procedure

Check a lawful-basis manifest

The manifest lists the conditions you still have to meet.

Every compiled channel plan carries a lawful-basis manifest: each data source used, the basis it relies on, the conditions attached to that basis, and any warnings raised while compiling. It exists so the answer to "where did this audience come from?" is a document rather than a conversation. Read it as a record of what remains to be done: it certifies nothing, and the conditions in it are obligations on you.
steps
5
things needed first
2
roughlyFifteen minutes
Get my plan and price Book a 30-minute call with the founder

Free, with no card. We read your homepage, draft who buys from you and show your monthly price before you join the waitlist. Nothing is bought until you've approved the plan and the ads.

what you need

You need these before you start

  • A compiled plan for at least one channel
  • Knowing who in your organisation owns data protection decisions, because some conditions are theirs to satisfy

the procedure

The procedure has five steps

Every step comes with a note on what commonly goes wrong there.

  1. step 01

    Check which channels are in scope at all

    Cinema and DOOH delivery involve no personal data (venue catchments, OpenOOH venue types, postcode polygons and dayparts), and the compiler records them as outside UK GDPR scope rather than leaving it to be inferred. Movement data is not in that list because none reaches the product: AdBuyMCP holds no movement-data licence, so the screen-ranking list the compiler emits is empty.

    what goes wrong here

    Outside scope describes the delivery. What was used to choose it can still carry a basis. Cinema's manifest really is outside scope throughout, but a DOOH plan that references a consent-attested segment still carries that segment's basis, and the manifest names the provider that attested it. Read it rather than assuming both channels are clear.

  2. step 02

    Read the basis for each source

    Different segments in the same plan can rely on different bases. The manifest records one per source: consent-chained, legitimate interests, or outside scope.

    what goes wrong here

    Per-campaign is the wrong granularity and is how a single non-compliant source hides inside an otherwise clean plan.

  3. step 03

    Read the conditions as a to-do list

    A consent-chained source attaches a condition that the supply chain must be framework-validated and the vendor attestation verified on connection. A legitimate-interests source attaches a condition that an assessment must be on file.

    what goes wrong here

    A manifest that lists a condition is telling you the work is still outstanding on your side.

  4. step 04

    Read the warnings

    Low-confidence segment matches, unmapped geographies and excluded segments that could not be expressed natively all raise warnings that stay attached to the compiled plan.

    what goes wrong here

    A warning that a persona exclusion could not be expressed on a channel is the one most likely to matter to a brand-safety reviewer, because it means the exclusion is not enforced there.

  5. step 05

    Take it to whoever owns the decision

    The manifest is designed to be the thing you hand a DPO rather than a summary you write for them. It names providers, bases, conditions and warnings in one place.

    what goes wrong here

    The manifest makes no judgement on whether legitimate interests is appropriate for your processing. Somebody has to make and document that assessment.

what you end up with

A written record of what made each targeting decision lawful, and an explicit list of the conditions still outstanding on your side.

other procedures

You might need these procedures next

Talk your market and your plan through with James Rooney, who built AdBuyMCP and wrote its code.

Book a 30-minute call with the founder

These questions come up when you check a lawful-basis manifest

Does a lawful-basis manifest make me compliant?

No. It records which data was used, on what basis, and what conditions come with it. That is the raw material for a compliance argument rather than the argument itself. Turning these conditions into enforced launch gates is unfinished work, and AdBuyMCP makes no claim of UK GDPR compliance on your behalf.