Who owns what when a team runs email software

Email marketing software team roles are accountabilities, not a recommended headcount. A small organisation may combine duties, but the person who can stop a release must be clear and conflicts should be recorded.

This non-ranked role map was researched on 5 September 2026 for organisations operating in England. Roles were included when the operating workflow needs a distinct decision or evidence owner. It excludes salary data, staffing ratios, seniority claims and employment-status conclusions. No supplier or recruiter contributed.

What to take away

Roles are accountabilities, not headcount, so a small organisation may combine duties.
The person who can stop a release must be clear, and conflicts should be recorded.
Each role needs a name, delegate, evidence output and stop authority beside it.
Any decision that depends on an unnamed group is not ready for release.
Employment status is a separate question needing qualified employment and tax review.

1. Service owner

The service owner accepts the purpose, population, maximum exposure and operating model. They make the final release decision only after all specialist gates have a current result. The ICO's planning guidance supports naming responsibility early rather than leaving compliance to a software setting.

2. Campaign operator

The operator builds the approved content and audience, records configuration, runs acceptance tests and releases the signed version. They do not reinterpret an expired legal decision or substitute an old audience query. Their evidence includes the change log, test outcomes and release identifier.

3. Data and privacy owner

This role documents source, purpose, population, lawful-basis analysis, transparency, access and retention. It also owns the technical path by which objections reach every connected system. ICO preference guidance provides the regulatory basis for suppression controls, but the owner still needs qualified advice on the real data flow.

4. PECR reviewer

The PECR reviewer assesses the message, channel, subscriber category, collection circumstances and any tracking technology. Keep this decision separate from the UK GDPR lawful-basis record. The reviewer can pause the job when the evidence does not match the proposed recipients.

5. Content and claims owner

The content owner maps objective statements to dated evidence, checks qualifications and controls sender identity and disclosures. CAP's substantiation advice supports holding evidence before distribution. Commercial pressure does not remove this gate.

6. Accessibility reviewer

This person defines the environments and user interactions to test, records limitations and decides whether an unresolved barrier needs remediation. The Government Equalities Office service-provider guide covers Great Britain and explains anticipatory duties. It is not a pass mark for a template.

7. Security and platform administrator

The administrator manages access, configuration baselines, sending-domain controls, logs, rollback and recovery evidence. NCSC SaaS guidance makes customer responsibilities visible. Supplier claims and buyer observations must be stored separately.

8. Commercial and finance owner

This owner tracks scope, contract conditions, support routes, spend authority, renewal notice, exit evidence and continuity exposure. They can stop commitment when a mandatory export, support or liability issue is unresolved. A low invoice does not override another specialist rejection.

9. Complaint and incident lead

The lead triages recipient complaints, misdirected sends, suppression failures and security events. They preserve logs, assign communications and decide when specialist escalation is required. The ICO's breach guide supports assessment and documentation but is under review, so the live facts and current guidance control the response.

Employment status is a different question

These accountabilities do not determine whether someone is an employee, worker, self-employed contractor or office-holder. GOV.UK explains that employment status affects rights and employer responsibilities, while section 230 of the Employment Rights Act 1996 contains statutory definitions. Actual terms and working arrangements need qualified employment and tax review.

Put one name, delegate, evidence output and stop authority beside each role. Then test the hand-offs on a single proposed email. Any decision that depends on an unnamed group is not ready for release.

Before you act

Name one owner for each of the nine roles.
Record any conflicts between combined duties.
Check each specialist gate has a current result.
Test the hand-offs on a single proposed email.
Keep PECR and UK GDPR lawful-basis decisions separate.
Store supplier claims and buyer observations separately.

Common questions

When can the service owner make the final release decision?

Only after all specialist gates have a current result. The service owner accepts the purpose, population, maximum exposure and operating model, and the ICO planning guidance supports naming responsibility early rather than leaving compliance to a software setting.

What does the campaign operator need to record?

The operator builds the approved content and audience, records configuration, runs acceptance tests and releases the signed version. Their evidence includes the change log, test outcomes and release identifier. They must not reinterpret an expired legal decision or substitute an old audience query.

Does this role map decide whether someone is an employee?

No. These accountabilities do not determine whether someone is an employee, worker, self-employed contractor or office-holder. GOV.UK explains that employment status affects rights and employer responsibilities, and section 230 of the Employment Rights Act 1996 contains statutory definitions. Actual terms need qualified employment and tax review.