Controller, processor and the house roles a retail media operation needs

Retail media team roles should identify who makes decisions about controlled advertising inventory and its data operations. They do not establish a standard headcount. For an England retailer, distinguish proposed internal responsibilities from the legal roles of organisations processing personal data.

How this non-ranked list was assembled

The research date is 6 September 2026. Entries were included where a directly inspected regulator, advertising-code or security-guidance record supports a responsibility relevant to the retailer's operation. The order follows responsibility types, not importance, seniority or a hiring recommendation.

The scope is England retail and marketplace advertising, using UK sources where their coverage applies. Recruitment adverts, salary surveys, agency staffing ratios and unrelated media-buying occupations were excluded. This is not an exhaustive staffing model; the research did not establish customary job titles or team size.

The controller and processor entry concerns external legal classifications. All other labels below are proposed house responsibilities. Their sources support the underlying subject, not a requirement to employ someone with that title. No ranked or paid inclusion is offered; publisher commercial relationships still require confirmation.

Controller and processor: organisation-level roles

The ICO's definitions of controllers and processors explain the distinction between deciding purposes and means and acting on a controller's behalf. The ICO flags this guidance as under review following legislative changes. Assess the actual processing arrangement with qualified advice.

These classifications are not interchangeable with campaign manager or supplier. Record the relevant legal entity and processing activity before allocating internal tasks. The list makes no finding about whether a particular retailer or ad-tech provider is a controller, joint controller or processor.

Advertising-recognition owner: house responsibility

CAP Code section 2 requires identifiable marketing communications. A proposed recognition owner would gather the rendered placement evidence and route unresolved presentation questions to the appropriate advertising reviewer.

This label does not create a statutory profession or transfer the marketer's responsibilities. Define the person's decision authority, including whether they can request corrections or must refer the issue. No claim is made that a dedicated post is necessary for every retailer.

Permission coordinator: house responsibility

The ICO's advertising storage and access guidance addresses consent and withdrawal across relevant processing chains. The proposed coordinator would collect implementation evidence and maintain the route to qualified privacy assessment.

Do not treat this administrative label as a data protection officer appointment. The person would record unanswered questions about requests, device activity and recipients, rather than independently certify the service. The source supplies no staffing norm for that work.

Access custodian: house responsibility

The NCSC's identity and authentication guidance covers user access and service-credential lifecycles. An access custodian is a proposed owner for keeping the retailer's authorisation record connected to operational access changes.

Describe which accounts and interfaces the responsibility covers. Identify who can approve privileges and who implements revocation. This is an allocation question, not evidence that any named service has weak authentication or that one person should hold every privilege.

Evidence custodian: house responsibility

The NCSC's customer audit-information principle concerns records needed to investigate service activity. A proposed evidence custodian would document where those records are available and how authorised investigators obtain them.

Keep security audit evidence distinguishable from campaign measurement exports. The role does not turn ad requests into rendered impressions, visibility into attention, or attributed sales into causal results. Those reporting interpretations need appropriate definitions and review.

Fill the ownership gaps

Map these responsibilities to real people and organisations, recording deputies and limits on authority where relevant. Leave unassigned work explicit until an accountable decision is made. Before publishing this list, obtain named editorial and qualified review; it is a desk-researched allocation aid with no interviews, observed staffing study or operational endorsement.