Review the permission record before the import.

Ask where each audience came from

Begin with the collection source. Newsletter forms, event registrations, account records and partner files can carry different expectations. Record who collected the addresses, when, which notice was displayed and the stated purpose. Split combined files by source rather than giving the entire audience one label.

For this marketing workflow, require documented permission covering the intended promotional messages. A publicly displayed address, a purchased file, an existing business relationship or a successful mailbox verification does not provide that record by itself. Where the source or scope is unclear, hold the batch out of the active marketing audience until an appropriate review resolves it.

Build a record another reviewer can understand

Keep evidence in your authorised system with suitable access controls. The public worksheet should contain a generic description or internal reference, without real email addresses or copies of personal records.

Record the scope in ordinary language. A consent=yes label is less useful than the message purpose and notice version. Avoid unnecessary identity documents or sensitive information. Keep evidence accessible to authorised reviewers without copying it into every campaign brief.

Use a three-way import decision

1. Approve the supported subset

   The collection context and promotional scope are documented, current subscription status is reconciled, and the intended campaign matches the record. Import only the fields needed for that purpose and verify the mapped audience rules.

2. Hold the unresolved subset

   The source, notice, scope or current status is missing or contradictory. Keep it out of active marketing selection while the responsible reviewer checks the evidence. Do not invent a collection date to fill a required column.

3. Exclude the unsupported subset

   The records are withdrawn, otherwise excluded or unsupported for the proposed marketing use. Preserve the appropriate exclusion control in your authorised workflow so a later file does not accidentally reactivate them. Decide any retention or deletion requirements separately.

Then check the technical import

After the audience decision, inspect the file structure. Remove unnecessary columns, check duplicates and map only needed fields. Confirm language, tag and subscription-status mapping. Retain a useful source label so later reviewers can identify the collection context.

Compare the number of source records, excluded records, duplicates and approved records. Any difference should have an explanation before you send. Review a small authorised sample in your workspace to check field mapping and audience selection. A successful import is a technical result; it does not demonstrate permission, establish legal compliance or guarantee delivery.

• Preserve the latest withdrawal and exclusion status when merging records.
• Do not overwrite an unknown permission date with the import date.
• Use synthetic examples when discussing the mapping outside the authorised system.
• Check the final campaign audience again after the import review is complete.

Use Kenya’s regulator resources for the wider review

The Office of the Data Protection Commissioner publishes a guidance index with resources on consent, registration, cross-border transfers and other topics. Consult the relevant current documents for your organisation and collection context. This page addresses an operational checkpoint before marketing import; it does not determine registration duties, the legal basis for every message, retention or transfer safeguards.

Revisit the decision when notices, partners or message purposes change, or exclusions cannot be reconciled. The outcome is a supported audience decision the sender can follow, with unresolved batches held outside the campaign.