Rules and ethics
Part of Why customer success software rules and ethics shape UK buying decisions
Before you buy customer success software, check UK GDPR and BSI standards
A pre-purchase guide to UK GDPR duties and BSI data standards for customer success software, with a scoring rubric, contract terms and common questions.
What to take away
- Most teams treat UK compliance as a post-purchase task and only check data protection duties after signing. That is the wrong order.
- Standards published by BSI give you a common vocabulary for data and privacy controls when comparing vendors.
- A scoring rubric completed before demos forces legal questions into the same room as commercial ones.
- This article is general guidance, not legal advice. Individual cases need a qualified adviser.
Why the buying order matters
In England and across the UK, the UK GDPR applies to any customer success software processing personal data about your customers. The ICO's accountability and governance guidance, including the Accountability Framework and the Guide to the UK GDPR, sets out the expectation that organisations can show how they comply.
That affects procurement. A vendor chosen before the data map may have a retention schedule, sub-processor list or deletion process that cannot meet your obligations. Check the Article 30 record of processing activities, the DPIA screening decision and the transfer risk assessment as part of selection. Reversing the order is cheaper than renegotiating after implementation.
The rules that shape the purchase
Several duties sit behind a typical retention deployment. You need a lawful basis for processing customer records, a clear picture of where data is stored and who can access it, and a retention period matching your stated policy rather than the vendor's default.
Marketing automation in the same stack adds a layer. A B2B marketing automation platform may combine sales and service data, which changes the scope of your processing. If your CS tool feeds that platform, the data map must cover both.
Subject access and erasure requests also depend on the platform. A tool that cannot locate every copy of a customer record will slow each request. That is an operational risk as much as a legal one.
Where standards help
Standards give buyers a reference point when vendor answers are vague. BSI's data and privacy standards guidance describes frameworks covering governance, risk and controls for customer-data-driven systems. The common references are BS 10012 for personal information management and ISO/IEC 27701 for privacy information management.
You do not need certification to ask better questions. Ask whether the vendor maps its controls to BS 10012 or ISO/IEC 27701 and how it evidences that mapping. A yes or no answer beats a slide about security culture.
For a wider view of how these duties interact with retention targets, the UK rules and compliance guide walks through the full lifecycle from selection to renewal.
A pre-purchase scoring rubric
Score each vendor from 1 to 5 before you shortlist, where 1 means no evidence and 5 means documented evidence you have seen. A total below 20 out of 30 should trigger more questions, not automatic rejection.
Pre-purchase scoring rubric
- Lawful basisrecorded and reviewed
- Data mappingsub-processors and storage
- Retentionconfigurable to your policy
- Subject rightsaccess, correction, erasure
- Standardsmapped to recognised standard
- Evidencedocumentation for accountability record
| Area | What to check | Score (1-5) |
|---|---|---|
| Lawful basis | Vendor can describe how your basis is recorded and reviewed | |
| Data mapping | Full list of sub-processors and storage locations | |
| Retention | Configurable retention and deletion that matches your policy | |
| Subject rights | Process for access, correction and erasure requests | |
| Standards | Controls mapped to BS 10012 or ISO/IEC 27701, with evidence | |
| Evidence | Documentation you can attach to your own accountability record |
Score honestly. A vendor strong on features but weak on evidence will cost you time when a request arrives. The data protection article explains how to turn those scores into contract clauses and internal controls.
Contract terms to settle early
Your agreement should name the processing purposes, the retention period and the deletion method. It should also state how you will be told about a breach and within what timeframe.
Under UK GDPR, the controller must notify the ICO within 72 hours of becoming aware of a personal data breach where it is likely to result in a risk to rights and freedoms.
Where a vendor uses sub-processors, you need the right to object to changes. Without it, a new hosting region can alter your compliance position without your involvement.
If the vendor hosts or supports the tool outside the UK, check that transfers rely on the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
Common questions
Does UK GDPR apply to customer success software?
Yes, if the software processes personal data about identifiable customers, including contact details, usage records and support history. The same rules apply whether the tool is hosted in the UK or abroad.
Do I need a data protection impact assessment?
Not always, but a DPIA is expected where processing is likely to result in high risk to individuals. Large-scale profiling, combining datasets, or processing special category data can cross that threshold. The ICO's list of high-risk processing also covers innovative technology and systematic monitoring.
Can a vendor's certification replace my own obligations?
No. A vendor's certificate covers its own management system, not your processing decisions. Check the scope and date before you rely on it.
What should I check before signing?
Confirm the lawful basis, sub-processor list, retention and deletion settings, and breach notification terms. Check the 72-hour breach notification clause and any international transfer safeguards.
