Turning retail media inventory, access and data needs into one supplier requirement

Retail media software selection should begin with a service specification that competing suppliers can interpret the same way. For an England retailer or marketplace, describe the controlled advertising inventory and the data operations to be supported. Selecting by the longest feature list leaves too much of the proposed operating model unstated.

This guide offers a requirements method researched on 6 September 2026. It contains no hands-on product assessment, software score or purchasing verdict. No named supplier products, no product scores and no prices appear in it, so no product comparison can be drawn from these pages.

Privacy and contractual interpretations need qualified UK review; the method is not legal advice and does not establish compliance.

What to take away

Define the first operating task

Choose the task the retailer needs to carry out, such as administering paid product positions on its own website. State who books the campaign, approves its creative and resolves advertiser queries. Keep later ambitions outside the initial requirement unless they are necessary to the purchase decision.

Write the boundary between your systems and the service. Identify the catalogue owner and the destination for campaign reports. Ask whether your team expects an ad decision, a rendered placement or a managed operational service. The specification should make that distinction before a demonstration is arranged.

Use one requirement per row, with a reason and an evidence request. Record excluded activities too. General social advertising or independent publisher inventory should not enter this exercise unless its role is part of the retailer-controlled service you have defined.

Separate necessary behaviour from preferences

Mandatory requirements should have a named owner who can decide whether the evidence satisfies them. Preferences can support a later trade-off. Avoid combining the two into an invented overall score that allows a desirable dashboard to offset an unresolved access-control issue.

For each behaviour, state the condition and expected response. A catalogue update request might ask how an unavailable product stops being eligible for promotion. A reporting request might specify the required fields and correction procedure. These are proposed assessment tasks, not claims about features already verified in a product.

Three worked example rows show the shape. Replace each condition with your own.

Specify access before adding users

The NCSC identity and authentication principle describes authenticated and authorised access as a cloud-security objective. Turn that guidance into questions for the proposed retailer administration, advertiser accounts and service identities.

Ask the procurement lead to check who can change budgets, approve assets and export information. Include the removal of departed staff and the management of automated credentials. Require evidence for the actual configuration rather than treating a product's ability to support a control as proof it will be enabled.

Make the data requirement explicit

Use the ICO advertising guidance when assessing storage and access technologies used for advertising. Its consent requirement should inform the technical specification, including how withdrawal reaches the affected operation.

Separately describe any personal information used for targeting or measurement. Ask the privacy specialist to determine purposes and roles before approving transfers to a demonstration environment. A suggested safe starting point is synthetic test material, clearly identified as such, with no claim that it represents observed shopper behaviour.

Ask every supplier for the same response

Send the identical scope, operating assumptions and evidence questions to each candidate. Request an explicit distinction between included functions, optional modules and work your team must undertake. Record unanswered questions without assuming either capability or incapability.

Keep quotations in GBP for a shared service period, with usage definitions and VAT treatment visible. Do not compare totals where one includes implementation and another excludes it. This guide provides no pricing evidence; the quantities and contractual rates must come from the actual procurement.

Where a longlist comes from varies by retailer. Candidates usually arrive through existing platform or agency relationships, recommendations from peer retailers, sector trade directories, or published procurement frameworks. This guide names none of them.

Public sector procurement in England also runs under the Procurement Act 2023, which took effect on 24 February 2025. Check whether a framework route or a published notice applies before you approach suppliers.

A short RFI skeleton has six parts: inventory and scope, operating roles, access control, data and consent, integration and reporting, and commercial terms.

Illustrative questions include who approves creative, which roles can change a budget, how a consent withdrawal reaches the audience, which reporting fields are standard, and whether a quotation covers implementation. Send one identical list and log each answer against a requirement row.

Decide what evidence is still missing

End the selection stage with a requirements disposition, not a promotional summary. Identify which rows were demonstrated, documented, rejected or left open. Record the version and date of the product evidence so a later release cannot quietly inherit an earlier assessment.

Only advance a candidate when the responsible owners can explain the remaining conditions and the next validation step. Before publication or use in a future buying exercise, refresh the cited guidance and arrange named editorial and specialist sign-off.

Before you act

Common questions

What should a retail media software selection begin with?

It begins with a written requirement, not a feature comparison. Set out the task, the condition and the evidence you will accept as rows. Scope the retailer's own advertising inventory and the data operations inside it, and keep anything else out.

How should access controls be specified?

Give each control a testable condition and a named owner. For budget changes, ask for the role configuration and one audit entry naming the approver. Cover departed staff and automated credentials. Treat a supported control as unproven until the live configuration is shown.

What should be done with supplier responses?

Compare like with like. Ask each candidate to separate included functions, optional modules and work your own team must do. Require GBP quotations for the same service period, with usage definitions and VAT treatment stated. Keep unanswered questions open rather than treating silence as either capability or incapability.