Customer success software due diligence checks for English buyers

What to take away

The Data (Use and Access) Act 2025 amends the UK GDPR framework, so controller and processor duties still apply to the customer success platform you buy.
Demand four written pointslawful basis, retention period, sub-processor list and export format.
Named platforms fall into three categories, and each carries a different due diligence question.
A £400 a month subscription is not the full cost. Migration, integration and admin time add to it.
Judge adoption per team and per week, with a 90-day review written into the contract.

Three levers: data law, GDPR roles, market demand

Nothing in the Data (Use and Access) Act 2025 replaces the UK GDPR. The Act amends the existing framework, and its provisions come into force by commencement regulations. Check commencement status on legislation.gov.uk before you rely on one section.

The Act covers automated decision-making, research purposes and purpose limitation. Each reaches account health scoring and any model trained on your customer records. Read the Data (Use and Access) Act 2025 before you accept a vendor's default terms.

Three 2027 buying levers

Data (Use and Access) Act 2025check lawful basis
UK GDPR rolesask who is controller
ICO guidancerecord each role
DBT trade dataweaker demand, more room

Controller and processor roles are unchanged in principle. The ICO's guidance for controllers and processors explains how each role is recorded, so ask which party is controller for every data flow you create.

Individuals keep rights over their own scoring data. The ICO's individual rights guidance covers access and objection, which matters when a customer disputes a health score.

Market conditions are the third lever. If B2B demand stays weak through 2026 and 2027, buyers gain room on price and terms. The customer success software trends and outlook maps how these forces interact at market level.

Named platforms and what each category asks of you

Named platforms and categories

Examples

Dedicated customer success platforms: Gainsight, Totango, ChurnZero, Planhat, Vitally
CRM-embedded retention modules: HubSpot, Salesforce
Onboarding and adoption tools: Pendo, Intercom

What to check before signing

Dedicated customer success platforms: Score logic, model training terms, export format
CRM-embedded retention modules: Data mapping between CRM records and score inputs
Onboarding and adoption tools: Event data retention, consent for in-product messaging

Choose by situation

Choose

Automated scoring: Documents roles
UK-wide customers: UK residency options
Small CS team: Phased plan
Consolidating tools: Documented exit
Budget under review: Start one workflow

Avoid

Automated scoring: Terms as annex
UK-wide customers: Cannot say where
Small CS team: Dedicated admin day one
Consolidating tools: No export route
Budget under review: Unmodelled uplift

None of these names is a recommendation, and terms change between releases. Use the table to pick your due diligence question, then test it against the clause list below.

Contract clauses to demand, with example wording

Illustrative wording you can adapt, not legal advice.

Contract clauses to demand

Retention"Personal data relating to customer accounts is deleted or returned within 30 days of termination, with written confirmation of deletion."
Sub-processors"The vendor publishes a current sub-processor list and gives at least 30 days notice before adding one, with a right to object."
Export"A complete export of account, contact and health data in CSV or JSON is delivered within five business days of a written request."
Roles"The parties record which of them is controller for each data flow, including any AI feature that processes customer records."
Evidence"The vendor provides annual security testing evidence and names a contact for data protection queries."

Example: what £400 a month actually buys

Illustrative figures for a five-seat subscription on a mid-market customer success platform:

What £400 a month buys

Subscription: about £400 a month.
Migration and onboarding: usually quoted as a one-off project fee.
Integration: internal developer days to connect CRM, billing and the platform.
Admin: roughly half a day a week to maintain scores, segments and playbooks.
Training and cover: time for two CS managers, plus replacement cover.

Ask whether the quote excludes implementation. The customer retention software pricing guide lists the line items UK buyers should expect in a written quote.

Health scoring and adoption checks

Ask for the score definition in writing, including weights, data sources and refresh frequency.
Confirm who can override a score, and whether overrides are logged with a reason.
Check the route a customer uses to query or object to their score.
Agree a 90-day adoption review, and name the person who signs off scope changes.

Weekly logins by CS managers are the adoption test, not seat counts. If the platform is opened only for board reporting, the retention case is weak. Set the review date before signature, not after.

Ask the vendor to demonstrate the score on a sample account during any pilot, using your own data rather than theirs.

Retention risks and adoption drift

The main risk is a mismatch between what a vendor assumes about your data and what your governance allows. It usually surfaces at renewal, when usage is reviewed and the original terms are re-read. Buyers who map their data flows early avoid that argument.

Adoption drift is the second risk. A platform bought for retention but used only for reporting weakens the case quietly. Set a 60-day and a 90-day checkpoint to compare logins against the plan. Working through customer success software risk scenarios helps you catch both before renewal.

Common questions

Does the Data (Use and Access) Act 2025 replace the UK GDPR for customer success platforms?

No. It amends the existing framework, so controller and processor duties still apply. Check both when you review vendor terms.

Should an English buyer insist on UK data residency?

Not automatically, but know where data is held and why. If your customer contracts require UK hosting, state it as a requirement rather than a preference.

Which clause do buyers most often forget?

The export clause. Without a stated format and deadline, leaving a platform can turn into months of manual work.

When should a 2027 buying decision be revisited?

At 90 days, at renewal, and whenever the data rules or your customer base change.