Email software costs that licence comparisons leave out

Hidden email software costs are usually work and risk, not secret fees. Licence comparisons for Email marketing software show plan tiers and seat counts. They rarely show data mapping, suppression testing, access reviews or exit work.

The evidence cut-off for this non-ranked England list was 5 September 2026. Items were included where authoritative UK guidance identifies an operational duty or lifecycle activity that consumes resources. It excludes provider prices, frequency estimates, salaries, penalties and claimed savings. No supplier funded the research and no system was tested.

What to take away

1. Reconstructing data history

Migration needs more than addresses. Source, notice version, subscriber type and permission route must remain interpretable. Objections and suppressions must also survive.

Budget mapping, cleansing, exceptions and reconciliation rather than a one-click import assumption. Typically, a mid-size migration of 10,000 to 100,000 records costs £3,000 to £15,000 in internal and contractor time, or 10 to 25 days. Complex provenance or multiple legacy systems typically push it above £20,000.

2. Privacy and PECR decisions

The ICO's planning guidance places purpose, responsibility, lawful basis and channel analysis with the organisation. Add specialist review, records and rework when audience or purpose changes. A supplier compliance label cannot absorb this cost.

A documented direct marketing assessment typically costs £1,200 to £4,000 in legal or specialist time. Rebuilding records after a purpose change adds 5 to 15 internal days, often £1,000 to £3,000 in staff time.

3. Suppression propagation

An objection must survive integrations, uploads and restores. ICO preference guidance explains suppression records. Include testing, monitoring, complaint investigation and correction across systems. Typically, budget £1,000 to £5,000 a year for a mid-size stack with several integrations. Typically, one failed propagation incident costs £2,000 to £10,000 in investigation, correction and complaint handling.

4. Authentication and domain ownership

DNS access, SPF, DKIM, DMARC, monitoring and incident response require technical time. NCSC email-security guidance supports staged implementation. These controls reduce spoofing risk but do not guarantee delivery.

A staged rollout for one domain typically takes 2 to 6 days of technical work, or £800 to £3,000 at contractor rates. Ongoing monitoring and incident response typically add £500 to £2,000 a year. A full managed DMARC service typically costs £1,000 to £6,000 a year for a mid-size sender.

5. Accessible content and testing

Templates, dynamic variants and landing pages need review with relevant clients, keyboards and assistive technologies. Price remediation and retesting. A checker result or alt-text field is not end-to-end evidence. A basic audit of 10 to 20 templates typically costs £1,500 to £5,000. Remediation and retesting typically add £1,000 to £4,000, or 5 to 15 internal days.

6. Security assurance and recovery

Staff must review scoped reports, configure access, monitor exports and rehearse incidents. NCSC SaaS guidance keeps customer configuration and recovery in view. Add internal owners and specialist support.

A security review of one email platform typically costs £2,000 to £8,000. Access reviews and export monitoring typically add 2 to 5 days a quarter, or £1,000 to £4,000 a year. Recovery testing typically adds £1,000 to £5,000 per exercise.

7. Everyday operation

Campaign briefing, approvals, content and list maintenance recur. Complaints, rights requests, reporting and supplier management also recur. Measure actual hours by role rather than borrowing a generic staffing ratio.

A small team sending two campaigns a week typically spends 0.5 to 1.5 full-time equivalent days a week on these tasks. At a loaded rate of £250 to £500 a day, that is £6,000 to £39,000 a year. Typically, add complaint and rights request handling at £50 to £200 per case.

Separate routine capacity from avoidable rework. A base budget may include one approval and scheduled list maintenance, while a scenario records extra cycles caused by broken data, late claims evidence or an inaccessible template. That distinction helps an owner correct the process instead of accepting repeated failure as normal demand.

8. Contract change and renewal

Notice dates, usage thresholds, price changes and plan limits need review before renewal. Support and liability also need review. Include finance, procurement and legal time, plus a reforecast when the supplier or scope changes.

A renewal review typically takes 3 to 10 internal days across those teams. External legal review of a changed data processing agreement typically costs £500 to £2,500. Missed notice periods typically add one extra term at the old price, often £2,000 to £20,000 for a mid-size plan.

9. Incidents and failed changes

Allow scenario resources for containment, investigation, communication, restoration and independent advice. Do not book an invented expected loss. Set a maximum exposure and escalation authority instead.

A tabletop rehearsal typically costs £1,000 to £4,000 in staff and facilitator time. A real incident with a send to the wrong segment typically costs £2,000 to £15,000 in investigation, correction and goodwill. Independent forensic support typically exceeds £500 a day.

Price a rehearsal as well as a response. A scoped exercise can test who can suspend sending, preserve logs, contact the supplier, restore a known configuration and authorise restart. The resulting action log gives the next budget a firmer evidence base than an arbitrary incident percentage.

10. Export and exit

ICO processor-contract guidance includes return or deletion and audit provisions. Budget export validation, dual running, transition, deletion evidence and decommissioning. A downloaded file may still omit essential history.

A full export validation and dual running for a mid-size account typically costs £3,000 to £12,000. Deletion evidence and decommissioning typically add £1,000 to £4,000. If suppression, provenance or campaign history cannot be reconstructed, remediation typically exceeds £20,000.

Before renewal, compare actual quantities and recorded staff time with the approved case. Check the notice deadline early enough to obtain an export and test whether suppression, provenance and campaign history can be reconstructed. If not, record remediation and transition exposure before approving another term.

Assign every item a currency, unit, quantity and period. Add VAT treatment, evidence source, confidence and owner. Put it in the base case when it is required, not in a vague contingency. Stop approval if a mandatory legal, accessibility, security or exit activity remains uncosted.

Before you act

Common questions

Why is a supplier compliance label not enough for PECR?

The ICO's planning guidance places purpose, responsibility, lawful basis and channel analysis with the organisation. Specialist review, records and rework are needed when audience or purpose changes. A supplier compliance label cannot absorb this cost, so it must be budgeted internally. A documented assessment typically costs £1,200 to £4,000.

What should be tested in an incident rehearsal?

A scoped exercise can test who can suspend sending, preserve logs, contact the supplier, restore a known configuration and authorise restart. The resulting action log gives the next budget a firmer evidence base than an arbitrary incident percentage. A tabletop session typically costs £1,000 to £4,000.

When should you stop approving another contract term?

Stop approval if a mandatory legal, accessibility, security or exit activity remains uncosted. Before renewal, compare actual quantities and recorded staff time with the approved case, check the notice deadline early and test whether suppression, provenance and campaign history can be reconstructed. Exit and remediation typically exceed £20,000 if history is incomplete.