Controller, processor and the house roles a retail media operation needs

Controller, processor and the house roles a retail media operation needs are three different things. The first two are legal classifications for organisations. The house roles are the posts a retailer's media arm fills. For an England retailer, this list names those posts and keeps them apart from the legal labels.

What to take away

Controller and processor: the two legal roles

The ICO's definitions of controllers and processors explain the difference between deciding purposes and means and acting on a controller's behalf. The ICO flags this guidance as under review following legislative changes. Assess the actual processing arrangement with qualified advice.

Neither term is interchangeable with campaign manager or supplier. Record the legal entity and the processing activity before allocating internal tasks.

Reporting lines and a simple org chart

Public material from Tesco Media and Insight Platform and Nectar360 describes client teams covering media sales, operations and measurement. Exact reporting lines vary by retailer, but the table below gives a usable starting point.

Headcount depends on whether the retailer sells onsite, offsite or both, campaign volume, and whether agency or ad-tech partners handle trafficking and measurement. A small network may cover several roles with one person. A large network may split them. The list sets no standard headcount.

How this non-ranked list was assembled

Research date: 6 September 2026. The list draws on the ICO, CAP Code and NCSC sources cited below. It covers England retail and marketplace advertising. Recruitment adverts, salary surveys and agency staffing ratios were excluded. Titles vary by retailer.

Head of retail media: owns the network

This is the senior commercial post in a retailer's media arm, such as Tesco Media and Insight Platform or Nectar360. The holder sets the rate card, picks the technology partners and answers for network revenue.

It suits someone from retail buying, agency trading or ad sales. Expect accountability for sell-through of onsite slots and for supplier contracts. Pay depends on network revenue, team size, location and whether the role carries sales targets. Advertised packages vary, so check current dated adverts.

Retail media account manager: runs brand campaigns

Brands and their agencies buy sponsored placements through platforms such as Amazon Ads, Criteo and CitrusAd, and this role is their day-to-day contact. The manager books campaigns, agrees targeting and reports delivery against the plan.

One manager usually covers several brand accounts. The post sits inside the network or inside the agency, and needs working knowledge of the platform's reporting.

Ad operations and campaign manager: traffics the ads

Line items, creative assets, flight dates, budgets and targeting rules are built in the platform by this person. They check that each placement renders as booked, and pause anything that breaks the site's advertising rules.

The post suits a detail-heavy operator who can read an ad server log. Keep it separate from the recognition owner below, who handles presentation questions rather than trafficking.

Inventory and yield manager: prices the slots

Sponsored product positions, homepage takeovers, display units and email slots each get a price. The yield manager tracks fill rate, CPMs and unsold inventory, then adjusts the rate card.

Experience in publisher yield or retail category trading fits the post. The role touches revenue figures, so it needs a clear handover with the finance team.

Measurement and analytics lead: works the clean room

Incrementality tests and clean rooms such as Amazon Marketing Cloud or Google Ads Data Hub supply the evidence that a campaign worked. This lead sets the definitions for impressions, clicks and attributed sales.

An analyst with SQL and experiment design skills fits the role. Results feed the evidence custodian below, who keeps security audit records apart from measurement exports.

Advertising-recognition owner: creative compliance reviewer

CAP Code section 2 requires identifiable marketing communications. This role gathers the rendered placement evidence and routes unresolved presentation questions to the appropriate advertising reviewer.

Define whether the holder can request corrections or must refer the issue instead.

Permission coordinator: consent and privacy lead

The ICO's advertising storage and access guidance covers consent and withdrawal across the processing chain. This role collects implementation evidence and keeps a route open to qualified privacy assessment.

Do not treat the administrative label as a data protection officer appointment. UK GDPR Article 37 requires a DPO only in set cases, such as large-scale systematic monitoring, and an external provider can hold the post. Record unanswered questions about requests, device activity and recipients. That ICO source gives no staffing norm.

Access custodian: identity and access administrator

The NCSC's identity and authentication guidance covers user access and service-credential lifecycles. This role keeps the retailer's authorisation record connected to operational access changes.

Describe which accounts and interfaces it covers, who approves privileges and who implements revocation. That is an allocation question. It is not evidence that any named service has weak authentication, or that one person should hold every privilege.

Evidence custodian: security audit lead

The NCSC's customer audit-information principle covers the records needed to investigate service activity. This role documents where those records are held and how authorised investigators obtain them.

Keep security audit evidence apart from campaign measurement exports. The role does not turn ad requests into rendered impressions, visibility into attention, or attributed sales into causal results. Those reporting interpretations need agreed definitions and review.

Fill the ownership gaps

Map each role to a real person and organisation, recording deputies and limits on authority. Leave unassigned work explicit until an accountable decision is made.

Common questions

What is the difference between a controller and a processor?

A controller decides why and how personal data is processed. A processor acts on the controller's behalf. The ICO's linked guidance explains the test. Get qualified advice on the actual arrangement.

Which roles does a retail media operation need?

Typical posts cover network leadership, brand account management, ad trafficking, inventory and yield, measurement, creative compliance, consent, access and audit. Titles vary, and one person may hold several roles.

Does the article recommend a team size or job titles?

No. Headcount depends on sales scope, campaign volume and which tasks are outsourced. The list names common responsibilities, not a fixed establishment.

What would an evidence custodian actually do?

They record where NCSC audit information sits and how authorised investigators get it. They keep security audit evidence separate from campaign measurement exports.