Customer Data Platform RFP Template: 50 Requirements, Scoring and Evidence

A customer data platform (CDP) RFP template should give you requirements a vendor must answer with evidence, a scoring scale fixed before the first demo, and a proof-of-concept gate. This one has 50 requirements in twelve groups, each with the evidence to request and a scoring anchor, plus weights for regulated buyers. The editable CSV is ungated: no form, no email.

Who this is for: procurement leads, architects, CISOs and DPOs, especially in banking, healthcare, gaming and government. Take cdp-rfp-template.csv from the RFP template tool, delete what does not apply and send it. More in the guides hub.

How to run a customer data platform RFP

Scope first. Write down five to eight use cases, peak events per second, profiles in three years, retention, destinations, regulators and deployment constraints (residency, key custody, who may operate). Requirements without volumes cannot be tested. Run the 3-year total cost of ownership model on the same inputs.

Scoring. Score each requirement 0–5: 0 absent, 1 roadmap only, 2 partial or services-dependent, 3 meets with limits, 4 meets natively and demonstrated, 5 meets natively, demonstrated and independently evidenced. Two people score independently, then reconcile. Group score = sum of (weight × score) ÷ sum of (weight × 5); total = sum of (group weight × group score). Score price last from your cost model, for example lowest three-year cost ÷ each bidder's cost, at about 15% of the total.

Proof-of-concept gate. Run the top two vendors through a four-to-six-week proof of concept on synthetic data, with pass or fail on the gate items; the method is in how to run a CDP proof of concept. Gate items are the 16 requirements with weight 5 (#6, #8, #10, #11, #12, #20, #23, #28, #29, #31, #32, #33, #36, #37, #48, #50). Any gate item scoring below 3 disqualifies a vendor unless fixed in writing.

Weighting advice for regulated buyers

• Group weights sum to 100 and appear in the headings below. Consent, security, deployment and residency, and audit evidence hold 48% together.
• Treat weight 5 as pass or fail, then rank on the rest.
• Prefer evidence in this order: live demo on synthetic data, independent report, documentation, attestation, roadmap.
• Adjust to use: if you will not use AI features, zero that group but keep #23 as a gate. If you score customers for credit or insurance pricing, EU high-risk obligations apply from 2 December 2027 4, so raise explainability.
• Unregulated buyers can move about 15 points from security, residency and audit to activation and operations.

The 50 requirements

Weights use a 1–5 scale; defaults are 3–5. The CSV adds why each requirement matters and 0-to-5 scoring anchors. Standards referenced: JSON Schema 5, SCIM (RFC 7644) 6, OpenTelemetry 7, Global Privacy Control 8, FIPS 140-3 9 and the Model Context Protocol 10.

1. Data ingestion and contracts (8%)

2. Identity resolution (8%)

3. Consent and privacy (10%)

4. Segmentation and decisioning (6%)

5. Activation and destinations (7%)

6. AI and explainability (5%)

7. Security and access (14%)

8. Deployment model and data residency (12%)

9. Audit and compliance evidence (12%)

10. Performance and scale (7%)

11. Operations and support (6%)

12. Commercial terms and exit (5%)

Red flags

How this compares with vendor-gated templates

---