Rules and ethics
Part of Marketing attribution rules and ethics: UK checks
Attribution contracts, clause by clause, from data roles to exit
Review attribution contracts through a dated, non-ranked evidence list covering scope, data, models, charges, continuity and exit before signing.
Method: desk review of UK legislation and official ICO, NCSC and HMRC material available on 6 September 2026, covering buyer-side clauses in an England attribution contract. No supplier funded this draft; this is not legal, tax or procurement advice.
What to take away
- Map processing operations before you accept a role label; factual purposes and means decide whether a vendor is a controller or a processor.
- Put numbers on the clock for sub-processor notice, audit cadence, incident reporting and deletion, and attach the exhibit behind each one.
- Version the attribution method and the acceptance dataset, and hold the signature while any item stays unresolved.
Before you act
- Name each legal party, product, edition and territory.
- Attach buyer-authored acceptance tests with named evidence.
- Record sub-processor approval routes and notice periods.
- Separate pre-existing software from campaign inputs and derived reports.
- Define notification events, contacts and recovery tests.
- Test export schema and deletion proof.
Parties, product and the measurable service
Name each legal party, product, edition, account, territory and incorporated document. Describe the service in observable terms: inputs accepted, attribution method, outputs and excluded channels. Buyer-authored acceptance tests belong in a schedule, with the evidence each produces.
Example order-form entry. Model: position-based, last non-direct 40 per cent of credit. Method version 3.2, frozen for acceptance. Acceptance dataset: 12 months of order data as CSV.
Compare how rival methods treat the same order before signing, as shown in attribution methods on one evidence grid.
Data roles and instructions
Map the processing operations first. The ICO's controllers and processors guide states that factual purposes and means determine roles, and is marked under DUAA review at the research date. A vendor that only hosts your data sits as a processor; one that sets its own purposes for benchmarking may be a controller.
Example clause. The supplier processes customer personal data only on documented instructions, and does not use it to train models for other customers.
Where the supplier is a processor, compare the drafting with the ICO's Article 28 contract guidance, also under review.
Sub-processors, transfers and audit
Record the approval route, the objection window, the sub-processor list, their locations, support access and flow-down duties. For access from outside the UK, apply the ICO's international transfers guidance to that flow. State what audit information arrives and how often.
| Clause | Illustrative figure | Evidence to attach |
|---|---|---|
| Sub-processor change notice | 30 days | Dated sub-processor list |
| Audit information | One report a year | Report scope and expiry |
| Incident notification | 24 hours | Named contacts and route |
| Deletion after exit | 30 days | Written deletion confirmation |
These figures are drafting starting points, not legal requirements.
Intellectual property and model use
Separate pre-existing software, campaign inputs, identity data, model features, derived reports, configuration and improvements. The Copyright, Designs and Patents Act 1988 places first ownership with the author (section 11) and lists the restricted acts in section 16. Section 9(3) treats the person arranging a computer-generated work as its author; sections 50A and 50B cover decompilation and observation.
Example clause. The customer retains all rights in campaign inputs; the supplier retains all rights in the platform and model features. Feedback may improve the service only in aggregated form.
If model outputs drive automated decisions, work through the error checks in testing AI attribution for error.
Security, incidents and continuity
Set controls for access, authentication, encryption, logs, vulnerability handling, backup and recovery. The NCSC's SaaS security guidance is a review framework, not a warranty. Name the notification event, the recipient, the information required and the recovery test. Add a manual reporting route if the platform is down.
Changes, acceptance and support
Identify who may change the model, a connector, the terms or a usage limit, and what notice follows. Version the method and the acceptance dataset so drift is visible. Support wording should give channels, hours, response clock, exclusions and remedy.
Fees, tax and liability
Record currency, VAT status, unit of charge, billing period, minimum term, usage thresholds, overage, renewal, indexation and exit assistance. VAT depends on the place of supply and the buyer's status, so check HMRC's VAT guidance for businesses against the draft invoice. Liability caps and indemnities need commercial judgement.
Test any performance figure in the sales deck against checking an attribution-based advertising claim before it reaches a signed schedule.
Export, deletion and termination
Test the export before signing: format, schema, identifiers, history length, model metadata and timing. Define termination triggers, transition assistance, the access window, return, deletion and written proof. Assign an owner who rehearses restoration into a buyer-controlled environment.
Common questions
Who decides these points?
A named England and Wales commercial solicitor, a privacy practitioner, an IP lawyer, a security reviewer, a procurement lead and a tax adviser. They apply the material to the actual order form, plan and schedules.
What decides whether a vendor is a controller or a processor?
The ICO controllers and processors guide states that factual purposes and means decide roles. It is marked under DUAA review at the research date, and the Article 28 contract guidance is under review too.
How long should notice and deletion periods be?
There is no single statutory figure. The illustrations above are a 30 day sub-processor notice, one audit report a year, 24 hours for incident notification and 30 days for deletion.
What if one item stays unresolved?
Hold the procurement decision. Do not offset a missing export test or an unverified role with a better feature elsewhere.
