Customer Data Glossary: 50 Terms Explained

Part of the Learn hub.

This glossary defines 50 terms that come up when regulated organisations buy, build or audit a customer data platform (CDP). Each entry opens with a one-sentence definition that can stand alone, explains the term with an example from banking, insurance, healthcare, gambling or government, links to related terms and longer articles, and answers two or three common questions.

Where a law defines a term, the entry follows the legal text and cites it: the GDPR, HIPAA, DORA or the EU AI Act. Where no law does, the entry says so. Prices and vendor claims come from public pages, so confirm them before you budget.

The glossary is neutral. It names competitors and open-source projects, and it says when software as a service is the right answer. It is general information, not legal advice.

New to the category? Start with what a customer data platform is, then browse the list below.

The 50 terms, A to Z

A

• Activation: Activation is when a customer data platform (CDP) delivers profiles, segments or events to the channels and tools, such as email, ads or CRM, that act on them.
• AI agent: An AI agent is software that uses an AI model to pursue a goal by planning steps, calling tools and acting on systems, often with limited human intervention.
• Air-gapped deployment: An air-gapped deployment runs on a network with no physical or automated logical connection to other networks, so data and updates move only by manual, controlled transfer.
• Audit ledger (immutable audit log): An audit ledger is an append-only, tamper-evident record of who did what to which data and when, kept so that actions can be reconstructed and proven later.

B

• Bring your own cloud (BYOC): Bring your own cloud (BYOC) is a deployment model in which vendor software runs inside the customer's own cloud account, often managed remotely by the vendor.
• Business associate agreement (BAA): A business associate agreement (BAA) is the contract HIPAA requires between a covered entity and a business associate that handles protected health information for it.

C

• Composable customer data platform (CDP): A composable customer data platform (CDP) builds CDP capabilities from separate components, usually a cloud data warehouse as the store plus tools for collection, identity, modelling and activation.
• Consent state: Consent state is the current, per-person and per-purpose record of what a customer has agreed to or refused, including when, how and under which wording.
• Consumption credits: Consumption credits are prepaid or committed units that a vendor deducts as you use metered features, so the cost depends on how many operations the platform performs.
• Critical or important function (DORA): Under DORA, a critical or important function is one whose disruption would materially impair a financial entity's financial performance, soundness or continuity of services, or continuing compliance with its authorisation.
• Customer 360: Customer 360 is a comprehensive view of a customer that joins profile data, transactions, interactions and preferences from every channel into one place for analysis and service.
• Customer data platform (CDP): A customer data platform (CDP) is software that builds and maintains a persistent, unified record of each customer and makes it available to other systems.
• Customer-managed keys (key custody): Customer-managed keys are encryption keys the customer creates, controls and can disable or delete, giving the customer, rather than the vendor, final say over who can decrypt its data.

D

• Data egress: Data egress is data leaving a system, network or cloud provider, and the term also names the fees cloud providers charge for moving data out.
• Data localisation: Data localisation is a legal requirement that certain data be stored or processed within the borders of a specific country or region.
• Data minimisation: Data minimisation is the GDPR principle that personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed.
• Data processing agreement (DPA): A data processing agreement (DPA) is the contract GDPR Article 28 requires between a controller and a processor, setting out how the processor handles personal data for the controller.
• Data residency: Data residency is the physical or geographic location where data is stored and processed, and by extension any rule requiring it to stay within a country or region.
• Data sovereignty: Data sovereignty is the principle that data is subject to the laws of a jurisdiction and that its owner, not a foreign provider or authority, controls access to it.
• Destination (connector): A destination (or connector) is a configured integration through which a platform sends data to an external tool, such as an email service, ad platform or CRM.
• Deterministic matching: Deterministic matching links records only when they share an exact, verified identifier, such as a customer ID, a login or a normalised email address.

E

• Event contract (event schema): An event contract is an agreed, versioned schema that defines an event's name, required fields, types and meaning, so producers and consumers can rely on it.
• Event stream: An event stream is an ordered, continuous flow of timestamped records, such as page views, transactions or consent changes, that a platform ingests and processes as they occur.
• Explainability (reason codes): Explainability is the ability to show why a system reached a specific decision in terms a person can understand; reason codes are standardised statements of the main factors.

F

• First-party data: First-party data is information an organisation collects directly from its own customers through its own websites, apps, transactions and service channels.

G

• Golden record: A golden record is the single, best-available version of a customer's data, assembled from multiple source records using survivorship rules that decide which value wins.

H

• High-risk AI system (EU AI Act): Under the EU AI Act (Article 6), a high-risk AI system is one covered by Annex I product law or used in an Annex III area such as credit scoring.

I

• Identity graph: An identity graph is a data structure that stores the links between identifiers (emails, device IDs, account numbers) and the person or household they have been resolved to.
• Identity resolution: Identity resolution is the process of matching records from different sources that refer to the same person or household, so that one profile replaces many fragmented ones.

J

• Journey orchestration: Journey orchestration coordinates messages and actions across channels over time for each customer, moving them through defined paths based on their behaviour, data and consent.

M

• Model Context Protocol (MCP): The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems, so they can reach data sources, tools and workflows in a uniform way.
• Model lineage: Model lineage is the traceable record of a model's origins: the data it was trained on, the code and parameters used, its versions, and where it is deployed.
• Monthly tracked user (MTU): A monthly tracked user (MTU) is a billing unit that counts each distinct user, known or anonymous, who generates tracked events in a month.

N

• Next best action (NBA): Next best action (NBA) is a decisioning approach that picks the most appropriate action for each customer from a set of eligible options, balancing customer needs and business goals.

P

• Packaged customer data platform (CDP): A packaged customer data platform (CDP) is an all-in-one product, usually vendor-hosted SaaS, that bundles collection, identity resolution, storage, segmentation and activation in one system.
• Perpetual licence (flat licence): A perpetual licence grants the right to use software indefinitely for a one-time fee, usually with optional annual fees for updates and support.
• Probabilistic matching: Probabilistic matching estimates the likelihood that two records describe the same person by scoring how closely their attributes agree, then links pairs above a chosen threshold.
• Protected health information (PHI): Protected health information (PHI) is individually identifiable health information in electronic or any other form, subject to a few exclusions such as education and employment records.
• Purpose limitation: Purpose limitation is the GDPR principle that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them.

R

• Real-time decisioning: Real-time decisioning selects the next action for a customer, such as an offer or message, within milliseconds to seconds of an event, using current data and rules or models.
• Register of information (DORA): The register of information is the record DORA requires financial entities to keep of all contractual arrangements with ICT third-party service providers, available to supervisors on request.
• Replay (event replay): Event replay re-processes previously recorded events from a stored log, so a platform can rebuild profiles, fix errors or feed a new destination without asking sources to resend.
• Reverse ETL: Reverse ETL copies modelled data from a data warehouse back into operational tools such as CRMs, ad platforms and email systems so teams can act on it.

S

• Self-hosted (private) customer data platform (CDP): A self-hosted customer data platform (CDP) runs on infrastructure the customer controls, on-premise or in its own cloud account, rather than in the vendor's shared SaaS environment.
• Single customer view (SCV): A single customer view (SCV) is a consolidated record of everything an organisation holds about one customer across products and channels, used to make consistent decisions.
• Single-tenant vs multi-tenant: In a single-tenant deployment one customer has a dedicated instance of the software and data store; in a multi-tenant deployment many customers share the same instance, separated logically.
• Suppression list: A suppression list is a record of identifiers that must not be contacted or processed for a stated purpose, such as people who unsubscribed, objected or withdrew consent.

T

• Third-party data: Third-party data is information about people collected by an organisation with no direct relationship to them and sold or licensed to others for targeting and enrichment.

W

• Warehouse-native customer data platform (CDP): A warehouse-native customer data platform (CDP) runs its profile, segmentation and activation logic directly on the customer's own data warehouse instead of copying data into a separate store.

Z

• Zero-party data: Zero-party data is information a customer intentionally and proactively shares with a brand, such as stated preferences, interests or communication choices.

Continue with the longer guides: What is a customer data platform? and Customer data platform architecture. Back to the Learn hub.