annual cycle. Records gathered at different times do not age at the same rate, and dated UK evidence is easier to assess when the expiry records why a further check is needed.
A change to the entity, edition, subprocessor, identity model, buyer purpose, destination, charging unit or security state can invalidate the affected part of the dossier. Return that part to UNRESOLVED, record the superseded evidence ID and name the person authorised to reopen the gate.
Do not make an executive deadline the recheck trigger. Use an observable event instead, such as receiving a revised contract, completing an accessibility retest or successfully restoring an isolated copy under the named version. That event gives the owner a specific reason to revisit the relevant evidence.
A changed subprocessor or processing location also reopens international transfer questions. The ICO international transfers guide was last updated on 15 January 2026, so record that date beside any transfer line. It provides a framework for transfers of personal data under UK GDPR and the Data Protection Act 2018, not a conclusion about a candidate.
Exercise the named edition
Use a predeclared fixture to test the edition and configuration named in the dossier. The test record should identify the edition, configuration, tester and date, so observed behaviour is not mistaken for evidence about a different setup or an unnamed version.
- The predeclared edition fixture covers ambiguity, duplicates, stale and contested data, correction, objection, suppression, deletion, refused tracking, access removal, logging, accessibility, export and restore.
- Actual observations identify the edition, configuration, tester and date.
- Every FAIL or UNRESOLVED line has an owner and recheck trigger.
- The verdict states its scope, limitations and expiry.
A suitable verdict names the UK edition and tested configuration, limits the finding to the predeclared fixture, and states an expiry set from the evidence date. Confirm that the edition in the verdict matches the edition recorded in the identity checks; otherwise, the test does not support that selection line.
Keep production data and live activation off until every required gate has independent PASS evidence. The remaining checks are the non-compensating quality gates, which must also be clear before the buyer treats the decision as ready to proceed.
Apply the result within its limits
- Give each line an evidence ID, owner, evidence date, expiry and observable recheck trigger.
- Confirm the contracting entity and the exact UK service edition.
- Match first-party product, terms and support records to that edition.
- Set an alert or another observable trigger for company-record changes.
- State the verdict scope, limitations and expiry.
A registration confirms an entity exists in the register; it does not prove that the entity sells the edition under consideration.
Supplier records must connect the two. If the records do not match, keep the line unresolved and request written clarification rather than treating the company listing as a product claim.
A change to the entity, edition, subprocessor, identity model, buyer purpose, destination, charging unit or security state calls for a review of the affected evidence. Retain its former evidence ID and assign a person to reopen the gate. Keep the verdict limited to the configuration and fixture actually tested.
