Operations
Part of Running social listening operations with access, rights and recovery kept apart
Who owns what in a social listening team: six roles and their evidence
Set out six social listening team roles, from service owner to security, covering source access, privacy, IP, analytical quality and evidence ownership.
These six social listening team roles separate decisions that are often hidden inside one analyst's job. Small organisations can combine posts, but each decision still needs an identified owner and an independent challenge where the risk warrants it.
What to take away
- Each social listening decision needs a named owner and independent challenge where risk warrants it.
- Six roles separate decisions often hidden inside one analyst's job, from service ownership to security.
- Small organisations can combine posts but must still identify owners and provide independent challenge.
- Accessibility and worker safeguards cut across all roles and need named specialists, not assumptions.
- Role combinations must be disclosed when one person would approve their own high-impact work.
How the roles were selected
brandsignal.co.uk's editorial desk reviewed public records on 5 September 2026. A role was included if a distinct operational decision had its own authoritative UK guidance or first-party source condition and could stop delivery.
The list excludes sales, campaign creation and platform publishing, and it is non-ranked, received no supplier payment and has no affiliate links. No workplace or system was inspected; it is a governance design, not proof of staffing sufficiency.
1. Service owner
This person approves the listening purpose, budget, risk boundary, recipients and stop or restart decision. They commission work but do not self-certify every analytical output. The 2025 AQuA Book, written for government analysis, distinguishes commissioner, analyst, assurer and approver and calls for proportionate independent assurance. A private team can adapt that separation without claiming government conformance.
Evidence owned: release record, risk decision, exceptions and signed change log.
2. Source-access custodian
The custodian maintains contracts, approved uses, API or supplier routes, fields, display rules, retention and change dates. They can suspend one feed without closing unrelated analysis. X's developer policy says approved use and continuing policy duties matter to access. That global first-party record applies to direct X arrangements, not automatically to every reseller contract.
Evidence owned: source register, entitlement artefacts, outage record and last terms check.
3. Privacy and rights lead
This lead maps data roles, purpose, transparency, retention and routes for access, objection, correction, restriction or erasure. They decide when specialist advice is needed and track actions across exports and integrations. ICO erasure guidance makes clear that the right is qualified and discusses notifying recipients. It is under review after the DUAA, so publication-day checking is essential.
Evidence owned: privacy decision, case log, system map and propagation result.
4. IP and report editor
This editor challenges copied text, images, screenshots, quotation length, attribution and audience. They also make uncertainty and source gaps understandable. GOV.UK's copyright overview explains general permission and exception boundaries but cannot resolve a specific extract. Qualified IP review remains necessary.
Evidence owned: extract register, permission or reviewed exception, report version and corrections.
5. Query and classification assurer
The assurer is separate from the person who designed the consequential analysis. They inspect test cases, sample selection, codebook, disagreements, automated labels and decision limitations. Their job is not to make an error percentage look favourable. The AQuA source above supports independent, proportionate assurance and the distinction between verification and validation.
Evidence owned: query version, adjudicated sample, assurance statement and unresolved uncertainty.
6. Security and resilience lead
This lead controls privileged access, logging, supplier evidence, incident escalation, continuity and recovery exercises. The NCSC's incident-management collection separates response processes, team capability, technical work and maintenance. It does not certify a listening service.
Evidence owned: access register, incident plan, exercise record, recovery decision and lessons log.
Accessibility and worker safeguards cut across these posts. The service owner must assign named specialists rather than assume the report editor or security lead covers them. Deputies need authority, training and access before an absence, and role combinations must be disclosed wherever one person would otherwise approve their own high-impact work.
Before you act
- Identify an owner for each of the six decisions.
- Assign named accessibility and worker safeguard specialists.
- Give deputies authority, training and access before absences.
- Disclose role combinations that create self-approval risk.
- Check privacy guidance on publication day after DUAA changes.
- Record evidence for each role as listed.
Common questions
Can one person hold multiple roles in a social listening team?
Yes, small organisations can combine posts, but each decision still needs an identified owner and independent challenge where risk warrants it. Role combinations must be disclosed wherever one person would otherwise approve their own high-impact work.
What evidence does the service owner need to keep?
The service owner owns the release record, risk decision, exceptions and signed change log. They approve the listening purpose, budget, risk boundary, recipients and stop or restart decision, but do not self-certify every analytical output.
Why is the privacy and rights lead role important?
This lead maps data roles, purpose, transparency and retention. They also map routes for access, objection, correction, restriction or erasure. They decide when specialist advice is needed and track actions across exports and integrations, using ICO erasure guidance that is under review after the DUAA.
