Supplier Evaluation
Part of Media procurement and contracts
Clarifying who owns campaign accounts and data
Map account administrators, data-use rights and handover steps before a media supplier starts work.
Settle account control, data use and exit access before a supplier starts work. Name an advertiser administrator for each essential account, give the operator only the permissions it needs and state which records it may use, export or retain.
Map access and authority
Create an access register covering the ad account, buying platform, analytics property, tag manager, audience source and reporting workspace used by the campaign. Record each account or property ID, administrator, billing contact, agency users, permission level and recovery contact. Include any parent or manager account that can affect access.
Check the actual product permissions. Record which roles can administer accounts, manage users, access data or change billing. Give each person only the access they need and keep an advertiser administrator able to manage the account.
Plan for dependencies before unlinking. While the relationship is working, identify shared remarketing lists, tags and other links. Confirm what will continue to function and arrange any required transition before removing access.
Key compliance and access metrics
- Accounts mapped
- All ad, analytics, tag manager and reporting properties
- Permission levels assigned
- Role-based access only (no admin rights unless necessary)
- Recovery contacts recorded
- At least one per account or property
- Shared assets identified
- Remarketing lists, tags, third-party integrations
Define rights to the records
List campaign settings, performance exports, creative files, conversion definitions, audience lists, customer data and supplier reports. For each category, establish who provides it, who may use it, what the advertiser can retrieve and what happens at expiry. State whether the supplier may combine it with other clients' information or use it for another purpose.
Where personal information is involved, review the actual collection, use and sharing arrangement. APP 11 requires an APP entity holding personal information to take reasonable steps to protect it and, when it is no longer needed—subject to stated exceptions—to destroy or de-identify it. OAIC guidance explains an entity may hold information where it has possession or control of a record.
Data rights and ownership by record type
- Campaign settings
- Advertiser owns; supplier may not retain post-project
- Performance exports
- Advertiser may retrieve; supplier may retain only with consent
- Creative files
- Advertiser owns; supplier must return upon request
- Customer data (personal information)
- Supplier must de-identify or destroy when no longer needed
- Audience lists
- Advertiser retains rights; shared lists require coordination
Check the exit path
Confirm an advertiser administrator can sign in, view agreed billing and delivery records, export reports at the required detail and identify third-party links. Check retention limits before relying on a later export.
Specify handover deliverables, date, format, secure transfer, access removal and treatment of copies. Where a platform cannot transfer a resource or export a required dataset, record that limit before adopting a workflow that depends on it. The handover is complete when the advertiser can operate and review the records it was promised.
Handover process for campaign accounts and data
- Confirm advertiser administrator accessSign in, view billing and delivery records
- Export reports at required detailVerify retention limits and export capability
- Specify handover deliverables and formatSecure transfer, access removal, copy treatment
- Complete handover when advertiser can operate independentlyFull access and review capability confirmed
