Controller and Processor Roles in B2B Intent Data: A Review Worksheet

For GDPR purposes, a controller determines the purposes and means of personal-data processing; a processor processes personal data on the controller’s behalf. Assess the actual activity, not just the vendor’s label. An agency, client and data provider can have different roles across different activities.

This guide provides a proposed operating worksheet for B2B intent-data teams. It is general information, not a determination of BrandWell’s or your organization’s legal role. Qualified counsel should assess the actual data, relationship and applicable jurisdiction.

Start with the processing activity

The EDPB’s final controller-and-processor guidelines describe these as functional roles determined by the facts. Contract descriptions can help, but are not decisive. A processor may have discretion over practical implementation; independent purposes and essential decisions need separate assessment. Joint controllership involves joint participation in determining purposes and means.

The ICO’s UK guide currently carries a notice that it is under review following the Data (Use and Access) Act. Verify the current UK position before relying on a static template. Do not mechanically translate GDPR terminology into another jurisdiction’s privacy framework.

Keep the legal conclusion separate from the operational record. A product subscription, platform name or agency service description does not settle the allocation.

Four scenarios to take to counsel

The following examples identify questions for review, rather than assigning a final legal role.

• Client-defined campaign: The client supplies the audience criteria, purpose, permitted channels and retention instructions. Ask which decisions the agency actually makes and whether any reuse serves a separate purpose.
• Agency-defined research service: The agency selects the market and produces research for clients. Ask who determines collection, targeting, recipients and later use.
• Reusable provider dataset: A provider maintains information used across customers. Separate that activity from any narrowly instructed client-specific processing.
• Jointly designed campaign: Client and agency make essential decisions together. Ask whether the decisions meet the applicable test rather than assuming shared commercial benefit is enough.

Assess billing, security, support and business-development records separately. Do not assign a single label to every activity simply because the same parties are involved.

Build a data-flow worksheet

1. Inventory the information: Topic observations, website events, company identifiers, names, contact fields, CRM records, suppression and outcome data.
2. Map the path: Source, receiving party, storage, integration, export, agent access and deletion destination.
3. State the purpose: Explain the particular task rather than writing only “marketing.”
4. Record decisions: Who chooses the people, fields, recipients, matching rules, retention and channels?
5. Record instructions: Link each instruction to its owner, version and implemented configuration.
6. Seek the role assessment: Record counsel’s conclusion, jurisdiction, assumptions and unresolved questions.
7. Test the operations: Check that access, exports, corrections and deletion follow the approved scope.

A useful worksheet has one row per activity, not one row per company logo. Keep factual observations, proposed controls and legal conclusions in separate columns.

Assign operational owners

Create a responsibility matrix for data definitions, access configuration, campaign operation, contracts, rights-request routing, incidents and offboarding. Name an accountable person for each task and a backup where needed.

Operations should know how to apply the instructions; engineering should know which controls enforce them; procurement should maintain the relevant documents; counsel should review the legal allocation. Do not give an AI-generated label authority over any of these responsibilities.

Record conflicts and a practical escalation path. If an instruction is ambiguous or differs from the approved scope, pause the affected activity and resolve the discrepancy before extending it.

Questions for contracts and instructions

Use this proposed preparation list for the relationship-specific review:

• What data, people, activities, purpose and duration are in scope?
• Which instructions are accepted and who may approve a change?
• What independent uses, if any, does each party propose?
• Who can access, export or send the information onward?
• Which service providers and locations are involved?
• How are confidentiality, security and review evidence addressed?
• How are requests, corrections, suppression and incidents coordinated?
• What happens to information and active integrations at termination?

This is not a complete statutory contract checklist. Have counsel identify the applicable mandatory terms and verify that the contract matches the real workflow.

Maintain an instruction register

Keep a versioned record of the approving party, affected dataset, purpose, fields, recipients, locations, retention, channels, agent permissions, effective date and superseded version. Link it to the actual configuration and evidence owner.

Sample the register against exports and logs. A documented restriction is ineffective if an active connector or operator can routinely bypass it. Do not silently broaden the purpose because a tool makes another use possible.

Review onward access and providers

Prepare an inventory of hosting, support, analytics, monitoring, integrations and model or agent tools that may receive information. Record the service, data categories, purpose, access location, approved scope and deletion path.

Ask whether prompts or records are retained or used for broader model training. Verify actual settings and terms rather than relying on a logo list or an assurance that every provider has the same role. Include remote access in the review.

Test requests, corrections and suppression

As a proposed control test, trace a sample request from receipt through verification, routing, action and confirmation. Use appropriate test records. Include a changed employer, misspelled name, previously exported contact and downstream audience.

Record the original field, correction, source, reason, time and affected systems. Check whether suppression continues to apply when the next feed or enrichment step runs. The appropriate retention of suppression evidence needs its own review; avoid treating deletion as permission to re-add the same person.

An observed topic or identity match is not evidence of permission for every possible channel. Record the actual authorization or other reviewed basis required for the proposed activity. Do not make private-browsing claims in a message on the basis of an uncertain association.

Prepare incident and exit exercises

Define who detects, contains, investigates, preserves evidence, assesses impact, coordinates notices and approves resumption. Confirm the relevant deadlines and duties with the responsible reviewers rather than adopting a universal number from a template.

Useful practice scenarios include a cross-client export, compromised integration key, incorrect identity, unapproved onward access, failed deletion or agent action outside instructions. Record remediation and retest.

For offboarding, inspect active keys, connectors, stored exports, audiences, scheduled jobs and support access. An ended commercial relationship does not automatically disable technical access.

Budget for implementation and maintenance

Include data mapping, qualified review, contract work, engineering controls, training, monitoring, request handling, correction, incident exercises and periodic reassessment. Separate initial implementation from recurring operation.

Fictional planning example: A team spends eight hours on mapping, four on implementation and two on testing. At an assumed $75/hour, fourteen hours cost $1,050. Add separately quoted legal or specialist work. This arithmetic is not a market benchmark or a promise that the program is compliant.

Fictional coverage example: Eight of ten processing activities have a documented assessment, an 80% coverage rate. That measures documentation coverage. It does not establish that the assessments are correct or that all controls work.

Keep the BrandWell boundary explicit

MarketPulse supports topic-based intent research, with standard plans starting at $500/mo. Growth includes three topics with daily pulls; Scale includes ten topics with daily pulls. Available fields and audiences vary, and audiences can overlap.

Review the actual product terms, data documentation, selected tools and instructions for your workflow. This article does not declare BrandWell a processor for every use, promise a white-label deployment or establish client resale rights.

AIMEE can help prepare research and connected tasks according to configured tools and access. Give it a defined scope and appropriate records. It does not determine a lawful basis or approve a new use on counsel’s behalf.

Reassess when the workflow changes

Review the worksheet when adding a client, source, field, topic, country, recipient, channel, agent, integration or reuse purpose. Periodically compare the documented map with logs, access, exports, contracts and operator practice. Assign unresolved issues an owner and review date.

The practical outcome is an activity-level record that qualified reviewers can assess and operators can follow. A questionnaire score cannot replace evidence from a working process.

Controller and processor questions

Can the contract alone decide the role?

The assessment needs to reflect actual decisions and processing. A label is not enough when the facts differ.

Is an agency always a processor?

Assess each activity, instructions and independent purpose. Do not assume the same role for campaign work and the agency’s own operations.

Does intent data establish consent?

A research signal or matched record does not document permission for every use. Review the specific activity and channel separately.

Does this checklist certify compliance?

No. It prepares an operational record for qualified, jurisdiction-specific review.

Review MarketPulse’s current product information or visit the BrandWell product directory before defining the workflow.

Reviewed and updated October 3, 2026.

Written by

Farnaz Kia