In brief
- Regulation: GDPR.
- Agencies, media networks, advertisers and influencer marketing players are concerned, often as joint controllers.
- Establish and inform.
- Framing data partnerships.
- Verifying the origin of files.
- Fines of up to €20M or 4% of global turnover.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
GDPR governs prospect databases, audience data and partnerships between advertisers, ad networks and platforms. Roles must be clearly defined (joint controllership is common) and the origin of data files must be verified.
Influence involves audience and creator data that must be governed.
Is the 'Marketing & advertising' sector concerned?
Agencies, ad networks, advertisers, and influencer marketing players are all affected, often as joint controllers. Platforms and data providers act as controllers or processors depending on the context.
Creators and their audiences are data subjects.
Detailed obligations
Establish grounds and inform
Define legal bases and information requirements for prospects and audiences.
Framing data partnerships
Clarify roles and sign agreements (DPA, joint controllership).
Verify the origin of files
Controlling the origin and legal basis of the files being processed.
Govern influencer activity
Protecting the data of audiences and creators.
Secure and limit
Security and appropriate retention periods.
Sanctions & risks
Fines of up to €20M or 4% of global turnover. Exploiting files of dubious origin and unregulated data partnerships are major risks.
Common mistakes in the sector
- 1Suspicious files. Using data of unverified origin.
- 2Unclear roles. Fail to clarify data partnerships.
- 3Unregulated influence. Neglect audience data.
- 4Excessive retention. Retaining files for too long.
Practical case
An advertiser was using files from partnerships without clarifying roles or verifying their origin. The remediation process formalises roles and DPAs, verifies data provenance, and governs influence data.
Compliance roadmap
- 1
Map. Mapping files, audiences, and partnerships.
- 2
Clarify roles. Define responsibilities and DPA.
- 3
Verify the origin. Control the origin of files.
- 4
Govern influencer activity. Protect the data.
- 5
Document. Maintain the register.
Frequently asked questions
Yes, by clarifying roles (sometimes joint controllership) and governing data flows.
Take action on GDPR
Free assessment or a chat with an expert dedicated to marketing & advertising.
They already trust us
See how organisations in the marketing & advertising sector secured their compliance with DCO.