Service standards for a customer data platform that the buyer, not the supplier, defines

Customer data platform service standards should describe a measurable event and a response, not a vague promise of good data. Each standard needs an eligible population, numerator and denominator or unit, clock, source, exclusions, owner and threshold. The buyer sets the threshold from its risks and evidence. All thresholds below remain blank.

This framework covers one fictional England membership journey with a controlled account source, identity decision, correction and suppression states, and an approved audience export. It reports no supplier performance.

What to take away

Use a complete measure card

Record these fields for every measure:

Use Europe/London for the operating clock and state how daylight-saving changes are handled. A supplier's uptime percentage or ticket label is not interchangeable with a buyer measure unless the event, population, clock and exclusions match.

Correction handling

Define the start as the authenticated request or credible internal finding entering the controlled queue. The stop is not merely a database update. It is the point when the factual owner accepts the correction and every in-scope destination confirms the permitted change or records an exception. Exclude requests awaiting information only if the pause reason and restart event are visible.

According to the ICO's page on the accuracy principle, an organisation should identify a record's source and status and consider challenges to accuracy. The page is currently marked under review following the Data (Use and Access) Act, so a qualified reviewer must confirm the current position.

Suppression integrity

The eligible population is all in-scope marketing objection or suppression events accepted during the period. The numerator is the number confirmed at every named destination before another relevant export; the denominator is all eligible events. Keep rejected, duplicate and unresolved destinations visible rather than removing them to improve the ratio.

The ICO's current right to object page describes an absolute right to stop use for direct marketing. Legal and PECR review must still classify the actual message and processing.

Identity exception control

Count proposed joins that the rule labels ambiguous, then count how many receive a recorded human decision with supporting evidence. Do not set a target that rewards fast merging. A safe service may leave an identity separate while evidence is missing. Track reversals and downstream corrections under the relevant rule version.

Export acceptance

Start the clock when an approved version creates an export package. Stop when the destination validates the schema, purpose tag and suppression handling and issues a receipt. Separate transport failure, rejected rows, missing fields and unauthorised destination use. The destination owner, not the source platform dashboard, accepts the state.

Security response and recovery

Measures can cover time to revoke a compromised service identity, completeness of protected audit records and successful isolated restore. Keep each event separate. The NCSC's using SaaS securely guidance asks buyers to consider identity, access, audit information, incident response and recovery. It supplies no universal threshold.

An isolated restore passes only if the specified package opens, provenance remains readable, identity states reconcile and corrections and suppression survive. A backup file that was never restored is not proof of recovery.

Accessibility and evidence review

Measure whether named administrative tasks can be completed with the agreed assistive methods, not whether a generic scanner reported no errors. GOV.UK's accessibility testing guidance is scoped to public-sector websites and apps, but its distinction between testing methods is useful operational context. Other organisations require their own equality and legal assessment.

At each review, retain the raw evidence, corrections, owner decision and reason for changing a definition or threshold. A definition change starts a new series. It should not be spliced into the old one as though the measure remained comparable.

Before you act

Common questions

What must a correction measure's stop point include?

The stop is not merely a database update. It is when the factual owner accepts the correction and every in-scope destination confirms the permitted change or records an exception. Requests awaiting information are excluded only if the pause reason and restart event are visible.

How should an export acceptance measure be timed?

The clock begins when an approved version makes an export package, and ends once the destination checks the schema, purpose tag and suppression handling and sends a receipt.

When does an isolated restore count as passing?

Only when the specified package opens, provenance stays readable, identity states reconcile, and corrections and suppression survive. An unrestored backup file proves nothing.