Yes, if the activity is likely to create heightened risk or involves sensitive data. Assessments are most useful when they happen before launch, because they force teams to document benefits, safeguards, consumer expectations and residual risk before the processing becomes business as usual.
Why data protection assessments belong before launch
Targeted advertising can move quickly from low-risk segmentation into processing that is harder to justify, document and unwind once it is live. A pre-launch assessment forces the team to test the purpose, necessity and proportionality of the campaign before assumptions harden into production practice, which is especially important where profiling, sensitive attributes or cross-context tracking are involved.
That timing matters because the real decision is not only whether advertising can be done, but whether it can be done with defensible safeguards and a clear residual-risk position. If the assessment is postponed until after launch, the organisation is usually reacting to a live processing model, shared data flows and already-established business dependencies instead of shaping them.
What the assessment needs to surface
A useful assessment should identify what data is used, who receives it, how audience selection works, which lawful basis or consumer expectation is being relied on, and what technical and organisational controls limit over-collection or secondary use. It should also show whether the campaign relies on inferred traits, combined datasets, or third-party enrichment that changes the privacy posture.
For advertising programmes, the question is often not whether data is personal, but whether the combination of tracking, profiling and distribution creates a materially higher-risk processing activity. The assessment should therefore capture data minimisation choices, retention limits, opt-out handling, vendor roles, and any safeguards that reduce the chance of exposure beyond the original advertising purpose.
For teams building the control set, a NIST Privacy Framework view helps structure the discussion around governance, data processing expectations and privacy risk management, while the GDPR is the clearest reference point where special-category data, profiling or high-risk processing may trigger a formal assessment. A practical assessment template such as DPIA Template can help teams record necessity, mitigation and sign-off in a way that is actually reviewable later.
When delay becomes the bigger risk
Delaying the assessment can leave the organisation with weak accountability, incomplete records and a poor ability to prove that the campaign was reviewed before processing began. That becomes more serious when the adtech stack includes multiple vendors, audience enrichment, inferred interests or data sharing that crosses business units or jurisdictions.
Failure mechanism: teams treat the campaign as a marketing deployment rather than a privacy-sensitive processing decision, so safeguards are added informally after launch, if at all. Once the processing is operational, it becomes harder to roll back hidden data flows, revise notices, change vendor settings or reconstruct why a particular audience segment was created.
Impact: the business may face avoidable exposure to regulatory challenge, consumer trust damage, remedial programme costs and the need to suspend or redesign the advertising workflow. If sensitive data or high-risk profiling is involved, the consequences can extend beyond the campaign itself to the organisation’s wider privacy governance and vendor oversight model.
Relevant control thinking here aligns with CIS Controls v8 on data protection and access governance, and with the privacy-by-design logic in the GDPR, which expects risk to be considered before processing is normalised. Where the advertising platform itself is the subject of the assessment, the NIST Privacy Framework is useful for framing the residual-risk decision rather than just the control checklist.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AR-4 — Privacy Monitoring and Auditing | Targeted advertising assessments need ongoing privacy oversight and auditable decisions. |
| PM-25 — Privacy Risk Management Program | The question is about deciding privacy risk before expanding a processing activity. | |
| RA-3 — Risk Assessment | A launch-time assessment must identify and document privacy and processing risks. | |
| Recommendation — Document privacy decisions and monitor ad processing for drift from approved purposes. Use a privacy risk program to assess high-risk advertising before launch. Assess processing risk before approving any expanded targeting model. | ||
| GDPR | Article 35 — Data Protection Impact Assessment | Pre-launch assessment is central where targeted advertising may be high-risk processing. |
| Article 25 — Data protection by design and by default | The answer depends on building safeguards into targeted advertising before it goes live. | |
| Recommendation — Perform a DPIA before launch when profiling or sensitive data raises risk. Bake minimisation and privacy safeguards into ad targeting before deployment. | ||
Practitioner Guidance
What to prioritise: Start with the processing activities most likely to change the risk profile, not with the lowest-effort campaign elements. Audience profiling, data enrichment, inferred characteristics and third-party sharing deserve first review because they usually drive the assessment outcome.
What to verify: Confirm that the assessment records the exact data sources, the purpose of the campaign, the recipients, the retention period and the mitigation measures that will be enforced before launch. If any of those are still unclear, the launch is premature.
Decision rule: If the campaign could reasonably be seen as high-risk, sensitive, or materially different from ordinary first-party marketing, complete the assessment before any live targeting begins. If not, document why the processing stays below that threshold and what monitoring will detect drift later.
Practitioner takeaway: The best time to find out that a targeted advertising model is hard to justify is before it is embedded in production, vendor contracts and audience operations.
Related resources from NHI Mgmt Group
- Should organisations prioritise data security coverage for GenAI and MCP paths before expanding more legacy controls?
- Why do organisations need data protection assessments before launching high-risk processing activities?
- Should organisations prioritise a unified operational data layer before expanding autonomous security workflows?
- When should organisations prioritise data visibility before expanding AI or cloud initiatives?