Running a branding engagement from defined job to controlled handover

A polished logo does not compensate for uncertain rights, an unsubstantiated claim, inaccessible artwork, exposed personal information or a missing handover route. Keep those gates separate and record every exception.

This guide concerns work delivered to organisations operating in England. Copyright, data protection and non-broadcast advertising sources cited here are UK-wide; contract interpretation may depend on the chosen law and facts. W3C material is a global technical reference. Public-service operating guidance is used as a design aid, not as a rule that governs private agencies.

Public-source research closed on 5 September 2026; no live project, client file or launch was inspected. Named commercial-contract, IP, advertising, privacy, security, accessibility and operations reviewers must check the real engagement before release.

What to take away

Define the job before opening production

An operational brief needs a decision, not a list of assets. State whose behaviour or understanding the work will change, which audiences and channels are eligible, what will not be addressed and who can approve a trade-off.

Record the current material, known rights, research provenance, brand names under consideration and any objective claims that might appear in public copy.

Attach a service definition with:

The Intellectual Property Office explains that a commissioner does not automatically become the first copyright owner of commissioned work unless the parties agree otherwise in writing. Its ownership guidance is a reason to resolve rights in the actual contract, not proof that either party owns a particular file.

Use controlled states, not a busy status column

The work queue should show what has been proved. A compact state model is easier to audit than labels such as "almost done".

1. Intake and quarantine

The engagement owner admits only a signed brief, authorised contacts and an asset register. Unverified fonts, photographs, research data, testimonials, existing marks or third-party files stay quarantined. The output is a logged scope with unresolved items and an owner for each.

For a completed state register, one row might read:

Stop if the client identity, authority to instruct, audience or intended channels are unclear. The restart authority is the accountable client decision maker after the missing evidence arrives.

2. Discovery and evidence definition

The research owner writes questions, source boundaries and a method before drawing conclusions. Observations, participant statements, supplier claims and agency interpretations occupy different fields. Personal information is collected only through an agreed route.

The ICO's data protection by design guidance says controllers must consider privacy from the start. It explains that a service provider may be a processor, joint controller or have no processing role, depending on the facts. A job title or contract label cannot decide that relationship.

3. Strategy decision

The client owner accepts the problem statement, eligible audience, evidence limits, options and explicit assumptions. The record should show why the chosen route was preferred over retaining the current identity or making a smaller change. It should also list the facts that would reopen the decision.

Approval at this state does not clear creative execution, legal rights or publication. It means only that the strategic choice and its evidence are accepted.

4. Concept development

The creative lead issues versioned concepts against the accepted brief. Each file carries its creator, source assets, permitted use and unresolved questions. The account or delivery lead logs client comments as decisions, not as overwritten emails.

Freeze work when a requested change adds an audience, language, channel, claim or deliverable. The change owner assesses time, price, rights and review consequences before production resumes.

5. Independent gates

Specialist reviewers evaluate their own evidence. None can trade a failure for a strong score elsewhere.

A qualified reviewer records pass, fail, conditional pass or not applicable, with reasons. "Not checked" is not equivalent to "not applicable".

6. Production and preflight

Production converts accepted concepts into the contracted variants. Preflight compares every output with its source decision and delivery specification. The evidence might include filenames, dimensions, colour profiles, copy versions, licences, alt text, reading order, link destinations and approval references, depending on the asset.

Use synthetic fixtures for workflows that involve personal information unless properly authorised data is essential and approved. A defect returns to its producing state with an owner. Do not repair a master file without recording the new version and invalidating affected exports.

7. Client acceptance

Acceptance belongs to a named authorised person. They receive the agreed sample, criteria, known limitations and exception register. Silence, use of a preview link or payment of an invoice should not be treated as acceptance unless the contract expressly and lawfully says so.

Government contract-management principles advocate outcome ownership, controlled change and performance reporting for public contracts. Private buyers can use those ideas, but must define their own terms, remedies and authority.

8. Release and observation

The release owner confirms the destination, scheduled version and rollback copy. Publish only assets included in the release manifest. Capture the time, person, channel and checksum or platform version where available.

The Government Service Manual recommends linking measures to a service purpose and using them to guide improvement. Its performance-metrics page applies to government services, so a private branding programme must define its own denominators, baselines and decision thresholds.

9. Correction, incident and withdrawal

Give recipients one route to report broken, inaccurate, inaccessible, misleading or misdirected material. Triage should distinguish a normal defect from a security event or possible personal-data breach.

NCSC incident-management guidance recommends defined roles, escalation criteria, decision authority and links to continuity arrangements.

The ICO's personal-data-breach guide explains that organisations must record personal-data breaches and assess notification duties. A qualified privacy lead, not the creative team, should make the case-specific assessment.

Contain first when continued distribution could increase harm. Preserve the original evidence, identify every affected variant, notify authorised owners and log the decision to correct, withdraw or resume. Only the named restart authority can reopen the route.

10. Handover and exit

The final package should match the contract, not the contents of an individual's desktop. Provide accepted masters and exports, rights and source registers, brand rules, test reports, open issues, renewal dates, access transfer, deletion evidence and a contact for later corrections.

Revoke temporary access and confirm how agency copies, personal data and confidential drafts will be returned, retained or deleted. Keep enough records to explain decisions, but do not keep personal information indefinitely merely because storage is available.

Assign authority before pressure arrives

Name the decision roles your scope needs, including engagement owner, client decision owner, delivery controller, creative owner, evidence owner, rights reviewer, privacy contact, accessibility reviewer, security contact and release authority. One person may hold several in a small agency, but the decisions must stay visible.

Government's service-team role guidance describes multidisciplinary public-service teams and places final quality responsibility with the service owner. It is useful evidence for separating work and decision authority, not a staffing mandate for this sector.

The ICO says a data protection officer is mandatory only in specified circumstances. Its DPO guidance also says an organisation needs sufficient people and resources whether or not it must appoint one. Record the assessment instead of casually giving someone a statutory title.

Write service measures that can be reconstructed

Avoid promises such as "fast response" or "high quality". For each agreed measure record the eligible population, event, numerator, denominator, unit, clock start, clock stop, timezone, exclusions, data source, owner, reporting interval, tolerance, remedy and review date.

For example, a first-response measure might be recorded as:

No universal target is supplied here. A response clock might pause for a documented client dependency, but only if the contract says so. A completion rate requires both completed items and an eligible denominator. A claim about accuracy needs a defined sample and adjudication method.

Track exceptions beside the headline measure. Repeated late inputs, inaccessible proofs or disputed acceptances are operational facts that an average can hide. When the definition changes, begin a new series or restate the earlier period transparently.

Keep the evidence useful after launch

Hold a short operational review at the interval agreed for the work. Examine defects, exceptions, rights expiries, access, unresolved client decisions, complaints, corrections and changed sources. Record who attended, what was decided and when the next check is due.

The workflow should stop when evidence becomes unreliable, authority disappears, rights expire, a gate fails or continued release could increase harm. Restart only after the cause is corrected, affected outputs are retested and an authorised person signs the new evidence. That record, rather than a reassuring status label, is what makes delivery defensible.

Next step

Before the first real asset enters production, create the state register and assign one owner to every transition. Leave thresholds blank until the parties agree their units and evidence. Keep the whole engagement on publication hold until named specialists have reviewed the actual contract, files, systems and release route.

Before you act

Common questions

Who owns copyright in commissioned branding work?

The commissioner does not automatically own it. Copyright stays with the creator unless the contract says in writing that it is assigned or licensed.

What does strategic approval actually clear?

Approval at the strategy decision state means only that the strategic choice and its evidence are accepted. It does not clear creative execution, legal rights or publication. The record should show why the chosen route was preferred and what facts would reopen the decision.

How should a possible personal-data breach be handled?

Contain it first if further distribution could increase harm, preserve the evidence and log the decision. A qualified privacy lead assesses whether it must be recorded or notified.