Rules and ethics
Part of The five kinds of authority a retail media launch must satisfy before release
Retail media data protection: a worksheet for purposes, roles and device access
Build a retail-media data protection worksheet for processing purposes, party roles and device access, with example entries and PECR regulation 6 checks.
Start a retail-media data protection worksheet with the proposed processing operation, not a broad label such as shopper insight. Describe what information would be used, for what purpose, by which parties and through which technology. Keep the assessment attached to that description as campaign plans change.
Define the worksheet's purpose
Use the worksheet to connect a proposed advertising activity with its privacy decisions. Give each processing purpose its own entry, and distinguish audience selection from measurement. Write down the questions that need a decision, the evidence to examine and the person responsible for resolving them before activation.
The lawful bases are set out in Article 6 of the UK GDPR. The ICO lawful-basis guidance says organisations should consider which lawful basis applies to each processing purpose and be able to justify the decision. Add that justification to the relevant entry rather than treating the campaign name as an answer.
Example: Retail media data protection worksheet
Illustrative example: a retailer and advertiser are considering audience selection and campaign measurement. Use the entries as questions for review, not as conclusions about either party's role or permission to process information. Replace the example activities with the operations actually proposed for the campaign.
| Example operation | Purpose to assess | Role or device question | Example review instruction |
|---|---|---|---|
| Purchase records used to select an audience | Audience selection | Who decides how the records will be used? | Describe the selection activity and assess each party's role. |
| An audience identifier passed between parties | Audience matching | What activity will the receiving party perform? | Compare the proposed use with the agreed instructions. |
| Information accessed on a user's device | Advertising delivery | What information is accessed, and by what method? | Assess the activity under PECR regulation 6. |
| Exposure records used to prepare a report | Campaign measurement | Who decides the reporting purpose and processing activity? | Assess the reporting purpose separately from audience selection. |
For each row, add the parties involved, the evidence examined and the decision reached. Keep unresolved questions visible rather than filling them with assumptions. Connect audience selection to the target audience plan, and allocate review work through the team roles record so someone owns each outstanding question.
Allocate responsibilities and instructions
Joint controllers must transparently determine their respective responsibilities for compliance, including data-subject rights and information duties. Put the allocation beside the operation it concerns. Carry the agreed responsibilities into the commercial contracts workstream, and check that the people handling requests can identify their assigned tasks.
A processor must process personal data in line with the controller's instructions, or it may be considered a controller itself. Describe the intended service and instructions together. During vendor due diligence, ask for a clear description of the proposed activity, rather than accepting a supplier label as the complete role assessment.
Check device activity under PECR regulation 6
The ICO cookies guidance says PECR regulation 6 applies to anyone who stores information on a user's device or gains access to information on that device, by any method. Describe the activity itself before assessing the consent question, rather than relying on the technology's name.
Regulation 6 requires consent from the subscriber or user. An exception applies to a cookie strictly necessary to provide an information society service requested by the subscriber or user. Cookies that are helpful or convenient but not essential, or essential only for the organisation's own purposes, still require consent.
Ask the supplier to identify what is stored or accessed and which proposed function depends on it. Add the consent decision and its reasoning to the worksheet. Carry the resulting questions into tool implementation, and keep unclear activity descriptions open for review rather than approving them by assumption.
Add assessment scope and an objection route
A single data protection impact assessment, or DPIA, may cover a set of similar processing operations that present similar high risks. Identify the operations covered by any assessment used for the campaign, and document why the proposed grouping matches that description before relying on it.
Individuals have an absolute right to object to processing their personal data for direct-marketing purposes. After receiving an objection, an organisation must not process that individual's data for that purpose. Individuals must be informed of their right to object at the latest at the time of the first communication with them.
For the worksheet, assign responsibility for receiving an objection and identifying the processing concerned. Test the handover with a fictional request before using the route operationally. Keep the outcome connected to the relevant purpose, so the person handling the request can see which activity needs action.
Review the completed worksheet before activation
Use a release review to examine the decisions attached to each operation, not merely whether every field contains text. Connect the worksheet to the operating workflow, and assign an owner to any unresolved question. Pause the affected activity while that question is assessed and resolved.
- Each processing purpose has a description and a justified lawful-basis decision.
- Party responsibilities and relevant processing instructions have been examined.
- Device storage or access has a documented PECR regulation 6 assessment.
- Any DPIA identifies the operations it covers.
- The direct-marketing objection route has an owner and an action record.
Revisit the worksheet when the proposed purpose, parties, instructions or technology changes. Compare the revised activity with the decisions already recorded, and reopen any question affected by the change. Keep the supporting evidence beside the decision so a reviewer can examine the reasoning without reconstructing the campaign.
