Marketing automation platforms are the most lightly governed systems in the average B2B company. They hold your entire contact database, they send email under your brand, they sync with your CRM, and they usually have more admin accounts than the finance system — held by people who have never had an access review. Security and compliance for marketing automation isn't a legal department problem. It's an operations problem, and it belongs to whoever owns the stack.

This checklist gives you the practical version: consent, data flows, access control, and vendor due diligence — the four areas where marketing stacks actually fail audits and breach their obligations. It's written for GDPR-conscious B2B teams, but the controls are the same in any regime: know what you collect, prove why you hold it, limit who can touch it, and check your vendors.

It pairs with the ownership model in who owns what in your marketing stack — every item below needs a named owner to be worth anything.

The Checklist at a Glance

Work through these four sections quarterly. If any item stays unchecked two reviews in a row, it's not a checklist problem — it's an ownership problem, and the fix is a name, not a nagging reminder.

1. Consent & Lawful Basis

Consent is where marketing stacks accumulate the most silent liability. The records exist somewhere — in a form tool, a spreadsheet, a previous platform's export — but nobody can produce them on demand. Regulators don't accept "the tool stores it"; you need to be able to show what was agreed, when, and on what wording.

  • Every active list, workflow, and segment has a documented lawful basis — not inherited from "the way the form was set up in 2022".
  • Consent records include what, when, where, and the exact wording shown at collection.
  • Merged or migrated contacts carry a consent audit trail; contacts with unclear provenance are suppressed, not mailed.
  • Preference centres and unsubscribe flows are tested monthly, end-to-end, in every connected tool.
  • Suppression lists sync across all platforms — one tool's "do not email" must be every tool's "do not email".

2. Data Flows & Minimisation

Most teams can't draw their own data flows — and that blindness is itself the risk. Every undocumented integration is a copy of your customer database you didn't know you were making. Minimisation is the discipline that keeps the map small enough to actually govern.

  • A current data-flow map: what personal data enters, leaves, and is stored in each tool.
  • Field-level inventory of the CRM and automation platform — every field has a purpose, an owner, and a retention rule.
  • Integrations authenticated with scoped API keys or OAuth, never personal credentials.
  • Stale data purged on schedule: hard-bounced, inactive, and beyond-retention contacts deleted, not archived forever.
  • No personal data in spreadsheets, form tools, or AI prompts outside governed systems.

3. Access Control

Access is the control that decays fastest, because it changes quietly: an agency onboards, a contractor gets "temporary" admin, someone moves teams and keeps old rights. The question in an incident is always the same — who could have touched this data? — and unmanaged access means you can't answer it.

  • Complete list of admin and editor accounts in every marketing tool — checked against actual logins, not memory.
  • Quarterly access review: every admin justifies their access; departures are deprovisioned within 24 hours (same day as the laptop).
  • Multi-factor authentication enforced on every platform that supports it — which is all of them.
  • Service accounts and integration keys inventoried, with owners and rotation dates.
  • No shared logins. Any exception is documented, named, and reviewed quarterly.

4. Vendor Due Diligence

Every tool that touches personal data is a processor acting on your behalf — and your accountability travels with the data. When a vendor is acquired, changes sub-processors, or moves hosting regions, that's your compliance posture changing without anyone in the room deciding it.

  • A data processing agreement (DPA) in place with every vendor that touches personal data.
  • Each vendor's data residency, sub-processors, and breach-notification terms reviewed at contract and at renewal.
  • Vendor security posture checked before purchase — not discovered during an incident.
  • Annual review calendar: one vendor per month, rotated, so no contract renews uninspected.

Why These Four, and Not Forty

Most compliance frameworks bury marketing teams under controls designed for IT infrastructure. The four sections above cover the failure modes that actually happen in marketing automation:

  • Unlawful consent inheritance — the single biggest risk. Two tools merge, contact histories blend, and suddenly you're emailing people on the basis of a checkbox they never saw. The consent audit trail item exists specifically to prevent this.
  • Orphaned integrations — an API key from a departed agency still syncing data to a tool nobody pays for. Common, invisible, and a live breach vector.
  • Access drift — admins accumulate. Marketing grows, agencies rotate, someone "temporarily" gets full CRM rights. A year later, twenty people can export your entire customer database.
  • Vendor amnesia — you signed the DPA once. Since then the vendor was acquired, changed sub-processors twice, and moved hosting. Nobody noticed, because renewal auto-charged.

None of this requires enterprise tooling or a dedicated compliance hire. It requires proportionate controls, written down, owned by name, and reviewed on a calendar. That's also how regulators and enterprise customers assess you when they ask — not "do you have a policy", but "show me the last time you checked".

Making It Auditable

A checklist you "did in your head" has no value — in an audit, a breach investigation, or a customer's security questionnaire, only written evidence counts. Four artefacts make this checklist provable rather than performed:

  • A consent register — one row per source: form, import, webinar, list purchase (hopefully none). Source, lawful basis, wording version, date, and volume. When a contact's provenance is questioned, you answer in minutes, not archaeology.
  • A versioned data-flow diagram — dated, owned, and updated at every integration change. The version history itself becomes evidence that governance is live, not laminated.
  • An access review log — who was reviewed, what was removed, who signed it off. Quarterly entries, dated, with the departures shown deprovisioned within the 24-hour window.
  • A vendor register — DPA status, sub-processor list, data residency, next review date. One row per vendor; the rotation schedule lives here too.

If behavioural tracking and scoring are part of your stack, these artefacts also feed your DPIA — the assessment regulators expect for large-scale behavioural processing. Documenting it once and reviewing annually is dramatically cheaper than reconstructing it during a complaint.

Running the Review Without Burying the Team

A checklist only works if it's performed. Two mechanics make this one survivable:

  1. Attach it to a rhythm. Run the full checklist inside your existing governance rhythms that keep systems aligned — quarterly, same meeting, same owner. Standalone compliance reviews get skipped; embedded ones don't.
  2. Split by frequency. Consent suppression syncs and unsubscribe tests: monthly. Access reviews and data-flow map: quarterly. Vendor reviews: rolling monthly by rotation. Nothing in this list needs doing weekly.

The point is resilience, not paperwork. When something breaks — a breach, an audit, an algorithm update your governance system absorbs the shock of — the teams that recover fastest are the ones with current answers already written down.

The First 30 Days

If you're starting from zero, in order:

  1. Week 1: Inventory admin accounts and API integrations across every marketing tool. This alone closes the two most common holes.
  2. Week 2: Map consent sources — every form, import, and list origin — and suppress anything you can't evidence.
  3. Weeks 3–4: Draft the data-flow map, confirm DPAs with active vendors, and schedule the first quarterly review with named owners.

Thirty days of focused work replaces years of quiet exposure. That's the trade.

Start the evidence trail on day one, not after the first incident: the admin inventory from week 1 becomes the first access review log, the consent mapping from week 2 seeds the consent register, and the data-flow draft from week 3 is version one of the diagram. By day 30 you don't just have a cleaner stack — you have the four artefacts that prove it stays that way.

Websfarm runs this checklist with B2B tech teams as part of stack governance engagements: consent audit, access cleanup, vendor review, and the rhythms that keep them current. If you'd rather have it done with you than alone, get in touch.