Rebuilt HTML — PaddleOCR-VL (Baidu)
Semantic HTML reconstructed from the OCR item tree (headings, text, lists, tables, form fields). overlay · view JSON
Navigating Assertion 10 Digital and Data Compliance
Martyn Boyle and David Hall Cloudy IT
Daniel Purchese Breakthrough Communications
Mark Tomkins Aubergine 262
CloudyIT
Assertion 10 Compliance & understanding the Practitioners Guide.
Domain Names, Emails, GDPR, Websites & IT Policies
For parish & town clerks
What we'll cover
Updates to SAPPP 2025 (formerly JPAG) Practitioners Guide - What the new governance requirement actually means to councils:
- New Email & domain name requirements and best practice
- Ensuring website accessibility compliance with the new WCAG2.2AA rules
- UK GDPR and data protection responsibilities
- IT policies and Assertion 10 explained: – and how it all fits in together – creating the digital and data scope and purpose.
What's it all about?
2025 edition of the Practitioners' Guide (Assertion 10: Digital and Data Compliance) states:
All smaller authorities, by AGAR 2025/2026, must have:
- A council-owned domain based official email address that's generic (and cease using free email)
- A website that continues to meet accessibility regulations
- An IT policy
- And a reinforcement of compliance with UK GDPR and DPA responsibilities.
Assertion 10 - Digital and data compliance
WHY? (added to clarify data compliance, previously covered under Assertion 3)
Assertion 10 will appear on the AGAR 2025-26 By then, the authority needs to have taken the following actions:
(1.47) Email management
Every authority must have a generic email account hosted on an authority-owned domain, for example:
clerk@abcparishcouncil.gov.uk or clerk@abcparishcouncil.org.uk
Not abcparishclerk@gmail.com or abcparishcouncil@outlook.com
Councillors & other staff email addresses.
Strangely, Assertion 10 doesn't talk about Councillors and other staff email address compliance – just the clerk/officer.
Best practice is for all council to have matching email: Cllr.bobsmith@abcparishcouncil.gov.uk
Free email services are permitted currently but NOT personal: cllrbobsmith@gmail.com - OK
BUT NOT bigbobsmith1968@yahoo.co.uk = GDPR risk/loss of email data/comms
Why is that important?
- The Council does not own those free platforms or domain (Gmail, Yahoo, Hotmail etc)
- The data contained in it is not really yours
- The Council has no legal rights over it
- Getting access without the logins is impossible
- Creates a GDPR exposures with FOI & SAR issues
- No authenticity of message – anyone can set up a free email address!
The domain - Your address on the internet
It's your website address you use in a web browser, like Google Chrome and Safari for people to see your web pages and information – agendas, minutes, AGAR, news etc
AND
Your email address – the address that people use to send you an email.
.gov.uk
It's the ultimate official domain for a Council.
- Elevated level of security
- Improves compliance
- Improves GDPR – and FOI & SAR situations
- Added benefits and security services
- More professional
- Improved authenticity of message
- ■ Can only be used managed by authorised organisations for added security & governance
.org.uk
It's an acceptable UK-based domain for a Council.
- Elevated level of security above free emails
- Helps with compliance
- ■ Improves GDPR – and FOI & SAR situations
- ■ Requires less scrutiny so = less official than .gov.uk
You can also use .com, .co.uk or other council-owned domain suffix but they are not within the UK jurisdiction managed by Nominet.
Domains - recap
- Stop using free email (Gmail/Hotmail/Yahoo etc)
- Use a council-owned domain for your official email for the council & website
- Get your .gov.uk domain for best practice
- Other council-owned domains are currently acceptable, but website and email should match
- Make sure you set enough in the budget/precept planning for these services
- Make sure the domain name is registered to the council – not an individual.
Website Accessibility Compliance - update
- Regulations for all public sector bodies, incl parish & town councils' websites must meet WCAG2.1AA standard since 2020 Regulations rose to WCAG2.2AA in October 2024
- You must have a compliant website
- Regardless of the domain type, SAPPP '25 & Public Sector Website laws require compliance
- You must have an up to date and relevant Accessibility Statement
- Risks? Challenged by vexatious MOP, audit failure, withdrawal of your .gov.uk domain
Website Accessibility tips
- Ensure the website & the content you upload is accessible
- Define your Accessibility Statement and include the things you know are not accessible – 3rd party documents, content older than 2018
- Avoid using ‘accessibility plugins’ to achieve compliance – they aren’t enough
- Have a checking process – use the free browser checker Wave by WEBAIM to check as you go
- Make sure any forms are web page forms, not documents
- Consider commissioning an accessibility audit to understand your position
- Consider commissioning a purpose-built website from council website experts, Aubergine, that's .gov.uk-ready and fully compliant from £499 + VAT
Website Accessibility tips
- ✓ Avoid using tables where possible
- Add ALT text for images
- Avoid embedding text on images
- events need the salient info on the web page
- ✓ High Contrast
- ✓ Use structured headings (H1, H2, H3..)
- ✓ Make documents accessible before uploading
- Forms need to be web forms, not PDFs Use descriptive link text (not 'click here'!)
- Use descriptive link text (not 'click here')
- ✓ Avoid pasting URLs on the page
- ✓ Avoid overly styled text formatting
- ✓ Avoid ‘accessibility plugins’
- ✓ Avoid scans where possible (3^{rd} party documents/AGAR/ROI excluded)
- ✓ Have a regular checking process
- ✓ Revisit your accessibility statement
IT Policies & Assertion 10
- What Assertion 10 requires in relation to IT policies
- What the Practitioners' Guide says an IT policy must do
- What “securely and legally” means in practice
- How email and domains link back to the IT policy
Assertion 10: IT Policy Requirements
- “All smaller authorities (excluding parish meetings) must also have an IT policy.”
- The IT policy must explain how authority business is conducted
- ■ Applies to clerks, members and other staff
- Covers authority-owned and personal equipment
Practitioners' Guide: Purpose of an IT Policy
Prevents misunderstandings when using IT equipment
Ensures there are no excuses for unsafe or insecure behaviour
Sets clear expectations for everyone in the authority
Templates must be personalised to reflect how the council actually works
“Securely and Legally”: What That Means in Practice
What an IT Policy Must Explain
“How everyone should conduct authority business in a secure and legal way”
What is expected when using passwords and user accounts
▶ How personal and council devices may be used
▶ Rules for remote working and mobile access
How incidents, mistakes or concerns are reported
IT Policies, Domains, Email & Data Protection
IT Policy sets the rules for how council business is done
Authority-owned domains establish ownership and control
Authority-owned email keeps communications in a managed environment
Data Protection compliance depends on all three working together
"Secure and legal use of IT underpins GDPR, FOI and SAR obligations."