Data Governance, Privacy, and Compliance
Governing audience data
Governance in AAM centers on data source governance, PII handling, consent, and retention. Know data source settings that control how data is used, declared ID hashing, and opt-out mechanisms. GDPR/CCPA obligations require honoring consent and deletion/access requests. Data retention and data export controls limit how long and where data flows.
Key concepts
- PII must be hashed where required (declared IDs).
- Consent gating: data shouldn't be collected or activated without consent.
- Opt-out: users can be excluded from data collection/activation.
- Data retention policies define lifespan.
- Data export controls restrict destinations for sensitive data.
- Role-based access limits who sees/edits data.
Traps in questions
- Assuming all data can flow to all destinations; export controls may block it.
- Forgetting consent must be captured and respected before activation.
- Confusing hashing (pseudonymization) with true anonymization.
- Overlooking retention limits when planning long-term segments.
- Ignoring access controls when multiple teams share the org.
Worked example
A marketing team wants to send hashed emails to a third-party destination. Check: (1) declared IDs are hashed, (2) consent is recorded, (3) data export controls permit that destination, (4) retention aligns with policy. If any fails, activation must be blocked. Rule of thumb: before any activation, run the consent → hashing → export control → retention checklist; a single failure stops the flow.