Rules and ethics
Part of Advertising creative tools rules and ethics
Advertising creative tools data protection: where data travels
A data-flow map for advertising creative tools data protection: the quiet copies, the ICO guidance and the supplier checks to make before launch.
What to take away
- Map each advertising creative tools data protection flow by purpose, including caches, version histories, support access and supplier backups.
- Separate research interviews from targeting and measurement, and check PECR for cookies and similar technologies.
- Assign supplier roles from what the vendor actually decides and does, not from contract labels.
- Release only the minimum material needed, using synthetic placeholders where real data adds no value.
- Plan correction and deletion before launch, because deleting a prompt may not remove a published output.
Draw the flow, including the quiet copies
Begin with collection and follow the material through transcription, upload, generation, review, export, publication, measurement, archive and deletion. Add caches, version histories, support access and supplier backups. For each location, note the data fields, purpose, people affected, controller, processor or other recipient, access group and retention decision.
An interview recording goes to a transcription service such as Otter.ai or the built-in transcription in Zoom or Microsoft Teams, creating a transcript file in cloud storage such as Google Drive, Dropbox or Microsoft 365. A designer imports a quote into a design tool such as Adobe Photoshop, Figma or Canva, adding a version history entry. The published asset sits in a digital asset management (DAM) system such as Adobe Experience Manager Assets, Bynder or Brandfolder, and a retargeting identifier feeds an audience in an ad platform such as Google Ads, Meta Ads Manager or LinkedIn Campaign Manager.
Quiet copies include the transcript file held inside the transcription tool, version history entries and comment threads in the design tool, thumbnail and preview renditions in the DAM, and the matched audience, pixel events and conversion records held in Google Ads, Meta Ads Manager or Google Analytics 4.
Data journey with quiet copies
- Collection
- Transcription
- Upload
- Generation
- Review
- Export
- Publication
- Measurement
- Archive
- Deletion
The ICO's data protection principles guide places lawfulness, fairness and transparency alongside purpose limitation, minimisation, accuracy, storage limitation, security and accountability. Its current warning that guidance is being reviewed after the Data (Use and Access) Act makes a dated legal check particularly important.
Set retention by purpose. A raw interview recording might be deleted after transcription is verified, while campaign measurement data might be kept for the reporting window. Record the period for each data type in your record of processing activities, check it against the ICO's storage limitation guidance, and review it at launch.
Separate research from targeting
Customer interviews can inform a brief without exporting identities into production. Use participant codes in working notes, restrict raw recordings and decide whether quotations or images may be used publicly. Removing a name does not necessarily anonymise a distinctive story or face.
Research vs targeting
Research
- Identities
- Use participant codes
- Raw material
- Restrict recordings
- Public use
- Decide quotations or images
- Anonymity
- Distinctive story or face may remain
Targeting
- Identities
- Identify technology
- Raw material
- Check PECR duties
- Public use
- Check online advertising guidance
- Anonymity
- Labels like anonymous audience are unreliable
For delivery and measurement, identify the technology rather than relying on labels such as "anonymous audience". The ICO explains that PECR sits alongside the UK GDPR and covers electronic marketing and cookies or similar technologies, and some duties apply even without personal data.
Check the ICO's direct marketing guidance and its guidance on the use of cookies and similar technologies against frequency capping, audience matching, conversion measurement and other actual uses, and its guidance on AI and data protection where generative tools are involved. This avoids the false shortcut that every activity needs identical consent, or that none does.
Assign supplier roles from reality
Read what the vendor decides and does, not only how its contract labels the parties. Ask whether uploaded material is used solely on documented instructions, whether sub-processors are involved, where support can access it and what happens at termination.
Where one party processes personal data for a controller, the ICO's 'Contracts and liabilities between controllers and processors' guidance identifies subjects including instructions, confidentiality, security, sub-processors, rights assistance, deletion or return, and audits. The ICO notes that this guidance is under review and is not a commercial contracting manual.
Release the minimum necessary material
Create a production-safe pack that excludes respondent contact details, unused attributes and unrestricted customer lists. Use synthetic placeholders for layout when real data adds no value. Give reviewers the smallest access needed and log downloads or exports that leave the controlled workspace.
Plan correction and deletion before launch. Identify who can find every copy linked to a participant or customer request, how a suppression reaches downstream exports and which records must be retained for accountability. Where a generated asset embeds a recognisable person or personal detail, deleting the prompt alone may not remove the published output.
Security review should cover ordinary collaboration failures as well as hostile access. Check public share links, inherited workspace membership, contractor access, authentication, export destinations and support tickets. Set an incident route that connects the creative owner with privacy, security and client contacts, including a method to preserve facts without spreading the affected material further and a route to report a personal data breach to the ICO where the threshold is met.
Before launch, a responsible owner should approve the purpose, role analysis, legal basis where required, PECR position, notice, retention, supplier terms and security evidence, and update the record of processing activities and any data protection impact assessment. Pause when the data path cannot be explained. A platform setting is evidence about configuration, not proof that the whole processing operation is lawful.
Before you act
- Draw the full data flow, including quiet copies. See Draw the flow.
- Check current ICO guidance, which is under review. See Draw the flow.
- Separate research use from targeting and measurement. See Separate research from targeting.
- Assign controller and processor roles from actual practice. See Assign supplier roles from reality.
- Build a production-safe pack with minimum necessary data. See Release the minimum necessary material.
- Plan correction, deletion and incident routes before launch. See Release the minimum necessary material.
Common questions
Why is one broad permission statement not enough?
An interview recording, customer photograph, retargeting identifier and campaign report may all relate to people, but they support different activities and may involve different organisations. One broad permission statement will not answer every question, so map information by purpose before it enters a creative system.
When can PECR duties apply even if an organisation thinks it holds no personal data?
Some PECR duties can apply even where the organisation believes it is not processing personal data. Check the actual technology rather than relying on labels such as anonymous audience.
What should be checked before launch?
Before launch, a responsible owner should approve the purpose, role analysis and legal basis where required. They should also approve the PECR position, notice, retention, supplier terms and security evidence. Pause when the data path cannot be explained, because a platform setting is not proof that the whole processing operation is lawful.
