Every vendor claiming to offer the best internal communications software says the same thing. Yet most buyer guides reduce the decision to a feature grid, and feature grids make every platform look identical. That is a problem when employee data, regulatory obligations, and evidence standards sit underneath the checklist. This post offers a buyer’s evaluation framework for UK organisations, not a vendor ranking. It will show you why feature grids flatten real differences, then walk through a five-stage framework for choosing between internal communications systems. You will examine where employee data is actually held, how the ICO three-step test defines a restricted transfer, why access matters more than storage location, and how transfer mechanisms, TRAs, and the Data (Use and Access) Act 2025 shape compliance. You will also learn to verify UK hosting, ISO 27001 and security controls rather than accept assurances, judge analytics depth by what you can prove without a spreadsheet export, and decide whether surveys and landing pages are native or bolted on. Finally, we cover the hidden cost of stitching three tools together, red flags for shortlists, a practical scoring approach and trial checklist, and the questions that actually decide it.

Why feature grids make every internal communications platform look identical

Feature grids reward checkbox parity. Nearly every shortlisted internal communications system lists email sending, templates, scheduling, audience lists and a dashboard. The grid tells you what exists, not what works. The three things that genuinely separate platforms almost never appear in one: where employee data is held and who can access it, what the reporting can prove to leadership without a manual export, and whether surveys and landing pages live in the same platform as the send.

Evaluation criteria should be weighted to your own risk profile. A UK charity with a part-time data protection lead has a different question set from a listed employer dealing with works councils, unions and a formal DPIA process. Buyers who score vendors on compliance evidence, reporting depth and workflow consolidation tend to make faster, more defensible decisions than buyers who score on feature counts and demo polish.

This guide gives you a five-stage framework plus the exact questions to ask in a demo. It is structured around the ICO’s restricted transfer test for the data residency stage and evidence you can put in front of a DPO, IT lead or board. For a broader view of vendor assurance, see our 20-point checklist for communications vendor security. And because secure platforms still need creative, compliant content, balancing innovation with integrity matters too.

The five-stage framework for choosing between internal communications systems

Feature parity ends where evidence begins. This five-stage framework turns those questions into a weighted scorecard. Score each stage pass, partial or fail, record the document that proves it, and keep the file for procurement or audit.

1. Data residency and transfers. Identify where employee records are stored, which sub-processors can access them, and which mechanism covers every restricted transfer, such as UK adequacy, the UK IDTA or the Addendum, or binding corporate rules. Ask about remote access, not just hosting, and document your approach to protecting your data.
2. Security assurance. Request the certificate, certification body, scope statement and expiry date. Check whether it covers hosting, support and development. Ask for recent penetration test dates, remediation evidence and contractual audit rights.
3. Analytics depth. Test whether reporting answers a leadership question live, for example “did the pay review land?” If it only exports raw data for spreadsheet rebuilding, score it down. Look for per-send open, click, unsubscribe, timing, device and attention data.
4. Native surveys and landing pages. Confirm feedback and non-desk channels are built into the same platform as the send, targeted at the same audience segments and reported against the same employee records. Integrations often break the link between message and response.
5. Total cost of ownership. Add licence fees to internal hours, legal reviews, DPAs and reconciliation work. Three tools mean three contracts, three security reviews and manual matching. Consolidation reduces sub-processors and compliance overhead, as shown in Internal Communications As The Strategic Engine Of Budget 2025 Implementation.

Stage 1: Where is employee data actually held?

Stage 1 ends more shortlists than any other, because it sits at the intersection of legal, IT and communications ownership. No marketing page settles it. A “UK hosted” badge tells you where a server sits; it does not tell you who can reach the data.

Start with the ICO’s brief guide to international transfers, last updated 15 January 2026, and send it to your DPO before the first vendor call. You and every vendor then work from the same test rather than three readings of “UK based”.

For most UK employers, employee data processed for internal communications falls inside UK GDPR. The real work is proving where that data goes and what covers the journey. That matters because everything else in this framework, including measuring employee engagement without another survey, depends on the answer.

Work through the sub-sections below in order: the three-step restricted transfer test, the access question, the transfer mechanisms, and the written questions to put to every vendor.

The ICO three-step test for a restricted transfer

The ICO’s three-step test decides whether a transfer is “restricted” under UK GDPR. Work through it for each vendor scenario in order, and record the answer.

Step 1: does UK GDPR apply? For employee data processed for a UK employer’s internal communications, the answer is almost always yes. That brings the transfer rules into scope and means the question cannot be left to IT alone.

Step 2: are you initiating a transfer to an organisation outside the UK? Storage location is only one part of this. Routing, replication, backups and remote support access all count, so a UK data centre does not close the question.

Step 3: is the receiving organisation a separate legal entity? Consider group structures too: where one entity is not the controller, the transfer can still be restricted. All three answers must be yes for UK GDPR’s restricted transfer rules to bite.

Do not accept a UK hosted badge as the answer. Ask each vendor to walk your specific scenario through all three steps in writing, because a badge does not answer Step 2 or Step 3. Keep the completed test with your shortlist documentation. It is the single most useful artefact to hand a DPO asked to approve a new internal communications platform.

Access is the question, not storage

The three-step test tells you whether a transfer exists. The next question is what “transfer” actually captures. UK transfer rules cover personal information made accessible outside the UK, not only information you actively send (see the ICO guidance). Remote access by an overseas support engineer can create a transfer question on its own.

A UK hosted platform can still raise transfer issues if sub-processors, cloud infrastructure or support teams outside the UK can reach employee data. Ask about access routes, not data centres alone.

Request a named list of sub-processors, their countries and the role each plays. Check it against the vendor’s privacy notice and your own record of processing activities. Any mismatch is a documentation problem you inherit.

Article 28 of UK GDPR places processor obligations on the vendor. Ask how sub-processors are authorised, contracted, monitored and removed, and whether you will be notified before a new one is added. “We will update our privacy notice” is not notification.

Finally, test the answer with a concrete scenario: if a support engineer in a non-UK office opens a ticket about our account, can they see recipient records, message content, engagement data, or all three? The answer should be specific. If it is vague, treat the residency claim as unproven.

Transfer mechanisms, TRAs and the Data (Use and Access) Act 2025

Once access routes are mapped, each restricted transfer needs a lawful mechanism. These are UK adequacy regulations, appropriate safeguards such as the UK IDTA or the Addendum, UK Binding Corporate Rules, or one of the limited exceptions.

The Data (Use and Access) Act 2025 introduced the data protection test as the statutory term. The ICO still uses transfer risk assessment in practice, and its updated guidance does not remove the TRA as a compliance requirement. Do not let terminology changes create a false sense of completion.

Ask the vendor who performs the TRA, when it was last reviewed, what assumptions it makes about their own sub-processors, and whether they will supply the technical detail needed to complete it. A vendor that cannot answer those points leaves your DPO with an incomplete record.

The ICO has further work planned on TRAs, the IDTA, cloud services and an interactive restricted-transfer tool. Treat transfer documentation as a live document to review at least annually rather than sign once and file.

The ICO ran an international transfer guidance webinar on 10 March 2026 for SMEs and experienced practitioners. Share it with your legal or data protection team before contract signature, so the transfer mechanism, the TRA and the statutory test are agreed before anyone signs.

Questions to put to every vendor on UK data residency

With the transfer mechanism agreed in principle, move from framework to evidence. Put these five questions to every vendor in writing before the demo, and ask for answers in the contract pack rather than a marketing page.

1. Where are employee records stored at rest? Which regions host backups, disaster recovery and any analytics processing? Ask for a named data centre and cloud region list, not a country badge.
2. Which sub-processors touch employee data, in which countries are they based, and can any access it remotely? Request the current sub-processor list with roles and locations, plus your notification rights before changes.
3. What transfer mechanism covers each restricted transfer? Can you supply the signed IDTA or Addendum with the contract itself, rather than on request? If the answer is legacy EU SCCs, treat it as a red flag.
4. Who completed the transfer risk assessment, when was it last reviewed, and what is your process for notifying us of material changes to sub-processors or hosting locations? Ask for the dated assessment and its assumptions.
5. Will you provide a data processing agreement that already reflects Article 28 obligations? You want to review their terms, not draft them. The IDTA alone does not include Article 28 processing terms; those should sit in a linked DPA.

If a vendor cannot answer all five clearly, it should not reach Stage 2.

Stage 2: Security assurance you can verify, not just accept

With residency answered, turn to whether the vendor can evidence the controls that protect that data. Security is a legal duty under UK GDPR, not only a selling point, and the ICO expects appropriate technical and organisational measures plus processes that test their effectiveness.

Certifications: ask for the document, not the logo

ISO 27001 is what procurement teams ask about most often, but a badge on a website proves nothing. Request the certificate, the certification body, the scope statement and the expiry date. Then read the scope. Does it cover the service you are buying, including hosting, support, development and any managed service? A certificate covering head office functions only tells you very little about the platform itself.

Cyber Essentials, Cyber Essentials Plus and SOC 2 reports complement ISO 27001 because each answers a different question about controls. The vendor should be able to say, plainly, which one applies to your contract and what it covers.

Testing, logging and contractual rights

Ask for a summary of the most recent penetration test, the date it was completed, and how findings were remediated and verified. Ask how access to your employee data is logged, how long those logs are retained, and whether you can request an audit. Confirm you can receive a completed security questionnaire or a security schedule attached to the contract.

Treat UK-based marketing copy, including platforms such as NewZapp that lead on UK data security, as a starting point for questions rather than a verified control. No vendor’s claim replaces the evidence.

With security evidenced, move to what the platform can prove.

Stage 3: Analytics depth, or what you can prove without a spreadsheet

Stage 2 asked whether the platform is safe to hold employee data. Stage 3 asks what it lets you prove once you press send.

The question to ask in the room

A dashboard is not the test. The test is whether the platform answers a leadership question while you are still in the room: did the workforce read the pay review message, and did anything change afterwards? If the answer needs a spreadsheet, the platform has failed the stage.

Demand per-send metrics, not monthly averages: open rates, click rates, unsubscribes, the time and day employees engaged, the device they read on, and which parts of the email held the most attention. These are the signals that tell you whether an internal newsletter employees actually read is working or simply being delivered.

Segmentation and reliability

Check whether metrics segment by audience group, location, department or role. One organisation-wide open rate tells you very little about whether a message landed on the factory floor.

Ask how the platform handles open-rate reliability given image blocking and mail privacy features, and whether it reports on non-email channels such as landing pages and QR code scans. Also ask whether reporting is native and exportable, or whether someone must pull a CSV and rebuild the story every month before it goes to leadership.

NewZapp’s model is worth testing directly here: per-send analytics on a single screen covering open rates, clicks, social shares, unsubscribes, timing, device and the most engaged parts of an email. That is the shape of reporting this stage exists to probe. Next, test whether the feedback and non-desk channels behind those numbers are native to the same platform.

Stage 4: Are surveys and landing pages native, or bolted on?

Analytics tells you what was sent and opened. It cannot tell you why an employee acted, or failed to act, unless feedback and publishing sit in the same system as the send.

If surveys live in a separate tool, the link between message and response breaks. You know a pay review email went out and that a survey received responses, but not which recipients did both. That is where internal communications measurement quietly falls apart. Ask whether surveys and polls are created in the same platform as the send, targeted at the same audience segments, and reported against the same employee records rather than a separate respondent list. Also ask what metadata a personalised survey link records, because traceable links affect what you can honestly promise about anonymity.

Landing pages deserve the same scrutiny. Can you publish a branded page with a QR code for frontline, shift-based or non-desk staff, and does activity on that page feed the same analytics as the email? Test whether results can be viewed per audience group, so a distribution centre and head office get separate read-outs from one campaign without manual filtering.

Treat this as a trial checklist item, not a spec sheet line. Build one real survey and one real landing page in the demo environment using your own audience data. For practical ways to lift participation, see 6 quick wins to improve employee survey response rates. If feedback is native, you can price what consolidation replaces next.

Stage 5: The hidden cost of stitching three tools together

Native tools resolve the integration problem, but they expose a commercial question most shortlists leave until too late: what does the whole stack cost to run, not just to license?

Three tools mean three contracts, three renewal cycles, three security reviews and three data processing agreements. Each consumes procurement, legal and IT time that never appears on a licence quote, and each review repeats the residency questions you asked in Stage 1.

Then there is data duplication. Employee records sitting in a sending platform, a survey tool and a page builder expand the surface area you must document in your record of processing activities, and multiply the sub-processor and transfer questions from Stage 1. Ask each vendor what the platform replaces, and price the total stack, including internal hours and third-party support.

Reconciliation is the quiet cost. Someone has to match send lists to survey respondents to page visits, usually in a spreadsheet, usually monthly, and that person is usually the internal communications lead.

Consolidation is a compliance argument as much as a budget one. Fewer tools means fewer sub-processors, fewer DPAs to review, and a shorter answer when your DPO asks where employee data sits.

Red flags that should end a shortlist conversation

If the total-cost picture leaves you weighing three contracts and three data processing agreements, the demos that follow are your chance to disqualify as much as to shortlist. Five signals should stop a conversation outright.

Vague hosting claims. “UK hosted” means little without a named sub-processor list, a data processing agreement template you can review before signature, and a straight answer on whether overseas support staff can access employee records. If any of the three is missing, the residency stage cannot be scored.

Raw-export reporting. If the only route to a leadership or employee forum view is exporting a CSV and rebuilding it in a spreadsheet, the platform is not doing the measurement work you are paying for. Ask to see the native dashboard, not a sample export.

Feedback sold as an integration. Surveys, polls or landing pages offered as third-party connections rather than built-in features usually mean the link between a send and its response stays manual. That is precisely the gap Stage 4 exists to catch.

Unverifiable certification. A security logo without a certificate, a scope statement and an expiry date is marketing, not assurance. Request all three in writing and read the scope.

Late-revealed pricing and thin contracts. Per-seat, per-send or per-contact charges that surface after the demo, or terms with no security schedule, no audit right and no sub-processor notification clause, are structural risks rather than negotiating positions. Treat them as disqualifying.

A practical scoring approach and trial checklist

Turn those red flags into a scorecard, not a gut feel. Weight the five stages to your risk profile before demos. A regulated or public sector employer might set data residency and security at 40 per cent, analytics depth at 25 per cent, native feedback at 20 per cent and total cost at 15 per cent. A charity or small team will weight them differently; that is the point.

Score each vendor pass, partial or fail against evidence, and record the document that supports every score. That written trail is what holds up when procurement, your DPO or an auditor asks why one platform won six months later.

Then trial properly. Run two weeks with one real campaign, one real survey and one real landing page, sent to a representative employee audience segment, not a five-person test list. A five-person test proves the software functions; a real segment proves it works on your distribution lists, non-desk staff and data.

Bring three people in: your DPO, an IT or security lead and one frontline communications colleague. Each spots a different failure mode, from a missing sub-processor to a QR code that does not survive a print run.

Finally, ask for a reference from a UK organisation of similar size and sector. Ask specifically about reporting quality, support responsiveness and how quickly change requests get delivered. Look for a vendor that treats your feedback the way how we use NPS feedback to improve your reporting, insight and overall experience shows.

Conclusion: the questions that actually decide it

With the scorecard weighted, the decision rests on evidence rather than parity. Feature grids will keep making internal communications software look interchangeable. Three questions separate the platforms that work from the ones that do not:

• Where is employee data held, and who can access it?
• What can your reporting prove without a spreadsheet?
• Do feedback and publishing live in the same platform as the send?

Before your next vendor call, send the ICO’s brief guide on international transfers to your DPO. Request the sub-processor list and signed IDTA in writing. Ask for the ISO 27001 certificate with its scope and expiry date.

In the trial, judge the reporting on whether it answers a leadership question on the screen it arrives on, not after an export. One real campaign, survey and landing page will show whether the platform delivers that.

NewZapp is one option worth scoring against this framework. It is a UK-hosted platform with per-send analytics, native surveys, landing pages and QR code campaigns in one place, so you can compare it on evidence rather than on a feature list.