Costs and pricing
Part of A measurement budget method that keeps three separate ledgers and tests its benefits
Seven measurement cost categories for England buyers to model outside a licence quote
Seven measurement cost categories for England buyers to model outside a licence quote, from privacy design and DPIA to security, VAT, migration and exit.
Privacy first measurement hidden costs are usually work omitted from the quote, not mysterious surcharges. Seven categories below belong in an England buyer's model before price approval.
What to take away
- Hidden measurement costs are work omitted from the quote, not mysterious surcharges.
- Seven categories belong in an England buyer's model before price approval.
- Model each category as hours times approved rate plus documented external charges.
- Review the estimate if a category has no owner or the service changes.
- Archive the dated estimate beside actual outturn for the next budget.
Inclusion method
Research date: 5 September 2026.
Inclusion: a category required current UK guidance identifying work, a resource or a financial treatment that a licence figure may omit.
Criteria: traceability, possible materiality and a clear buyer action.
Geography: the buying scenario is England; the linked regulator and government records have UK or stated public-sector scope.
Exclusions: product features, supplier prices, penalties, speculative breach losses and claimed savings.
The order follows a project from design to exit, not cost or importance. This is desk research. No invoice, account, supplier service or implementation was tested, and the editorial team declared no relevant commercial relationship.
1. Data and purpose design
Teams spend time deciding which events are necessary, drawing flows and removing unjustified fields. The ICO's privacy by design guidance places that work across the processing lifecycle. Budget named privacy and technical hours; a supplier's privacy label does not perform them.
2. Project risk assessment
Screening and, where required, completing a DPIA can involve consultation, alternatives, risk owners and approval. The ICO DPIA guidance provides the process but cannot set a universal number of days. Record actual roles and planned hours.
3. Security assurance
Reviewing identity controls, incidents, resilience, encryption and supplier evidence needs qualified effort. The NCSC SaaS security guidance is a question framework, not certification. Include initial assessment, unresolved remediation and repeat review after material service changes.
4. Internal labour and overhead
Analysts, developers, procurement, finance, support and managers contribute time even when their pay is already budgeted. The official Service Costing in Government publication uses traceable staff, non-staff and overhead pools for government services. A private organisation should use its own approved loaded rates and avoid counting payroll twice.
5. VAT and overseas-service treatment
Gross cash and economic cost can differ. HMRC's services from abroad guidance describes the reverse-charge mechanism and notes that partial exemption can affect the net result. Currency conversion, evidence and VAT recovery need a qualified tax owner; an invoice without UK VAT is not enough to set the line to zero.
6. Parallel migration and rework
Old and new measurement may run together while events, consent states and reports are reconciled. The government Sourcing Playbook puts mobilisation, whole-life cost and transition into its public-sector model. Other buyers can identify the same work without adopting government rules.
7. Export and contract exit
Data extraction, definition transfer, report rebuilding, account removal and deletion evidence all consume resources. GOV.UK's Open Standards principles tell government bodies to estimate exit and migration costs at the start. Private contracts need their own rights, formats and acceptance tests.
Model each category as hours x approved £ per hour + documented external charges across contract and exit period. The total has no denominator; include in-scope resources only, keep recoverable VAT separate, exclude invented incident values.
Vary labour, delay, migration effort; review if a category lacks an owner, service changes, or whole-life total exceeds authority. Qualified finance, tax, accounting, privacy and security reviewers must confirm their parts; commercial reviewers must confirm theirs. The list predicts neither compliance nor return.
Archive the dated estimate beside actual outturn so the next budget can use observed effort instead of repeating an unsupported assumption.
Before you act
- Name a privacy and technical owner for data and purpose design.
- Record actual roles and planned hours for the DPIA.
- Include initial assessment and repeat review after material service changes.
- Use your own approved loaded rates and avoid counting payroll twice.
- Keep recoverable VAT separate from gross cash and economic cost.
- Estimate exit and migration costs at the start of the contract.
Common questions
What does the article say about the licence quote?
It says hidden costs are usually work omitted from the quote rather than mysterious surcharges. Seven categories belong in an England buyer's model before price approval. The order follows a project from design to exit, not cost or importance.
How should a buyer model the seven categories?
Model every category as hours times approved pounds per hour plus documented external charges over the contract and exit period. Include only in-scope resources, keep recoverable VAT separate and exclude invented incident values. Vary labour, delay and migration effort.
When should the estimate be reviewed?
Review if a category has no owner, the service changes, or the whole-life total exceeds authority. Qualified finance, tax, accounting, privacy, security and commercial reviewers must confirm their parts. The list predicts neither compliance nor return.
