Tools and providers
Part of Assessing customer data platform tools and suppliers with dossiers, fixtures and exit gates
Customer data platform vendor due diligence as an evidence dossier, not a scorecard
Build a CDP supplier evidence dossier covering identity, data roles, security, accessibility, commercial scope and tested exit without using scores.
Due diligence should produce a dated dossier of evidence and unknowns, not a supplier score. Start with the exact legal entity, UK-available service and edition proposed for one England data journey. If the seller, contracting party, service schedule or operating entity is unclear, stop before assessing features.
Source review for this checklist closed on 6 September 2026. It supplies questions for privacy, security and legal reviewers, who own the privacy and PECR, security, and contract and exit gates respectively, and gives no procurement, legal, privacy or security approval.
What to take away
- Due diligence should produce a dated evidence dossier, not a supplier score.
- Record the exact legal entity, service edition and geography before assessing features.
- Treat supplier claims as unverified until supported by scope and evidence.
- Keep privacy, security, accessibility, contract and exit gates independent.
- Preserve the exact artefact reviewed because supplier pages and schedules change.
Identity and product record
- Record the contracting name, company number where applicable, trading name and responsible seller.
- Identify the service, edition, environment, geography, version and evidence date.
- Preserve the proposal, product record, service description and change history.
- Mark undocumented capability or availability as unknown.
The government route to Companies House information can confirm narrow register facts such as status and filings. It does not prove authority to contract, operational capacity, product quality or solvency.
Identity and product record
- Contracting name, company number, trading name
- Responsible seller identified
- Service, edition, environment, geography, version
- Evidence date recorded
- Proposal and change history preserved
- Undocumented capability marked unknown
Data and identity behaviour
- Map every source, collection event and claimed authority before ingestion.
- Specify identifiers, normalisation, join logic, confidence treatment and manual override.
- Separate verified fields, supplier-enriched values and buyer-created inferences.
- Trace correction, objection, suppression and deletion across destinations and copies.
- Document retention events, profile expiry and treatment of backups.
Ask what happens when records disagree. A credible answer includes provenance, the rejected alternative and an auditable correction route. A polished profile is not evidence that its fields are accurate. For example, a CDP such as Segment or Adobe Experience Platform may merge two records on a shared email with conflicting names.
A credible answer names the source of each name, the join rule that won, and the manual correction route.
Trace data and identity behaviour
- Map sources and collection events
- Specify identifiers and join logic
- Separate verified, enriched, inferred fields
- Trace correction, objection, deletion
- Document retention and backups
Roles, recipients and transfers
- Determine roles from actual decisions about purposes and means.
- List subprocessors, support access and processing locations for the chosen edition.
- Identify each intended disclosure or restricted transfer and its evidence.
- Record contract assistance for rights, incidents, audits and deletion.
The ICO's current international transfers guidance should be applied to real recipients and access patterns. A hosting-region label does not replace that work.
Security and recoverability
- Inspect authentication, privileged roles, service identities and access removal.
- Obtain the log schema, retention, export and tamper-protection account.
- Identify incident contacts, notification inputs and buyer containment controls.
- Test backup, export and isolated restore with fictional records.
NCSC supplier assurance questions cover networks, cloud dependencies, privileged access and incident response. Treat every response as a claim requiring scope and supporting evidence. A badge or audit summary does not describe the buyer's configuration.
Accessibility and operating fit
- Name critical tasks such as reviewing a match, excluding a record and exporting evidence.
- Request edition-specific accessibility documentation and known limitations.
- Plan testing with applicable assistive technologies and qualified participants.
- Provide an alternative route for any blocked task.
For relevant public-sector procurement, GOV.UK accessibility guidance discusses WCAG 2.2 AA and buyer responsibility for outsourced services. Other buyers should obtain scope-specific equality and accessibility advice rather than assuming the public-sector regime applies unchanged.
Commercial control and exit
- State currency, VAT status, charging unit, period, term, minimum, overage and renewal.
- Separate supplier charges from buyer integration, governance and operating work.
- Record support scope, service changes, acceptance, liability and termination process.
- Define export content, format, timing, cost, deletion evidence and transition help.
Finish with an evidence-gap register. Each row needs an owner, requested record, due date, expiry and release consequence. Scores hide hard failures, so keep privacy and PECR, rights and accuracy, security, accessibility, contract and exit gates independent. An unanswered mandatory question leaves the proposal on HOLD.
Example row:
| Owner | Requested record | Due date | Expiry | Release consequence |
|---|---|---|---|---|
| Privacy lead | DPIA and transfer impact assessment for the chosen edition | Before contract signature | 12 months after acceptance | HOLD until received |
Ask the evidence owner to preserve the exact artefact reviewed, not merely its web address. Supplier pages, subprocessor lists and service schedules can change. The dossier should therefore hold a dated copy, its source location, the reviewing role and the event that forces rechecking.
A later document must not silently replace the basis on which an earlier decision was made.
Common questions
What should happen if the seller or contracting party is unclear?
Stop before assessing features. If the entity is unclear, issue a written query to the seller's legal contact and set a HOLD that expires only when the signed contract names the same entity as the service schedule.
How should a buyer treat a supplier's audit badge or summary?
Treat it as a claim requiring scope and supporting evidence. Ask for the audit's scope, period, covered entities and the buyer's configuration exclusions in writing, then test one control against the buyer's own logs.
What must an evidence-gap register contain?
Use one row per open gate. Add the gate name, requested record, owner, due date, expiry, release consequence and last-checked date.
