Getting Marketing, IT and Legal Through a Website Project

Last updated: October 2026. Mid-sized website programmes in Johannesburg rarely miss launch dates because a developer was sick. They slip because legal first sees the contact form in week nine, IT discovers SSO was assumed but not spec’d, and marketing has already announced the relaunch to the sales force. Each group is reasonable alone; together without a RACI they become serial bottlenecks.

Dsignr Digital runs kickoffs with marketing, IT and legal in the same room — or the same Teams call — before visual design starts. That is not bureaucracy. It is how you avoid rebuilding the homepage because the cookie banner text was wrong for POPIA.

Mid-market companies often have capable people in each function who have never shipped a web programme together. The kickoff’s job is to introduce them on purpose, with decisions — not to “socialise” a deck everyone forgets.

If you are assembling the business case, pair this article with how long corporate website builds take and add two to four weeks of calendar buffer for governance you actually use.

Stakeholder alignment is also how you protect agency budget. Every week of internal indecision is a week of retained project management and dev capacity you still pay for — or scope cuts that hurt launch quality. Executives notice slippage; they rarely see the inbox threads that caused it.

Start with a shared problem statement: “Our site cannot safely support campaign X, integration Y, and POPIA expectation Z.” That frames IT and legal as enablers of a revenue or risk outcome, not as veto players in a branding exercise.

Replace vague “stakeholder approval” with a RACI matrix everyone signs in week one:

A = Accountable (one throat to choke), R = Responsible (does the work), C = Consulted, I = Informed. Only one A per row.

A national professional services firm with ~180 staff used this matrix after a prior project where IT refused production DNS cutover because penetration testing was “news”. Marketing was Accountable for launch date; IT was Accountable for security gate; Legal was Accountable for consent copy. Decisions logged in steering notes replaced Slack threads that nobody could audit.

Without RACI, agencies become accidental mediators between departments — billable time spent chasing signatures instead of shipping templates. Put escalation to the executive sponsor in writing when Consulted parties do not respond within agreed SLAs (typically three business days for template review, longer for legal policy alignment).

Publish the RACI in the project wiki and again in every steering invite. New joiners — common after reorgs — should not reset decisions because they were not in kickoff. Version the RACI when scope changes; do not let it rot while the site grows new templates.

When marketing and IT disagree on CMS plugin policy, the executive sponsor picks a risk posture: fewer plugins with tighter change control, or richer features with monthly patch cadence. Unresolved tension becomes a silent freeze on content publishing after go-live.

IT teams are not blockers when they receive requirements early. Give them this checklist in the kickoff pack:

• Environment model — Dev, staging, production; who can deploy; whether production content sync is allowed.
• Hosting and data residency — Provider, region, backup frequency, restore test date, WAF/CDN expectations.
• Identity and access — CMS roles, MFA for admins, break-glass accounts, offboarding when staff leave.
• Integrations — API keys, IP allow lists, OAuth apps, service accounts — with named owners in IT and marketing ops.
• Monitoring — Uptime alerts, error logging, security update cadence for CMS and plugins.
• Change windows — Blackout periods (year-end, peak retail, audit seasons) when go-live is forbidden.

A industrial supplier rebuilding after acquisition needed SAP product data on the public catalogue. IT required a read-only middleware layer rather than direct ERP exposure — a sensible constraint marketing did not know to mention. Discovery captured it; design never showed a “live ERP stock” widget that would have failed security review.

Reference Google’s guidance on site security for HTTPS, malware and hacked content — not because Google is your CISO, but because security failures become search and reputational incidents. IT sign-off should include TLS chain, HSTS where appropriate, and admin URL hardening.

Document “minimum viable launch” versus “phase two” integrations so IT can approve a bounded first release. Perfectionism hidden until UAT is how programmes die in staging.

Ask IT to name a single integration counterpart and a single infrastructure counterpart — not a mailing list. Mail lists produce diffusion of responsibility; projects wait for “someone from infra” while agencies hold sprint capacity.

If your organisation runs formal vendor risk assessments, start them at RFP award, not at go-live week. We have watched corporate launches move month-on-month because a checkbox security portal was opened late. IT can give marketing a realistic gate date once the assessment template is in flight.

Legal teams care about what the live site does, not what the policy PDF promises. Align on:

• Lawful basis and consent — Which forms collect personal information, what tick boxes are required, how consent is logged and exported.
• Cookie and tracking — Categories, default state, relationship to marketing tags; alignment with internal records of processing.
• Data processors — Hosting, CRM, email, analytics — and contracts with sub-processors.
• Retention — How long form submissions and analytics data are kept; deletion workflows.
• Accessibility — Reasonable accommodation for users; WCAG failures can create reputational and contractual risk in B2G and enterprise sales.
• Archiving — Whether legal needs static snapshots of key pages at launch for regulatory comparison.

POPIA enforcement and guidance evolve; the Information Regulator expects organisations to demonstrate accountability. Website rebuilds are a common moment to fix consent banners that marketing added years ago without records. Treat the rebuild as a chance to align privacy policy, cookie notice and live tags — not three unrelated workstreams.

A healthcare-adjacent corporate with 90 staff had separate disclaimers on PDFs and web pages — legal spent two sprints reconciling wording once we exported every template into a single review doc. Doing that in week two would have saved a month.

Legal should review form field lists and auto-reply emails, not every blog post. Marketing owns editorial accuracy; legal owns regulated claims on product pages. Define which templates require legal Consulted versus Inform only.

Schedule legal review slots in the project plan — two hours fortnightly beats an emergency “stop everything” review the day before launch. Legal teams are small; treating them as a surprise gate guarantees delay.

Where marketing uses third-party embeds (maps, stock widgets, social feeds), legal and IT should agree on whether those processors appear in records of processing. Rebuilds expose shadow embeds that accumulated over years; inventory them in week one.

Marketing must own outcomes — pipeline, brand, content calendar — but not every technical task. Clarify:

• Product owner — One named person with authority to accept sprints; backup when they travel.
• Content supply — Who writes, who approves divisional pages, deadline for migration-ready copy.
• Brand guardrails — Design system usage for campaigns so microsites do not rot the main rebuild investment.
• Analytics — Event dictionary, UTM standards, dashboard owner post-launch.
• Training — CMS editors identified; office hours scheduled in hypercare.

Marketing directors at a B2B tech company with 220 employees often sit on fifteen committees. We assign a single product owner with four hours per week protected for decisions — otherwise “we’ll revert Monday” becomes never. Steering meetings stay fortnightly; ad-hoc requests go through change control.

Rebuild success is measured in leading indicators: form completion rate, time-to-publish for news, organic visibility on priority service lines — not only “site live”. Connect KPIs to SEO and trust-building so stakeholders see why technical choices matter.

When marketing owns too much technical detail without IT partnership, you get shadow IT plugins. When IT owns editorial flow, pages stall. RACI keeps each function in its lane.

Prepare sales and channel partners before launch — not after. A rebuilt site changes URLs, PDF paths and product naming. Marketing comms should include a “what changed for customer-facing teams” brief so call centre scripts match the live estate.

If you are replacing a site that failed, acknowledge internally what will be different this time: named owners, steering minutes, and change control. Teams sceptical of “another website project” cooperate when they see decisions logged, not relitigated in email.

Use a 90-minute kickoff with mandatory attendees from marketing (product owner), IT (infrastructure + integrations), legal (privacy), and procurement if applicable:

1. Outcomes and KPIs (15 min) — What changes for the business by launch +90 days.
2. RACI walkthrough (15 min) — Sign off Accountable names; no anonymous “team”.
3. Integration and security constraints (20 min) — IT lists non-negotiables and environment access dates.
4. POPIA and forms (15 min) — Legal confirms consent approach; agency shows draft form components.
5. Timeline and decision gates (15 min) — Wireframe, design system, UAT, legal template review, go-live.
6. Risks and communications (10 min) — Blackout dates, internal announcement plan, sales enablement.

Record decisions and circulate within 24 hours. Ambiguity lives in verbal “we’ll be flexible” — flexibility without owners is delay.

Agencies should leave kickoff with staging access tickets filed, analytics read access confirmed, and the next steering date booked. If legal cannot attend, schedule a dedicated POPIA session in the same week — not “later”.

Choosing a studio that has delivered corporate programmes reduces stakeholder friction — see Dsignr Digital work and our approach on responsive web design with governance baked in.

End kickoff with visible homework: IT opens firewall tickets, legal confirms consent copy owner, marketing delivers analytics access, procurement confirms contract path. Homework with due dates beats polite nods.

Repeat the same agenda at phase gates — IA approval, design system approval, UAT entry — so new risks do not appear only at go-live. Stakeholder alignment is not a one-off workshop; it is a rhythm until hypercare ends.

Book internal alignment before you book design sprints. Send RACI draft and integration list to IT and legal this week.

Book a call to run a stakeholder-ready kickoff agenda with Dsignr Digital, or request a quote once your RACI owners are named.

Alignment is cheaper than rework. One week spent locking RACI, POPIA and integration gates saves multiple weeks of design churn — and protects the trust your executives placed in the relaunch. Bring the RACI to your next leadership meeting; visibility prevents surprise vetoes.