Counsel briefing kit: fact sheet, question list and decision record for an ad tech data flow

The fact sheet describes a flow. The question list draws on the selected checkpoints. The decision record holds the result of the business discussion. Each piece can be downloaded on its own or included in one Markdown file.

A fact sheet can cover one release or a flow that is already running. The scope matters because the same placement can use different data in two environments or countries. The records named in the kit help identify which version is being discussed.

The source examples for the fact sheet include records of processing and impact assessments under the General Data Protection Regulation (GDPR). The National Institute of Standards and Technology (NIST) Privacy Framework also covers inventory and mapping. The kit uses those examples for its structure. Each source has its own scope and purpose. GDPR Articles 30 and 35; NIST Privacy Framework, Identify-P.

Each row names something that can be checked against a record. The goal can come from a business brief. Recipients and purposes may appear in several contracts or diagrams. A network capture can show a request the diagram misses.

A worked example is a purchase-based rewards offer. Its goal could be to encourage use of a card. The data map might show a bank matching the purchase internally and sending a total to a merchant. The recipient row can capture who gets the total, while the request row can show what else is sent in practice.

The flow might also contain old fields that are no longer used. A schema can show fields that could be sent, while a capture shows which fields were sent in a particular test. An assumption can be marked as such in the fact sheet until the team has evidence of the operation.

The scope row can record what has already launched and since when. A new control may change later requests without affecting what was sent earlier. A clear timeline helps counsel identify which evidence goes with each version.

The selector groups the ten questions by subject. Select the checkpoints that apply to the flow and the kit collects the full question lists in checkpoint order. The IDs remain beside the questions so each can be traced to its checkpoint.

In the rewards example, the Regulation P checkpoint can help frame the role of a merchant and the route by which it receives information. A second question can arise if a network already holds the transaction data. The card network checkpoint addresses that source and later reuse.

A health promotion can raise a different pair of questions. The business associate checkpoint concerns the platform’s role. The pixel checkpoint concerns the communication, timing and vendor function. The records that answer one question may also help with another.

Each selected checkpoint has a row for the readings considered and the reading adopted. The row can capture the reasons, facts assumed, decision-maker role, counsel consulted and date. It also has space for controls, events that trigger a new look and the next review date.

A change in a payload can be a reason to revisit a decision. In a rewards program that sends totals, adding a row key can affect who can identify customers. A decision that relied on the prior schema can name that schema so a team can spot the change.

The record can also name a new vendor, jurisdiction, contract or court decision as a trigger. These events can change different parts of the analysis. A date gives the business another way to review the decision when no event has yet been recorded.

Management can discuss three questions before counsel reviews the flow. What is the program worth to the business? How much uncertainty is the organization willing to accept for that value? Who has authority to sign for that choice?

An optional five-step scale can give the discussion a common vocabulary. Likelihood can run from remote, unlikely and possible to likely and very likely. Impact can run from limited, modest and material to serious and severe. The labels are an aid to discussion and do not measure legal risk.

People in different roles may use the same word for different effects. An engineer may mean a high chance of a tag firing on a page. Management may mean a different chance of a costly business outcome. Naming the event and time period makes the scale easier to interpret.

The kit gives no legal answers and does not replace counsel. Completing a row does not make the document confidential or privileged. Ask your counsel how to prepare, label and share the fact sheet and the decision record so that confidentiality and privilege are handled correctly in your jurisdiction.

Entries and selections stay in the browser’s local storage. The clear control removes them from the kit on that browser. Downloaded copies are separate files managed by the reader. The print view shows the contents of the three parts together.

Related references

• ad tech compliance guide
• ad tech legal checkpoints index
• HIPAA and advertising reference
• GLBA and advertising reference
• dsp rfp template
• advertising consent signals reference

1. GDPR Article 30(1)–(2). Checked 10 November 2026.
2. GDPR Article 35(1), (7). Checked 10 November 2026.
3. 16 CFR 314.4(b). Checked 10 November 2026.
4. NIST Privacy Framework, Core, Identify-P and Inventory and Mapping. Checked 10 November 2026.
5. 45 CFR 164.308(a)(1)(ii)(A). Checked 10 November 2026.
6. UK GDPR Article 35(1), (7). Checked 10 November 2026.
7. GDPR Article 5(1)(b) and (c), purpose limitation and data minimization. Checked 10 November 2026.
8. 16 CFR 314.1(b), scope for customer information. Checked 10 November 2026.