8.2.3 Marketing and advertising use
The organization must not use personal data processed under a contract for marketing or advertising without establishing that prior consent was obtained from the appropriate individual, and must not make giving that cons
4
artefacts
0
held by a system
2
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of prior consent where such use occurs, traceable to the individual · Data governance / DLP tooling
- Evidence that consent is not a condition of service · Data governance / DLP tooling
governing documentDocuments that govern the control
- Contract terms addressing marketing and advertising use · Vendor register / contract repository
- Documented compliance with the customer's contractual requirements on this point · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Marketing use permitted by a broad clause in standard terms, with no consent behind it
- Consent bundled into service acceptance, making it a condition of receiving the service
- Consent obtained by the customer and assumed by the processor without evidence
- Analytics or profiling for the organization's commercial benefit treated as service improvement rather than marketing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.2 Organization’s purposes · 8.2.4 Infringing instruction