Every internal communications email software demo can feel reassuringly familiar. The same dashboards, the same audience segmentation, the same promises about opens and clicks. That sameness is the problem. Feature lists rarely reveal whether a platform can withstand scrutiny over UK data hosting, security posture, lawful monitoring, or the documented evidence an internal email programme now requires.

This guide cuts through the demo script with nine questions buyers should ask in the order that matters. You will learn why every platform demo looks the same, where employee data lives and who can access it, what lawful basis supports analytics, whether a DPIA has been done, how incidental special category data is handled, and whether engagement can be evidenced beyond an open rate. You will also assess auditor-ready records, retention and deletion, least intrusive means, and what happens at exit. Finally, you will score the answers and build your shortlist. Treat those answers, not the feature grid, as the real shortlist.

Why Every Internal Comms Email Platform Demo Looks the Same

If your last three internal communications email platform demos blurred into one, that is feature parity doing its job, not a failure of your evaluation. Branded templates, audience lists, scheduling and a basic reporting tab are now table stakes. They cannot differentiate anything.

What the demo script never covers is where employee data is hosted, which lawful basis supports per-recipient tracking, what evidence you can hand an auditor, and how long data is kept. Those questions separate a communications tool from a compliance risk, and they rarely make the slide deck. Getting that right is part of Protecting your data, and the same discipline applies to any new tool you bring into employee messaging, as we explored in Secure Channels, Creative Content: Balancing Innovation with Integrity.

Note the commercial frame. The queries that bring buyers here (internal communications email software, internal communications email platform, internal comms email software, internal email software, internal email analytics) are all pre-purchase investigation language. You are building a shortlist, so every question below ends in something you can ask, score, or strike a vendor off for.

The order matters: data posture first, lawful monitoring second, evidence third, documented records and exit terms last. Capability questions come at the end because they are the easiest to answer and the least likely to cause harm if answered badly. The same thinking applies to any newer tool, as we set out in Challenges and Considerations, using ChatGPT for internal communications.

Three terms appear throughout. A DPIA is a data protection impact assessment. Special category data covers things like health and union membership. A sub-processor is any third party that touches your employee data on the vendor’s behalf.

Monitoring worker communications can incidentally capture special category data: a message about a hospital appointment, a note referencing a trade union representative, a mention of a religious observance. That risk runs through Questions 3 to 5, and it is why the order of this checklist matters.

This is not legal advice. The ICO’s workplace monitoring guidance was published on 3 October 2023 and is under review following the Data (Use and Access) Act, so check the live version and involve your own DPO.

Question 1: Where Does Employee Data Live, and Who Can Touch It?

Begin here, because a comms tool that cannot answer this is a compliance risk regardless of how polished its templates look.

Ask directly: is the internal communications email platform UK-hosted, and is any component replicated outside the UK? Reporting, backups, disaster recovery and support tooling all count. Request the answer in writing against the current architecture, not the version in a two-year-old security pack.

Request the full sub-processor list: email delivery infrastructure, analytics processing, error monitoring, customer support systems, and any third-party tracking domains appearing in the HTML of a sent email. A vendor who cannot produce this on request has given you a substantive answer in itself.

Self-declaration is not assurance. Ask for ISO 27001, Cyber Essentials Plus or SOC 2 Type II, plus the date and scope of the most recent penetration test, who performed it, and whether you can review the executive summary under NDA. Under UK GDPR a processor must offer sufficient guarantees, and processor contracts must specify the processing terms that support them.

Ask how the platform supports a data subject access request covering employee records it holds, including engagement history and survey responses, and what turnaround the vendor commits to when you need an export. Ask for inside reports to be demonstrated against your own data rather than a canned dataset. This matters most where comms carries sensitive workforce change, the territory covered by NewZapp’s part in change communications.

NewZapp’s own marketing claims UK based data security. Treat that as a claim to verify against a live sub-processor list and current certifications, and hold every other vendor to precisely the same standard.

Question 2: What Lawful Basis Supports the Monitoring Your Internal Email Analytics Performs?

The lawful basis question is where analytics turns into compliance exposure. Employers must comply with UK GDPR whatever technology they use, must select the least intrusive means available, avoid function creep, and collect no more data than necessary. That framing comes from ICO workplace monitoring guidance published on 3 October 2023 and applies whether staff work in an office or at home.

Do not accept consent as the default answer. Workers have far less power than employers, so consent is unlikely to be a valid lawful basis for monitoring employee communications. Most organisations rely instead on legitimate interests, evidenced by a carefully documented balancing test.

Ask the vendor to describe the processing plainly: per-recipient open tracking, click tracking, device and timing capture, link rewriting, tracking pixels, and whether any of it is attributable to a named individual rather than an aggregate segment. Open rates already mislead because of image proxying and Apple Mail Privacy Protection, so ask how machine fetches are separated from genuine human opens. Click-level attribution has its own moving parts, and tracking actions and new technologies make the picture less settled rather than more. A vague answer here is a signal.

Flag the genuinely open question instead of letting anyone settle it. Whether per-employee campaign analytics counts as monitoring under the ICO’s workplace guidance is not addressed directly in the sources reviewed here. Put it to your DPO and treat a DPIA as a prudent step, not a legal verdict.

Question 3: Has a DPIA Been Done, or Can the Vendor Support One?

The ICO requires controllers to complete a data protection impact assessment before monitoring employees’ emails and messages. Run that requirement against the per-recipient tracking inside an internal communications email platform and the overlap is uncomfortable. The ICO also recommends completing a DPIA for homeworking monitoring and signals that the principle extends to any monitoring technology; check the live guidance for how far it reaches.

Note the second layer: the ICO recommends DPIAs for workplace monitoring even where one is not strictly required. A vendor who treats a DPIA as an unusual request is out of step with current regulatory expectation, and that reaction tells you how they will handle your DPO’s questions later.

Then ask two vendor-specific questions.

First: does the vendor maintain its own DPIA covering processing it carries out as a controller for its own purposes, such as support, product analytics or deliverability monitoring, and will they share a summary with your data protection officer?

Second: what will they supply to feed yours? Data flows, purposes, categories of data, recipients and sub-processors, retention periods, and the technical and organisational safeguards they rely on.

Budget DPIA time into the selection timeline rather than treating it as a post go-live formality. The DPIA is the document that decides whether your internal email analytics can stay switched on, so treat a vendor who accommodates it as a shortlist candidate and one who deflects as a risk.

Question 4: Does Any Processing Incidentally Capture Special Category Data?

A DPIA that maps data flows down to names and email addresses is still incomplete. The question it must also answer is what arrives uninvited in message content.

Under UK GDPR, a special category condition must be identified before that processing happens, not after an employee complains.

So ask how the platform handles the obvious capture points. Survey and poll responses, free-text fields, subject lines, reply-to inboxes, and any comment or feedback feature where someone might disclose a health condition or a union matter. Where does that content live, who can read it, is it searchable, and does it feed internal email analytics?

Then ask whether audience segments, tags or custom fields could be built on sensitive attributes. Who can create them, and what controls stop a well-meaning comms team from building a list that implies health or union status? The ICO’s clarification of inferred special category data sharpens this point.

If incidental capture is possible, the DPIA must record the condition relied on and the safeguards applied, and that makes it a live document you revisit rather than a one-off exercise.

Be candid about the evidence gap. The sources reviewed support the principle that incidental special category data matters, but say nothing about how vendors should design for it. Treat the vendor’s answer as a risk indicator, not a pass or fail. The next question turns to what the platform can prove.

Question 5: Can Internal Email Analytics Evidence Engagement Beyond an Open Rate?

Question 4 covered what might be captured on the way in. This question covers what comes back out, and it is where the phrase internal email analytics earns its keep.

Start with opens, the metric every platform reports and the one most likely to mislead. Apple Mail Privacy Protection pre-loads pixels through Apple’s proxy regardless of whether anyone reads the message, as noted earlier, so ask how the vendor separates a genuine human open from a machine fetch.

Then ask what is measured per employee once opens are set aside: link clicks, time and day of viewing, device and client, scroll depth, shares, unsubscribes, and whether performance appears in real time as a campaign runs.

Ask how aggregation and privacy are handled alongside evidence quality. The granularity that makes analytics useful is the same granularity that raises the monitoring question in Question 2, and a vendor who can explain that trade-off has thought about it.

Ask whether reporting exports into a format that supports board reporting, whether benchmarks come from your own trend line or a wider dataset, and whether the same view can be segmented by audience without exposing individuals.

Request the reporting demo against your own campaign, not a canned dataset. NewZapp reports opens, clicks, shares, unsubscribes, timing, device and real-time attention from a single dashboard, and any vendor claiming the same should prove it on your data. Measure everything from the outset, and the answers get easier to defend.

Finally, note the honest gap: the sources reviewed do not settle how reliable open tracking is as an engagement measure. Ask anyway, and treat the answer as a test of candour rather than a question with one correct answer.

Question 6: What Documented Records Does the Platform Produce for Auditors?

Analytics answer what happened. Audit records answer whether you can prove it later, to an internal auditor, an external assessor or a regulator.

Ask for the audit log specification first: who sent what, to which audience, at what time, who changed an audience or segment, who exported a contact list, and who changed a permission or role. If the answer is “we can pull that on request,” you have not received a specification.

Push on the qualities of those logs. Are they immutable, timestamped, retained for a defined period, and exportable in a format internal audit or an external assessor can work with, rather than a screenshot or a manual CSV someone assembles? Immutability matters because a log that can be edited is not evidence.

Then test the practical uses. Ask how the internal comms email software helps you answer a DSAR or information rights request without manual spreadsheet archaeology. Ask whether the same records can evidence an ISO 27001 control or support a breach investigation.

Permissions are part of the answer. Ask how role design is evidenced: who inside your organisation can see employee-level engagement data, and who can export it. That access model is itself an audit question.

One limitation to state plainly. The research behind this piece supports DPIAs as a documented requirement, but it says nothing specific about audit logs or record-keeping in internal comms platforms. Treat these as questions to put directly to the vendor and to your own audit function, not as requirements you can assume are met.

The ICO’s workplace monitoring guidance is under review following the Data (Use and Access) Act; check the live version before you finalise your requirements.

Question 7: What Is the Retention and Deletion Model?

Audit logs record what happened. Retention decides how long any of it remains, and that is where many internal comms email software conversations go quiet.

Ask for retention periods per data type, not one blanket number. Campaign content, per-recipient engagement data from your internal email analytics, survey and poll responses, uploaded audience lists, and suppressed or unsubscribed records all serve different purposes and should not share a single clock.

Then ask how deletion actually behaves. Hard delete or soft delete? Does an archived campaign stay recoverable, and for how long? How long do deleted records persist in backups or disaster recovery copies before they are genuinely gone? “Deleted” on screen is not the same as erased.

Ask how retention is configured. Can you shorten a period without a professional services project? Who inside your organisation can change it, and are those changes logged?

Finally, test alignment. The storage limitation principle requires you to justify retention against purpose and to set standard periods where possible, so vendor defaults must map to your own schedule, not replace it. Ask for a data map tying each field to a stated retention period.

Keep this section short on purpose. The public evidence base for retention specifics in internal comms platforms is thin, and a brief, honest answer from a vendor is worth far more than a lengthy vague one. Next: whether that vendor can prove least intrusive means.

Question 8: Can the Vendor Prove Least Intrusive Means?

Retention answers tell you how long data persists. Least intrusive means asks whether it should have been collected at all, and the ICO’s workplace monitoring guidance is explicit that employers must select the least intrusive option available and collect no more than necessary.

Start with an itemised inventory. Ask the vendor to list every tracking mechanism the internal communications email platform applies and, beside each one, whether it can be switched off and at which level: platform-wide, campaign-level, audience-level or recipient-level. Ask for that as a table.

Then test the toggle reality. “Flexible tracking” means nothing until you see it. Ask whether you can run a campaign with click tracking on and open tracking off, or report at segment level rather than per person, and ask them to demonstrate it live in the interface rather than describe it on a slide.

Ask about minimisation in practice. Does the platform collect fields you will never use? Can those fields be suppressed at import? How are imports validated, so that unnecessary personal data does not quietly accumulate in your tenancy?

Homeworking and hybrid arrangements are treated as higher risk by the ICO, partly because monitoring can inadvertently capture private-life information. Ask how the vendor supports those scenarios, and whether default settings differ for remote and on-site populations.

Finally, request toggle-level documentation so your DPO can confirm minimisation from evidence rather than accept a verbal assurance in a sales call. Make that documentation a condition of shortlisting, not a follow-up item.

Question 9: What Happens at Exit?

If your vendor has now documented every tracking toggle, the final question is how cleanly you can walk away. Exit terms are cheap to negotiate at signature and costly to discover later.

Ask about portability in specifics. What export format is provided, CSV, JSON or something you can actually import elsewhere? Does the export include engagement history, survey responses and audit logs, or only the contact list? Is export self-service from the interface, or a chargeable professional services exercise you have to commission and wait for?

Ask what happens to data on termination. Pin down the deletion timeline, whether you receive certification of deletion, and how long records survive in backups after the contract ends. A vendor that cannot separate live deletion from backup expiry has not thought about it.

Ask about wind-down mechanics: notice periods, support during transition, and what happens to scheduled campaigns, active surveys, landing pages and QR campaigns. Ask whether redirects can be preserved, so printed posters and QR codes do not dead-end on day one.

Ask whether the vendor will sign contractual terms covering deletion on exit, advance notice of sub-processor changes, breach notification timelines and audit rights. Controllers are expected to know every sub-processor and to be notified promptly of changes, so that notification right belongs in the contract before you sign.

Then close the loop: get the exit answer in writing before you sign. It is the cheapest risk control in the whole procurement and the one most often skipped.

How to Score the Answers and Build Your Shortlist

You have the exit terms in writing. Now score everything else on the same standard.

Score evidence, not assurance

Give each of the nine questions one of three bands: documented and shareable, partially documented, or verbal only. Verbal only is an amber at best, however confident the account manager sounds. Confidence is not a control.

Treat non-answers as answers. A vendor who cannot produce a current sub-processor list, a retention schedule or a DPIA summary is telling you how the relationship will run once the contract is signed. Record that in the scoring rather than extending the benefit of the doubt.

Bring the reviewers in

Drop the nine questions into your RFP or security questionnaire verbatim. Ask IT, InfoSec and your DPO to review the responses independently, so the comms team is not carrying the compliance judgement alone. Three readers catch contradictions one reviewer misses.

Weight to your risk

For a regulated, unionised or heavily hybrid workforce, weight Questions 1 to 4 most heavily: data residency, lawful basis, DPIA support, special category data. Where the board wants proof of engagement, weight Question 5, internal email analytics, most heavily.

Let the pattern build the shortlist

Compare answers like for like rather than comparing feature grids, and let the pattern of responses decide who advances. The vendors that answer well on data posture, lawful monitoring and evidence quality are the ones worth a second meeting. That pattern, not the polish of the demo, is what a shortlist of internal comms email software should be built from.

Conclusion: Let the Answers Build Your Shortlist

The sequence and scoring method above are the output of every section that precedes them; apply them as a unit. Asked out of order, the questions reward a polished demo over a defensible platform.

Bring the completed checklist into your next internal communications email platform conversation, including one with NewZapp, and ask every vendor to answer against your own campaign data rather than a curated demo environment. Real send history exposes what a sandbox conceals: tracking behaviour, segmentation limits, export formats and retention defaults.

Involve your DPO before you shortlist, not after. They should review the raw answers alongside IT and InfoSec, and their judgement should shape which vendors reach a second meeting. Date-stamp your reading of the ICO guidance, which remains under review following the Data (Use and Access) Act, and check the live version again before you sign.

That is the shift this checklist is built to produce. Treat the shortlist as the output of the answers rather than the input to the questions, and compliance risk stops being an abstract worry. It becomes a procurement decision you can defend to a board, an auditor and your own workforce.