Operations
Part of Marketing attribution operations: a controlled workflow
What a marketing attribution launch review must evidence
A marketing attribution launch review record for England: the ten evidence rows, the UK GDPR and PECR checks, and why missing evidence means HOLD.
Verdict: HOLD. This is the record a marketing attribution launch review has to fill before go-live, shown on a proposal that arrived with no evidence. No actual marketing attribution launch was supplied, so there is no evidential basis for approval, rejection of a named product or claim about readiness. The useful output is the review record itself: ten evidence rows, the legal checks behind them, and what each row must contain before the verdict can move.
What to take away
- No attribution launch was supplied, so the review holds with no evidential basis for approval.
- An empty evidence cell cannot count as a pass in any launch review.
- Causal claims need more than a working pipeline, as QPIE guidance explains.
- Privacy, security, accessibility, statistics and contract review are separate gates that cannot compensate for each other.
- The verdict must state what was not tested and when the evidence expires.
Review disclosure
Named reviewer status: no reviewer has been assigned. Before any launch decision, assign a named accountable business owner plus qualified UK privacy and PECR, security, accessibility, statistics or evaluation, commercial-contract and legal reviewers.
Review subject: an unspecified attribution service proposed for operation in England. No legal entity, supplier, service, edition, account, environment, data source, event schema, identity rule, model, contract or decision use was provided.
Review date: 6 September 2026. Method: desk review of the evidence fields a launch record would need, checked against current official guidance. Fixtures: none supplied or executed. Hands-on boundary: no interface, API, connector, tag, pixel, pipeline, export, deletion, rollback or recovery step was accessed or tested. Conflicts: no supplier funded the draft, and there are no affiliate links, samples or commercial relationships to disclose.
Evidence record
| Review area | Evidence received | Review status |
|---|---|---|
| Decision and attribution job | None | Unperformed |
| Event, identity and metric dictionaries | None | Unperformed |
| Data authority and purpose map | None | Unperformed |
| Product and contract record | None | Unperformed |
| Synthetic or authorised fixtures | None | Unperformed |
| Query, model and configuration versions | None | Unperformed |
| Reconciliation and exception results | None | Unperformed |
| Accessibility task evidence | None | Unperformed |
| Security logs and incident rehearsal | None | Unperformed |
| Rollback, export, deletion and recovery proof | None | Unperformed |
An empty cell cannot count as a pass. The absence of adverse evidence is not evidence that a control works.
Evidence record: all unperformed
- Decision and attribution jobnone
- Event, identity and metric dictionariesnone
- Data authority and purpose mapnone
- Product and contract recordnone
- Synthetic or authorised fixturesnone
- Query, model and configuration versionsnone
- Reconciliation and exception resultsnone
- Rollback, export, deletion and recovery proofnone
What a real review must observe
The review should begin with one declared job: platform credit allocation, cross-system reconciliation, MMM, experiment or incrementality support, or general analytics. It needs a decision owner, population, geography, period, timezone, numerator, denominator or unit, late and duplicate rules, refunds, missingness, source versions and permitted wording.
What a real review must observe
- Declare one jobcredit allocation or incrementality
- Fix owner, population, geography, period, timezone
- Define numerator, denominator, late and duplicate rules
- Examine personal-information lifecycle and access configuration
- Run synthetic fixtures through accepted, rejected, duplicate, deleted states
- Have a second competent person reproduce the output
For personal-information processing, the reviewer should examine the actual lifecycle and access configuration. The ICO's data protection by design guidance discusses minimisation, access and lifecycle controls. It does not clear a specific launch. Device storage or access needs a separate purpose-specific check against the ICO's final storage and access technologies guidance.
The team should run synthetic fixtures through accepted, rejected, duplicate, late, unmatched, corrected and deleted states. A second competent person should reproduce the output from the recorded input and code or query version. Causal language needs more than a successful pipeline: HM Treasury's QPIE guidance explains, in a public-policy context, why monitoring alone cannot establish an intervention's effect.
Security evidence should cover least privilege, change records, protected logs, alerts, incident contacts and restoration. The NCSC's cloud audit guidance supplies buyer questions, not assurance about an unexamined service.
The legal checks behind the privacy rows
An attribution service in England that joins events to people processes personal information, so the privacy rows are checked against the UK GDPR and the Data Protection Act 2018. Tags, pixels and other device storage or access are a separate question under the Privacy and Electronic Communications Regulations (PECR), which is why the record keeps PECR as its own gate.
Three documents should sit in the evidence packet before those rows can pass:
- Data protection by design.The ICO's guidance on data protection by design and by default says it starts at the initial planning stages of any system, service, product or process and continues throughout its lifecycle. For a launch, that means the purpose map and minimisation decisions are dated before the first tag fires.
- A DPIA.The same guidance calls DPIAs an important part of how you apply data protection by design and by default, and says it is good practice to complete one whatever the risk level. An attribution model that profiles customers across channels belongs in one.
- The data protection fee.Under the Data Protection (Charges and Information) Regulations 2018, organisations that use personal information need to pay a data protection fee to the ICO unless they are exempt. The record should hold the controller's ICO registration reference, and the supplier's where it acts as a separate controller.
Conditions for a later verdict
Replace every unperformed row with a dated source, named owner, method, observation, limitation and reviewer decision. Record failures without hiding them inside an overall score. Privacy, PECR, security, accessibility, statistical validity and contract review are separate gates; strength in one cannot compensate for failure in another.
The later verdict may approve a bounded use, require repair or keep HOLD. It must state what was not tested and when the evidence expires. Until a real service and evidence packet exist, this launch review remains unperformed.
Before you act
- Assign a named accountable business owner before any launch decision.
- Declare one job, such as credit allocation or incrementality support.
- Run synthetic fixtures through accepted, rejected, duplicate and deleted states.
- Have a second competent person reproduce the output from recorded inputs.
- Record failures without hiding them inside an overall score.
- State what was not tested and when the evidence expires.
Common questions
Why is the verdict HOLD rather than approval or rejection?
No actual marketing attribution launch was supplied, so there is no evidential basis for approval, rejection of a named product or any claim about readiness. The review record is empty, showing exactly what remains unperformed. Until a real service and evidence packet exist, the launch review stays unperformed.
What must a real attribution review observe first?
It should begin with one declared job, such as platform credit allocation, cross-system reconciliation, MMM, experiment or incrementality support, or general analytics. It needs a decision owner, population, geography, period, timezone, unit, late and duplicate rules, refunds, missingness, source versions and permitted wording.
What evidence should security and causal claims rest on?
Security evidence should cover least privilege, change records, protected logs, alerts, incident contacts and restoration. The NCSC cloud audit guidance supplies buyer questions, not assurance about an unexamined service. Causal language needs more than a successful pipeline, because monitoring alone cannot establish an intervention's effect.
