Rules and ethics
Part of UK media buying agencies rules and ethics explained
Media buying agencies data protection: campaign map guide
Media buying agencies data protection starts with a campaign map: record each activity, audience source, legal basis, tracking, suppliers and deletion.
This guide to media buying agencies data protection starts with the campaign's data path. Do not approve an audience or measurement plan until the agency can draw it. The map should show what enters, what is created, every party that receives it and what leaves at the end. That gives a privacy reviewer something concrete to examine before spend begins.
This guide addresses campaigns run for organisations in England. The relevant framework includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The Information Commissioner's Office (ICO) publishes UK guidance, and National Cyber Security Centre (NCSC) security advice is for UK organisations. For agency selection, ask the agency to show the workflow and contract for the proposed campaign; this guide is not advice on a specific lawful basis, contract or international transfer.
What to take away
- Map each campaign activity separately rather than lumping everything under one vague campaign data entry.
- Record the source, recipients, legal basis and retention for every use before any spend begins.
- Check what tracking technology actually does before and after a user makes a choice.
- Require advance notice when an agency adds a processor or changes a data destination.
- Release work only when rights can travel through the chain and deletion has an owner.
Map one use at a time
Create a row for each activity, such as an uploaded customer audience, site retargeting, frequency control, conversion measurement or survey follow-up. Avoid a single entry called "campaign data".
For every row, record:
- The activity and purpose, with a separate entry for each use.
- The personal data involved, its source, how it was collected and the people it concerns.
- Every recipient and destination, including onward recipients.
- The agency's and advertiser's roles, instructions and responsibilities.
- The UK GDPR lawful basis and any relevant PECR condition, plus the notice, consent or opt-out evidence.
- Tracking technologies, their purposes, firing conditions and consent signals.
- The retention period, deletion method and person responsible for deletion.
- Any international destination and the transfer mechanism relied on.
- How rights requests and suppression instructions will be passed through the chain.
Campaign data map row fields
- Business purpose and decision supported
- Data fields and their source
- Advertiser, agency, platform recipients
- Who decides purpose and means
- Legal basis or consent route
- Access, retention, deletion, rights
- Countries and systems involved
The ICO's direct marketing guidance discusses planning, lawful basis, individual rights and electronic marketing under UK rules. Which provision applies depends on the recipient, channel and facts. Have the reviewer decide on the recorded use rather than copying a conclusion from a different campaign.
For named references, use the ICO's Direct marketing guidance, Guide to the UK GDPR, Guide to Privacy and Electronic Communications Regulations (PECR) and Lawful basis interactive guidance tool. Possible UK GDPR lawful bases include consent, contract where processing is necessary to perform it, and legitimate interests where appropriate; record why the chosen basis applies. For email or text marketing, check PECR: its soft opt-in is limited to a sender's own similar products or services marketed to existing customers or people who negotiated a sale, with an opt-out offered when details are collected and in each message.
Examine where the audience came from
Ask whether the advertiser collected the information, the agency sourced it, or a platform generated the segment. Retain the collection wording, date, notices, permissions, suppression process and any contractual limit. A segment name such as "interested buyers" does not disclose how people entered it.
Trace audience origin and purpose
- Identify who collected the audience
- Retain collection wording, date, notices
- Check permissions and suppression process
- Confirm contact use: message, match, exclude, model
- Verify objection reaches every destination
Check whether contact details are used to send a message, match an account, exclude existing customers or build a model. Those are distinct purposes. The agency should be able to remove suppressed people and explain how an objection reaches every relevant destination.
Review device access and measurement
Pixels, cookies, local storage, fingerprinting and similar methods require their own technical inventory. The ICO's guidance on storage and access technologies explains the UK framework and includes online advertising uses. Give the reviewer tag behaviour, purposes, vendors, firing conditions and consent signals.
The ICO's Guidance on the use of storage and access technologies is a named reference for checking the rules that apply to cookies and similar technologies. Assess PECR requirements alongside the UK GDPR review.
Tracking technology inventory
- Tag behaviour and firing conditions
- Purposes and vendors
- Consent signals before and after choice
- Evidence of configured production version
- Test what technology does, not labels
Do not rely on the wording "analytics" or "essential" in a user interface. Test what the technology does before and after a person's choice. Keep evidence of the configured production version. Global platform documentation may describe a switch, but it cannot decide whether the whole English campaign meets UK rules.
Control access and supplier changes
List named administrators, ordinary operators, service accounts and recovery contacts. Remove dormant access and agree who investigates an unexpected export. The NCSC's advice on using SaaS securely prompts UK organisations to examine authentication, logging, integrations and incident preparation. It does not certify any advertising supplier.
The controller determines the purposes and means of processing; a processor handles personal data on a controller's behalf. Set these roles for each activity and use a written controller-processor contract with the terms required by UK GDPR Article 28 where applicable. Keep Article 30 records of processing activities (ROPA) where required.
Require advance notice when the agency adds a processor or changes a data destination. Tie that notice to the campaign map, privacy review and contract change route. An unread supplier list on a website is not an operational approval.
For a restricted international transfer, record whether UK adequacy regulations cover the destination or rely on an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses (SCCs). Document the transfer risk assessment where required.
Decide whether work can start
Release only when the purpose is specific, roles are reasoned per activity, source evidence exists, tracking behaviour has been checked, rights can travel through the chain and deletion has an owner. Record unresolved transfer, profiling or special-category questions for qualified UK advice.
Assess whether a data protection impact assessment (DPIA) is required before high-risk processing; the UK GDPR requires one when processing is likely to result in a high risk to people's rights and freedoms. Systematic and extensive profiling with significant effects, and large-scale processing of special-category data, are examples of processing that can trigger that assessment. Tracking does not automatically require a DPIA, but assess its scale, purpose and impact.
At campaign close, follow the documented retention schedule and obtain evidence of return or deletion where the contract requires it. Verify the live account, tag manager, consent platform and data set before approval; this article has not reviewed a specific campaign.
Before you act
- Draw the data path before approving any audience or measurement plan.
- Create one row per activity, not a single campaign data entry.
- Retain collection wording, dates, notices and permissions for each audience.
- Inventory pixels, cookies and similar technologies with their purposes and vendors.
- List administrators, operators and recovery contacts, then remove dormant access.
- Record unresolved transfer or profiling questions for qualified UK advice.
Common questions
What should a campaign data map show?
It should show what enters, what is created, every party that receives the data and what leaves at the end. That gives a privacy reviewer something concrete to examine before spend begins, according to the article.
Why does a segment name not prove how people entered it?
A label such as interested buyers does not disclose how people entered the segment. The article says you should retain the collection wording, date, notices, permissions, suppression process and any contractual limit instead of relying on the name.
When can campaign work start?
Release only when the purpose is specific, roles are reasoned per activity, source evidence exists, tracking behaviour has been checked, rights can travel through the chain and deletion has an owner. Unresolved transfer, profiling or special-category questions go to qualified UK advice.
