Operations
Part of Why marketing agencies operations decide delivery quality
What shared service standards mean for marketing agencies clients
New ICO and HSE expectations mean marketing agencies service standards now need named owners, records and review dates that clients can check.
What to take away
- The two duties clients raise most in agency supplier reviews are the UK GDPR accountability principle at Article 5(2) and the Health and Safety (Display Screen Equipment) Regulations 1992.
- Ask for dated records rather than policy titlesa record of processing activities, and a DSE assessment date for each regular screen user.
- A service standard becomes enforceable when the contract schedule fixes the response time, the review cadence and the evidence.
- Keep everything in one evidence pack, so an audit request takes minutes rather than weeks.
- Delivery and operations leads should hold different halves of the standard, both written into job descriptions.
The ICO and HSE duties behind service standards
The accountability principle in Article 5(2) has applied in the UK since 25 May 2018. The ICO's accountability and governance guidance sets out what counts as evidence. For an agency that means a record of processing activities, a recorded lawful basis for each live campaign, and a review cycle.
The Health and Safety (Display Screen Equipment) Regulations 1992 have applied since 1 January 1993. HSE's display screen equipment guidance covers workstation assessment for regular users, planned breaks and eye and eyesight tests on request.
Both duties dominate supplier reviews because each leaves a date behind. General employer duties under the Health and Safety at Work etc. Act 1974 follow the work, so shoots and event sites are covered as much as offices. uk/browse/employing-people/health-safety) rather than a verbal assurance.
[figure 1]
Two duties clients check
Data accountability
- What it covers
- Processing records
- Key document
- Register of processing
- Often missing
- Lawful basis per campaign
- What to ask for
- Review cycle
Workplace safety
- What it covers
- Offices, studios, sites
- Key document
- Risk assessment
- Often missing
- DSE assessments
- What to ask for
- Assessment date
DSE records are the most commonly missing item and the easiest to check. Ask for the assessment date for one named user. A dated record is live; an undated policy is not.
Implied terms in service contracts, such as the reasonable care and skill duty in the Supply of Goods and Services Act 1982, set a floor in England and Wales. They rarely cover the specifics a client needs. That is why the schedule carries the weight.
Agencies rebuilding this from scratch should start with our operations and delivery guide for 2027, which maps each standard to a delivery stage rather than treating it as paperwork.
Example contract schedule clause
Schedule 4, Service Standards. The Supplier will acknowledge client requests within one working day. The Supplier will review the register of processing activities quarterly and send the dated log within five working days of quarter end. The Supplier will reassess a named user's workstation within four weeks of a reported change and will give the assessment date on request.
Each line carries a number, an owner and a record. The regulations do not fix a quarterly cadence, so the schedule does. That is the part a client can enforce.
What goes in a one-page evidence pack
One-page evidence pack
- Register of processing activities (Article 30), with the date of its last review.
- Lawful basis recorded for each live campaign.
- DSE assessment date for every named screen user.
- Quarterly review logdate, question, answer, action.
[figure 2]
Four parts of a workable standard
- Written statement
- Named owner
- Review date
- Escalation route
Send one PDF or folder, not a fortnight of email. Clients shortlisting suppliers also want outside evidence, which is why our piece on agency reviews needing independent evidence sets out what a review should contain.
Matching the standard to the request
Choose
- Client asks for data records
- A maintained register with a review date
- Client asks for a DSE assessment date
- The dated assessment for each named user
- Team works mainly at screens
- Assessments, break planning and eyesight testing on request
- Client sends a supplier code
- Each clause mapped to an owner and a piece of evidence
- Agency grows past ten staff
- Separate compliance and safety roles
- Client requests an audit
- One evidence pack
Avoid
- Client asks for data records
- A policy PDF with no date
- Client asks for a DSE assessment date
- A generic workstation policy
- Team works mainly at screens
- Assuming home workers are covered
- Client sends a supplier code
- Signing and filing it unread
- Agency grows past ten staff
- Leaving both with the founder
- Client requests an audit
- Files sent piecemeal over weeks
Who owns each standard
Data protection usually sits with an overloaded operations lead. Safety sits with whoever last attended a course. Splitting the two works better: a delivery lead owns client-facing standards, an operations lead owns the records.
Our breakdown of marketing agency team roles in England shows how those responsibilities usually divide, which helps when you write a supplier questionnaire or a job description.
Write both roles into job descriptions so cover exists during holiday. If a client asks who owns a standard, one name should come back within a minute.
Review quarterly. Ask whether guidance has changed and whether a client has raised a failure. Note any owner who has moved role. Log the answers on one page as date, issue, answer and action. Anything longer stops being updated.
Common questions
Do these duties differ across the UK?
Data protection law applies UK-wide. The DSE regulations cover Great Britain, with equivalent Northern Ireland regulations enforced by HSENI rather than HSE. The practical requirements are the same.
Can a client demand to see the agency's records?
Only what the contract allows, so agree the audit scope before signature. A client is entitled to evidence that assessments happened, not to the personal data inside them.
What is the minimum standard for a small agency?
A dated record of processing activities, a DSE assessment for each regular user, one owner per standard and a quarterly log. That covers the two areas clients ask about most.
