Run a loyalty marketing quality checklist without guesswork

What to take away

This checklist can be used on its own. Teams planning campaign delivery can also consult the operations and delivery guide.

How does the checklist score each area?

Score each row out of 20. The reviewer writes the evidence next to the score. A missing document is a zero, not a promise.

Area	What counts as evidence	Score

| Data and consent | Purpose and data fields listed; lawful basis and privacy information recorded; PECR permission or qualifying soft opt-in evidenced for email or text; retention and partner sharing documented. | ___ / 20 | | Offer clarity | Reward and threshold match across the landing page, email and in-store card; expiry date consistent; eligibility and exclusions shown beside the offer; terms recorded. | ___ / 20 | | Creative claims | Every objective claim has a source or calculation; the 15% saving calculation retained where used; copy matches the offer terms; CAP Code claims check recorded. | ___ / 20 | | Channel fit | Each message mapped to a listed message moment; channel fits customer expectations; send-time and frequency rationale recorded; PECR permission checked where electronic marketing is used. | ___ / 20 | | Reporting | Named owner and fix log; reporting plan defines measures; platform report or export supports results; 30-day review records consent matches, complaints and reporting against the plan. | ___ / 20 |

Treat each listed criterion as a check. Split the row's 20 points equally across its checks and award points only where evidence is recorded; a check with no evidence scores zero.

A total of 70 or more means the scheme can launch. Below 70, the owner fixes the lowest row first. For example, a team paying £400 a month for a platform still fails the review if consent records are missing.

What does good data and consent look like?

Before processing personal data, identify a lawful basis under the UK GDPR and explain it in your privacy information. The lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. The ICO's lawful basis guidance explains how to choose and document the basis; consent or legitimate interests may suit some loyalty-scheme processing, depending on its purpose.

Write down the purpose, the data fields, and the retention period. If the scheme shares data with a partner brand, that sharing needs its own entry. Test the opt-in by reading it aloud: if a colleague cannot say what they agreed to, rewrite it.

The Privacy and Electronic Communications Regulations 2003 (PECR) apply to electronic marketing. For marketing emails or texts to individuals, obtain consent unless the limited soft opt-in applies: the details were collected during a sale or negotiations for a sale, the messages promote your own similar products or services, and an opt-out was offered when the details were collected and in each message.

Where your organisation must keep a record of processing activities under Article 30 UK GDPR, include the controller's name and contact details (and those of any representative and data protection officer, where applicable), purposes, categories of data subjects and personal data, recipients, international transfers, envisaged erasure periods and a general description of security measures. Keep the lawful-basis decision and consent or opt-out evidence with the record. Check the ICO's data protection fee self-assessment; if your organisation is not exempt and must pay, pay the fee and check the ICO's register of fee payers.

For campaigns in Great Britain, check targeting under the Equality Act 2010. Review whether criteria or exclusions could unlawfully discriminate on protected characteristics, and record the commercial rationale; a commercial reason alone does not make unlawful discrimination acceptable.

Are the offer and the creative telling the same story?

Compare the landing page, the email and the in-store card. The reward, the threshold and the expiry date must match on all three. A mismatch is the most common reason a review fails.

Check every number. If the copy says members save 15%, the reviewer needs the calculation behind it. The CAP Code, enforced by the Advertising Standards Authority (ASA), requires evidence for objective claims. Record the evidence for each claim and remove anything that cannot be traced to a source, a price list or a signed brief.

Then check the small print. Exclusions belong near the offer, not behind a second click. For a separate disclosure test, see the launch review checklist; the checks in this article are the core review for the campaign.

Does the channel suit the customer?

The channel question is simple: would this customer expect this message here? A push notification at 21:00 for a coffee reward fails the test. A receipt message at the till passes it.

Map each message to a moment. Sign-up, first purchase, reward earned, reward expiring and lapse. Five moments are enough for most schemes. Fewer moments mean fewer chances to annoy.

Review frequency. If a member receives more than one promotional message a week, the reviewer needs a reason. The DMA's customer engagement guidance treats relevance and timing as part of the discipline, not an afterthought.

Who owns the report and the fixes?

Name one owner for the checklist. That person keeps the fix log, dates each entry and closes items with evidence. Shared ownership is how items stay open for months.

Set the review date 30 days after launch. The review asks three questions: did consent records match the sign-ups, did any claim attract a complaint, and did the reporting match the plan?

Record the outcome in one page. A score, the fixes, the date and the owner. That page is the audit trail for the next review, and it takes ten minutes to write.

Common questions

How often should the checklist be run?

Run it before every launch and again 30 days after. Run the data and consent rows every quarter, because retention rules and partner arrangements change.

Who should sign it off?

The person accountable for the scheme, not the agency. A named internal owner keeps the evidence and answers the questions.

What if a row scores zero?

Fix that row before launch. A zero on data and consent or on offer clarity stops the campaign, regardless of the total score.

Does the checklist cover Scotland, Wales and Northern Ireland?

The UK GDPR, Data Protection Act 2018 and PECR apply across the UK. The Equality Act 2010 applies in Great Britain; Northern Ireland has separate equality legislation. For consumer-facing offers, use the Digital Markets, Competition and Consumers Act 2024 and the Competition and Markets Authority's guidance, and check any Northern Ireland-specific requirements before a campaign runs there.