Rules and ethics
Part of Marketing attribution rules and ethics: UK checks
Mapping personal data and device tracking in an attribution setup, row by row
Map personal data, device tracking, roles, rights, transfers and retention for an England marketing attribution configuration and supplier decisions.
Attribution data protection starts with a configured journey, not a generic analytics label. Map what is collected from whom, how identifiers join, why each operation happens and who receives the result.
Evidence was checked through 6 September 2026. The guide does not choose a lawful basis and is not legal advice. Named UK privacy, PECR, legal, security and accessibility reviewers must decide the real case.
What to take away
- Map each attribution operation as a separate row with purpose, data fields, recipients and deletion evidence.
- Device storage or access needs a PECR check before you assess the separate UK GDPR processing.
- Controller and processor roles follow the facts and can differ between measurement, security and product development.
- Link the data map to the notice version shown at collection and define deletion across logs, models and suppliers.
- Privacy approval cannot compensate for weak security, inaccessible rights routes or misleading claims.
Draw one row per operation
Separate page measurement, campaign matching, identity resolution, audience creation, model training, fraud checks and reporting. For each row record purpose, data fields, source, people affected, collection time, recipients, storage location, retention trigger and deletion evidence. Keep anonymous aggregate data distinct from personal or pseudonymous records; replacing a name with an identifier does not necessarily take data outside the UK GDPR.
Document the minimum fields genuinely needed. Necessity should be shown, not asserted. The Data Protection Act 2018 sits alongside the UK GDPR and includes additional national provisions. Territorial and sector questions belong with a qualified lawyer.
Review device access before later processing
A pixel, tag, script or fingerprinting technique may store or access information on terminal equipment. The ICO's storage and access technologies guidance was finalised on 29 April 2026 following DUAA changes. It explains PECR consent and exceptions. Assess the exact technology, purpose and user interaction. A first-party domain or server-side route is not by itself an exception.
Then examine the separate UK GDPR processing. Record possible lawful bases, necessity analysis, any consent evidence, transparency wording and the reviewer's decision. Do not select legitimate interests, consent or another basis for every attribution use by default.
Assign roles from decisions
Identify who determines purposes and essential means for each operation. Buyer and supplier roles can differ between measurement, support, security telemetry and supplier product development. The ICO's controller and processor guide says roles follow the facts. As of the research date, it is marked under review after the Data (Use and Access) Act 2025, so record that limitation.
Where a processor acts on instructions, assess Article 28 terms, sub-processor control, rights support, security assistance, audit information and end-of-contract return or deletion. Contract wording cannot convert independent purposes into instructed processing.
Design for people and change
Link the data map to the notice version shown at collection. Provide routes for access, correction, objection, erasure and other applicable rights. Retain evidence of suppression where needed without keeping unrelated campaign histories indefinitely. Define deletion across raw logs, identity tables, model features, exports, backups and suppliers.
Profiling or automated use requires its own check. The official DUAA explanatory notes describe the amended Article 22A to 22D framework for solely automated decisions with legal or similarly significant effects. Whether an attribution-derived action meets that test depends on the actual effect and meaningful human involvement.
Assess whether a DPIA is required before processing likely to create high risk. The ICO's DPIA guidance is currently marked for post-DUAA review. Preserve the status, unresolved risks, consultation decisions and approval date.
Check recipients, transfers and security
List every sub-processor, remote support team and export destination. The ICO's international transfers guide, updated 15 January 2026, sets out a three-step analysis. Do not infer the answer from a supplier's regional hosting label.
Finally, test least privilege, authentication, logs, incident escalation, recovery and deletion proof. Privacy approval cannot compensate for weak security, inaccessible rights routes or misleading claims. Reopen all cited pages, under-review notices and the actual supplier records when the system, purpose or publication date changes.
Before you act
- Draw one row per operation with purpose, fields, recipients and retention.
- Check device access against PECR before later processing.
- Assign controller and processor roles from the facts.
- Link the data map to the notice version shown.
- List every sub-processor and export destination.
- Test least privilege, logs, recovery and deletion proof.
Common questions
What should each row of the data map record?
Record purpose, data fields, source, people affected, collection time, recipients, storage location, retention trigger and deletion evidence. Keep anonymous aggregate data distinct from personal or pseudonymous records, because replacing a name with an identifier does not necessarily take data outside the UK GDPR.
Does a first-party domain or server-side route avoid PECR consent?
No. A pixel, tag, script or fingerprinting technique may store or access information on terminal equipment, and the ICO guidance explains PECR consent and exceptions. Assess the exact technology, purpose and user interaction. A first-party domain or server-side route is not by itself an exception.
When is a DPIA required for attribution processing?
Assess whether a DPIA is required before processing likely to create high risk. The ICO DPIA guidance is marked for post-DUAA review. Preserve the status, unresolved risks, consultation decisions and approval date. Profiling or automated use also requires its own check under the amended Article 22A to 22D framework.
