CDP Governance Has Moved to IT — Was That the Right Call?

Angle

Independent practitioner research (MarTech, February 2024) confirms that GDPR and CCPA compliance requirements have shifted CDP decision authority from marketing to IT — CMOs are now influencers, not owners. The article examines what this governance shift gets right (compliance rigor, vendor contract scrutiny) and what it systematically loses (activation velocity, marketer feedback loops on data quality). Neither marketing-led nor IT-led governance alone produces the best CDP outcomes; the brief frames the organizational design question the reader should be asking, rather than resolving it for them.

Key decision this helps with

What governance structure for CDP ownership balances compliance rigor with marketing effectiveness — and what signals tell you your current structure has drifted too far in either direction?

Tradeoffs the article will map

• IT-led governance (regulatory defensibility, vendor contract leverage) vs. marketing-led governance (activation velocity, data quality feedback loops)
• Centralized CDP ownership (clear accountability, slower iteration) vs. federated ownership (faster experiments, fragmented compliance posture)
• Pre-implementation governance design vs. post-incident governance redesign (cost and disruption differ significantly)

Open questions / uncertainties

• Whether CCPA ADMT rules will push CDP governance further toward IT/legal or create a new compliance-literate marketing operations role is an open organizational design question
• There is no established benchmark for how governance structure correlates with CDP ROI — the practitioner data is anecdotal and largely sourced from vendor-commissioned research

Knowledge-graph nodes this draws from

• org-dim.operational-profile.marketing-led-cdp
• org-dim.org-chart-type.matrixed-enterprise
• constraint.gdpr-right-to-erasure