UK GDPR
In practice, for a UK buyer
The paragraph above is the neutral answer. This is the part a vendor glossary leaves out.
For a media buyer the practical questions are which targeting involves personal data at all, on what basis, and for how long it is kept. Two of AdBuyMCP's seven channels — cinema and DOOH — involve no personal data in delivery and are recorded as outside scope rather than left to be inferred. Where personal data is involved, the compiled plan carries a manifest naming each source and its basis. Note what that is and is not: an engineering artefact that tells you what you still owe, not a compliance guarantee. This site does not claim to be UK GDPR compliant on your behalf.
Goes deeper: What a DPO will ask
What this one connects to
Most confusion in media buying comes from two adjacent terms being used interchangeably, so these are the neighbours worth reading next.
Lawful basis
The legal ground relied on to process personal data, of which six exist under UK GDPR and at least one must be identified before processing begins. In advertising the two that matter are consent and legitimate interests, and the basis has to be settled before the processing, not after.
Legitimate interests
A lawful basis permitting processing necessary for interests pursued by the controller or a third party, provided those interests are not overridden by the rights of the individual. Requires a documented balancing assessment.
Consent
A freely given, specific, informed and unambiguous indication that someone agrees to their data being processed. Must be as easy to withdraw as to give, and cannot be inferred from silence or inactivity.
Data Protection Impact Assessment (DPIA)
A structured assessment of the privacy risks of a processing activity, required where processing is likely to result in a high risk to individuals — which large-scale profiling for advertising generally is.
Lawful-basis manifest
A record attached to every compiled channel plan naming each data source used, the lawful basis it relies on, the conditions that come with it, and the warnings raised while compiling — produced automatically rather than assembled on request.
More on compliance and clearance
UK data protection and UK advertising clearance: what has to be true before an ad runs.
45 minutes. Bring a real brief and we compile it live. You describe one audience and watch it compile into seven targeting specifications, each with the score for how much of the definition survived.
Talk it through