Rules
Part of Marketing data governance: purpose, ownership, lifecycle and deletion
Which compliance gaps cause marketing data governance to stall?
Six specific compliance gaps stall marketing data governance, from missing lawful basis records to consent that never reaches the warehouse.
What to take away
- Marketing data governance stalls on six named compliance gaps, starting with the missing lawful basis record and the consent that never propagates.
- The other four are the absent suppression list, the missing retention schedule, the unlisted vendor register, and the broken rights path.
- Each gap maps to a real rule. GDPR Article 6 covers lawful basis, CAN-SPAM covers opt-outs, and GDPR Article 15 covers access requests.
- Each gap has an owner and a test. A gap you cannot test is a gap you have not closed.
- Fix one flow first, then reuse the pattern. A program that starts enterprise-wide stalls before its first audit.
- Consent captured at the form and consent stored in the warehouse are two systems. Most stalls happen where they meet.
- When a gap touches a regulation, name the regulation and route the decision to counsel. Do not write the rule yourself.
The gaps that stop governance
Governance programs rarely fail because the policy is wrong. They stall because a specific gap sits under a workflow nobody owns, and every downstream decision waits on it. Six gaps account for most of the stalls.
Six compliance gaps that stall governance
- No lawful basis record
- Consent never reaches the warehouse
- No suppression and preference list
- No retention schedule
- No vendor and subprocessor register
- No rights request path
No lawful basis record. The team can name the campaign but not the reason it is allowed to run. GDPR Article 6 lists six lawful bases. Three common ones are consent, contract, and legitimate interests.
Article 30 requires a record of processing activities that names the basis. CAN-SPAM instead requires opt-out handling and sender identification. Without a recorded basis, counsel cannot approve the flow and the pilot stops.
Consent that never reaches the warehouse. Consent is captured at the form, stored in the CRM, and never propagated to the CDP or the activation layer. IAB Europe's Transparency and Consent Framework v2.2 carries the signal as a string of purposes and vendor IDs.
Google Consent Mode v2 has been required for EEA ad personalization since March 2024. A suppression that only lives in one system is not a suppression.
No suppression and preference list. Unsubscribes, global opt-outs, and channel preferences live in separate tools. CAN-SPAM requires commercial senders to honor an opt-out within 10 business days and to include a physical postal address. When a customer opts out in email, paid social and SMS keep sending.
No retention schedule. Records accumulate with no deletion date. GDPR Article 5(1)(e) sets storage limitation: keep personal data no longer than needed. Google Analytics 4 caps user and event data retention at 14 months, or 2 months on the shorter setting. Nobody can approve deleting a field with no date attached.
No vendor and subprocessor register. Marketing ops runs on pixels, agencies, enrichment vendors, and exports. GDPR Article 28 requires a written processor contract and a list of subprocessors. Salesforce publishes its own subprocessor list, and Mailchimp and OneTrust do the same. Without a register, no one can say where data went.
No rights request path. Access, correction, and deletion requests arrive by email and get handled by hand. GDPR Article 15 gives a controller one month to answer, extendable by two. The CCPA and CPRA give 45 days, extendable to 90 with notice. There is no route from request to downstream propagation.
Why each gap stalls the flow
A gap stalls governance because it blocks a decision, not because it breaks a system. The lawful basis gap blocks approval. The consent gap blocks activation. The retention gap blocks deletion. The rights gap blocks the audit trail.
The pattern repeats: the workflow is technically ready and legally unanswerable. Teams respond by writing more policy, which adds words without closing the gap.
Where to start
Pick one high-consequence use: an audience, a conversion, an identity rule, or a partner exchange. Trace it from collection through correction, deletion, and recovery. The marketing data governance walkthrough covers that trace end to end.
The UK National Data Library data management manual is written for public-sector work. Its categories help a marketing team check its lifecycle map. The categories are:
- asset recording
- ownership
- quality
- access
The team should check whether its map assigns operating responsibility beyond field names.
The UK Government's data ownership model separates owner, steward, and custodian.
It ties each to the following:
- definitions
- quality
- access
- retention
- change
Adapt those obligations to your organization rather than importing the titles.
The six gaps, checked
| Gap | What it looks like | Test that closes it |
|---|---|---|
| Lawful basis, GDPR Article 6 and Article 30 | Campaign runs, basis unrecorded | Can counsel name the basis in one line? |
| Consent propagation, IAB TCF v2.2 and Google Consent Mode v2 | Opt-in lives in one system only | Does the CDP show the same state? |
| Suppression list, CAN-SPAM 10-day rule | Opt-outs split by channel | Does one opt-out stop every send? |
| Retention schedule, GDPR Article 5(1)(e) and the GA4 14-month cap | Fields have no deletion date | Can you name the date for one field? |
| Vendor register, GDPR Article 28 subprocessor list | Pixels and agencies unlisted | Can you list every recipient of one record? |
| Rights path, GDPR Article 15 and the CCPA 45-day clock | Requests handled by email | Does a deletion reach every system? |
Run a controlled handoff
The GOV.UK technology selection guidance asks for adaptable choices, data control, security review, and ownership-cost analysis. Those questions apply to a marketing stack too.
The CISA software acquisition fact sheet covers supply-chain exposure and vulnerability management. Add those questions to a vendor review without treating them as local approval.
For the questions teams ask before they start, see common marketing data governance questions.
Common questions
Which gap should a team close first?
Start with the one blocking the live workflow. If a campaign cannot launch, the lawful basis record is the gap. If sends are reaching opted-out contacts, the suppression list is the gap. CAN-SPAM gives you 10 business days to stop those sends.
Does closing one gap fix the others?
No. The gaps are independent, but closing one builds the habit: name the gap, name the owner, write the test, run it. Reuse that pattern on the next flow.
When does a compliance gap need counsel?
Whenever the answer depends on a statute, a state attorney general's guidance, or FTC enforcement. Name the regulation, hand the decision to qualified counsel, and record the answer.
How do you know a gap is closed?
You can run the test in the table above and it passes. A gap with no test is a gap you have not closed.
