{"page":"/blog/bank-media-network-without-moving-customer-data","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Item","Owner","Artefact","Audit evidence"],"rows":[["1","Data-use register (element × use × legal basis × jurisdiction)","Legal, Data","Register","Signed register, review log"],["2","Reg P notice updated to describe offers and advertising uses","Legal","Privacy notice v.n","Notice version history, delivery records"],["3","Opt-out mechanism and 30-day window implemented","Digital","Opt-out flow","Test records, opt-out counts"],["4","§1016.13 contracts for every processor touching NPI","Procurement","Contracts","Executed contracts with use-limit clauses"],["5","EU/UK: GDPR consent for marketing profiling, separate from PSD2","Legal, DPO","Consent text and records","Consent logs, DPIA"],["6","DPIA or equivalent risk assessment","DPO","DPIA","Signed DPIA"],["7","PCI scope statement: media stack outside CDE","Security","Scope diagram","QSA sign-off"],["8","Tokenization of customer and card identifiers before the media stack","Engineering","Token service","Token map access logs"],["9","Excluded merchant categories list","Compliance","Exclusion list","Change log"],["10","Segment registry with floors and definitions","Data","Registry","Registry exports per quarter"],["11","Consent store schema with versioning","Engineering","Schema","Schema and migration history"],["12","Offer engine eligibility rules referencing consent flags","Engineering","Rules","Unit tests, rule change log"],["13","Onsite decisioning logs (what was shown, to which token, why)","Engineering","Logs","Retention policy, sample audit"],["14","Offsite bid request template with no transaction attributes","Engineering","Template","Schema review, sample requests"],["15","Clean room with aggregation thresholds and query logging","Data","Clean room config","Threshold settings, query logs"],["16","Holdout design and lift methodology document","Analytics","Methodology","Published methodology"],["17","Reporting API returns aggregates only","Engineering","API spec","Schema review"],["18","Access control: who can query records vs aggregates","Security","IAM policy","Access reviews"],["19","Vendor support access: logged, time-boxed, no data export","Security","Policy","Session logs"],["20","Customer-facing explanation of how ads use data","Marketing, Legal","Help page","Published page"],["21","Complaint and deletion handling tied to consent store","Operations","Runbook","Ticket records"],["22","Incident response covering the media stack","Security","Playbook","Tabletop record"],["23","Quarterly review of segments, exclusions and contracts","Compliance","Calendar","Minutes"],["24","Exit plan: data return and deletion for every processor","Procurement","Exit clauses","Contract text"]],"sourceUrls":[[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[]]}