Six roles that share out authority for measurement delivery

Privacy-first measurement team roles should divide authority, not create a chain of vague consultations. Six roles that share out authority for measurement delivery cover the principal operational decisions. Each is named below and each is documented in UK public guidance.

The service owner, data protection officer and senior information risk owner hold decision authority. The performance analyst, delivery manager and accessibility specialist supply evidence and checks. A small organisation may combine jobs, but it should record which role a person was performing when they approved something.

Research date: 5 September 2026.

Inclusion: roles with a separate decision, evidence output or escalation duty in delivery.

Criteria: authority must be specific enough to accept, reject or stop work.

Geography: operating model for organisations in England, using mostly UK-wide official guidance.

Exclusions: salary benchmarks, headcount ratios, recruitment claims and supplier job titles.

The entries are non-ranked and do not prescribe employment status.

What to take away

1. Service owner (Government Service Manual)

The service owner owns the service boundary, priorities and the final release decision. Their output is an approved scope, resources, thresholds and a proceed, conditional proceed or hold decision.

The Government Service Manual, published by the Government Digital Service, describes a service owner as having decision authority and overall responsibility for operation and continual improvement on its service-team roles page. The same page lists product managers, delivery managers, user researchers and quality assurance testers, so the post sits inside a wider team.

The manual's requirement applies to government services. Other organisations can copy the accountability pattern without borrowing the title.

2. Data protection officer (ICO)

The privacy function maps collection purposes, device operations and personal information. It sets out lawful basis, transparency and rights. It also sets retention, transfers and role allocation. The output is a reasoned decision with conditions.

Where statutory criteria require a data protection officer, the ICO explains the position, tasks and independence in its DPO guidance. The ICO criteria cover public authorities, large-scale systematic monitoring and large-scale handling of special category data.

A DPO reports to the highest level of management and cannot be told how to do the job. Do not automatically call every privacy reviewer a DPO. Legal interpretation and organisational independence need qualified review.

3. Senior information risk owner (SIRO)

Security owns access design, credentials, logs and supplier assurance. It also owns recovery and the cyber incident route. An approval identifies residual risks and containment signals.

Government and NHS information risk guidance describes the senior information risk owner (SIRO) as a board-level post accountable for information risk. The NCSC says organisations using SaaS remain responsible for their own configuration and should prepare response and recovery processes in its SaaS operations guidance.

Security does not decide whether a metric is statistically sound or whether device access has permission.

4. Performance analyst (Government Service Manual)

The analyst owns metric definitions, test oracles, reconciliation, uncertainty and interpretation limits. They specify populations, periods, exclusions, duplicate handling and attribution logic. Their output is a versioned data contract and a quality statement that a decision owner can understand.

GOV.UK describes performance analysts as combining web analytics, financial data and user feedback to help teams understand service performance on the official role record cited above. The service manual lists performance analyst and business analyst as separate posts. Metric definitions often live in dbt, Looker's LookML or a Power BI measure file.

It is a public-service description, not evidence that every commercial team needs a full-time analyst.

5. Delivery manager (Government Service Manual)

The delivery manager owns the plan and the route to live. Developers and technical architects build the approved configuration, maintain environments and manage deployment and rollback.

That work supplies peer-review notes, test artefacts and a change log. Neither role can approve its own privacy or security exception.

The Government Service Manual's team setup guidance includes the skills to design, build and test a service, then deploy, host and support it live. Private teams should translate those capabilities into their own operating structure.

6. Accessibility specialist (Government Service Manual)

This role plans manual, automated and assistive-technology checks for dashboards, forms, evidence packs and support routes. They also make missing evidence visible and maintain the release checklist. Accessibility remains a whole-team responsibility, even with a specialist coordinating it.

GOV.UK's introductory accessibility guidance assigns responsibility across the service team and highlights the contribution of researchers, testers, developers and managers. Public sector bodies in England must meet WCAG 2.1 AA and publish an accessibility statement under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018, which GDS monitors.

A private organisation needs qualified advice on the law and appropriate coverage for its users.

Join the six roles with explicit handovers

For every state change, record sender, recipient, required input, accepted output and escalation time. The performance analyst hands a metric contract to implementation.

Implementation returns test evidence. The data protection officer and the senior information risk owner return decisions tied to the same version. The accessibility specialist returns defects and affected journeys. The service owner then makes the bounded release decision.

Name deputies and emergency authority. If the relevant specialist is unavailable, that should cause a hold or a pre-approved restricted route, not an undocumented substitution. Review the role map after reorganisations, supplier changes and incidents so departed staff do not retain access or unresolved ownership.

Before you act

Common questions

What does the service owner actually decide?

The service owner owns the service boundary, priorities and final release decision. Their output is approved scope, resources, thresholds and a proceed, conditional proceed or hold decision. The Government Service Manual describes the role as having decision authority and overall responsibility for operation and continual improvement.

Can a privacy reviewer be called a data protection officer?

Not automatically. The ICO explains the position, tasks and independence of a data protection officer where statutory criteria require one. Legal interpretation and organisational independence need qualified review, so the title is not a loose synonym for privacy reviewer.

What happens if a specialist is unavailable during delivery?

Name deputies and emergency authority in advance. An unavailable specialist should cause a hold or a pre-approved restricted route, not an undocumented substitution. That keeps decision authority explicit rather than relying on whoever is present.