Operations
Part of Running a customer data journey with people, not systems, making the decisions
Combining customer data platforms team roles in small teams
Combine customer data platforms team roles in a small England team with a self-approval test, a combined-role record and a named challenger.
Customer data platforms team roles are decision functions, not a headcount, so one person in a small England team can hold several of them. That is allowed. The risk starts when one person would approve their own work and nobody else can say no.
Eight functions are in play: controller decision-maker and factual data owner, journey owner, data steward, privacy, PECR and legal reviewer, security owner, accessibility owner, operations and incident owner, and procurement, supplier and destination owners. The question is which combinations need a second pair of eyes before release.
What to take away
- One person may hold several functions, provided the authority used for each is recorded.
- Test every combination with one questionwould this person approve their own work?
- Where the answer is yes, name an independent challenger before release.
- Write a combined-role recordthe person, the authority, the conflicts and the challenger.
- If nobody can challenge a privacy, security, identity or exit decision, that gate stays unresolved.
The self-approval test
Ask one question of every combination: would this person approve their own work? A yes does not ban the combination. It means the decision needs a second person who can refuse it before the journey is released.
| Combined pair | How self-approval arises | What the challenger asks |
|---|---|---|
| Data steward and privacy reviewer | The person who set the joins and inferred fields also reviews their purpose | Why is this join justified for the stated purpose? |
| Journey owner and security owner | The holder of stop and restart authority also sets the access requirements | Which access requirement would block a restart if it failed? |
| Operations owner and privacy reviewer | The person who contains the journey also judges whether an incident is reportable | Which facts support the reportability decision? |
| Procurement owner and security owner | The person who reads the supplier's materials also judges the configured controls | What shows the configured controls work, beyond supplier materials? |
| Data steward and accessibility owner | The person who built the correction queue also tests it | Can a disabled colleague finish the correction task with their assistive technology? |
The journey owner defines the single buyer decision, approves version changes and holds stop or restart authority. That function collects decisions from the other gates rather than overruling them, so it is the pairing to watch most closely when one person also holds a gate.
Release gates are where these answers end up. The operations and delivery guide shows how a journey is passed, failed or held. The role record below is what lets a gate be marked as passed with a clear conscience.
Write the combined-role record
Record the combination before release, not after an incident. One short entry per person is enough, provided it names the authority used and the person who can challenge.
- Name the person and every function they hold.
- State the authority used for each function.
- List the conflictsdecisions the person would otherwise approve themselves.
- Name an independent challenger for each conflict.
- Check that the challenger can refuse the decision before release.
If nobody can challenge a privacy, security, identity or exit decision, that gate remains unresolved. The fix is a different challenger, not a longer record. A small team may need to borrow one from outside the journey.
Two functions people merge by mistake
The controller decision-maker and the factual data owner may be different people. The first records why and how the organisation uses each source. The second vouches for provenance and meaning, so merging them quietly removes a check.
The ICO's guidance helps an organisation decide whether it is acting as a controller, processor or joint controller when processing personal data. It does not appoint a job title or settle a particular arrangement, because roles follow actual activities.
The privacy, PECR and legal reviewer is the second function to protect. This person examines purpose, roles, transparency, rights, objections, retention, sharing, transfers and device storage or access. A platform consent flag does not replace that examination, and the reviewer should not be the person who configured the flag.
When operations and privacy sit with one person
Containment and reportability are different decisions. The incident owner can contain the journey and preserve evidence, but reportability remains a fact-specific decision, so a second reviewer should look at it when one person holds both functions.
The ICO says an organisation should have breach detection, investigation and internal reporting procedures in place. Rehearsing the incident scenarios shows whether a combined owner and a challenger work together when it counts.
Before you act
- Write down every function each person holds.
- Apply the self-approval test to each combination.
- Name an independent challenger where the answer is yes.
- Record the person, authority, conflicts and challenger before release.
- Assess evidence for security controls, not just supplier claims.
- Leave any gate without a challenger marked as unresolved.
Common questions
Can one person hold several customer data platforms team roles?
Yes. A small organisation may combine functions, but before release it should record the person, the authority, the conflicts and the independent challenger. The test is whether one person would otherwise approve their own work, not how many functions they hold.
Does a platform consent flag settle the privacy review?
No. The reviewer applies the ICO's final guidance on storage and access technologies, dated 29 April 2026, to the actual configuration. A flag shows what the platform records. It does not show that the configuration fits the facts.
Who checks the supplier's terms?
Procurement checks the legal entity, exact edition, subprocessors, change, support, export, deletion and exit terms in the commercial contracts. The supplier performs only its contracted tasks, and the destination owner controls audience receipt, use, suppression and deletion.
What happens if nobody can challenge a decision?
The gate stays unresolved. Supplier materials alone do not prove that configured controls work, so buyer evidence is needed, and a decision that has no independent challenger should not release the journey.
