Compliance and clearance
What is a lawful basis under UK GDPR?
Free, with no card. We read your homepage, draft who buys from you and show your monthly price before you join the waitlist. Nothing is bought until you've approved the plan and the ads.
what it means here
Here is what the term means for a UK buyer
The definition above holds anywhere. Buying media in the UK adds the detail below, including where AdBuyMCP does something different.
Different segments in the same media plan can rely on different bases, which is why recording it per segment is the useful granularity and per campaign is too coarse. AdBuyMCP's policy engine assigns a basis per data source and attaches the condition that comes with it: a framework-validated supply chain for consent-chained sources, a completed assessment on file for legitimate-interest ones.
Which lawful bases apply to advertising?
UK GDPR sets out six: consent, contract, legal obligation, vital interests, public task and legitimate interests. Advertising targeting relies almost entirely on the first and the last. Consent is usually collected upstream by a publisher or a data vendor and passed down the chain as an encoded string. Legitimate interests needs a documented three-part assessment of purpose, necessity and balance, completed before the processing starts.
Some inputs involve no personal data at all. Cinema audience packs, out-of-home venue types, postcode polygons and your own search terms are aggregate or buyer-authored, which is why cinema's manifest is the shortest in the catalogue.
How does AdBuyMCP record the lawful basis?
Every compiled channel plan carries a lawful-basis manifest naming each data source, the basis it relies on, the conditions that come with it and any warnings raised while compiling. A consent-chained source carries the condition that the supply chain be framework-validated and the vendor attestation verified on connection. A legitimate-interests source carries the condition that an assessment is on file.
The manifest records what you still owe, and it is written for your data protection officer to read. Deciding whether legitimate interests fits your processing stays with you, and turning the manifest's conditions into enforced launch gates is work that is not finished.
Type your company website or work email to see who we think buys from you and what reaching them 3, 5 or 12 times a week would cost.
Free, with no card.
related terms
These terms sit next to this one
Most confusion in media buying comes from two adjacent terms being used interchangeably, so these are the neighbours worth reading next.
UK GDPR
The United Kingdom's data protection regime, retaining the structure of the EU General Data Protection Regulation. Requires a lawful basis for processing personal data and gives individuals rights over data about them.
Legitimate interests
A lawful basis permitting processing necessary for interests pursued by the controller or a third party, provided those interests are not overridden by the rights of the individual. Requires a documented balancing assessment.
Consent
A freely given, specific, informed and unambiguous indication that someone agrees to their data being processed. Must be as easy to withdraw as to give, and cannot be inferred from silence or inactivity.
Legitimate Interests Assessment (LIA)
The documented three-part test of purpose, necessity and balancing that underpins any reliance on legitimate interests. It must be completed and retained before an organisation may rely on legitimate interests as its lawful basis for processing personal data.
Lawful-basis manifest
A record attached to every compiled channel plan naming each data source used, the lawful basis it relies on, the conditions that come with it, and the warnings raised while compiling. The compiler writes it automatically as it builds the plan.
same group
These terms are also in Compliance and clearance
UK data protection and UK advertising clearance: what has to be true before an ad runs.