Governance, Security, and Compliance
What you must understand
Governance covers operator rights, security zones, audit trails, and data retention. Compliance covers consent, unsubscribe handling, and data subject requests. Know how typology rules enforce sending policy and how approval workflows create accountability.
Traps that appear in questions
- Consent is not implied. A recipient without recorded consent should not be targeted, regardless of list membership.
- Unsubscribe is immediate. Suppression must apply at send time, not at the next campaign cycle.
- Audit trails are immutable. Do not design workflows that depend on editing audit records.
- Least privilege. Grant the narrowest rights that let an operator do the job; admin is not a default.
Rule of thumb
Before any send, confirm three things: consent recorded, suppression current, and approval captured. If any is missing, the send is non-compliant.
Worked example
A data subject requests deletion. Locate the recipient record, honor the request through the defined process, and confirm that suppression and retention rules prevent re-import from a stale source file.