2025 edition of the Practitioners' Guide (Assertion 10: Digital and Data Compliance) states:
All smaller authorities, by AGAR 2025/2026, must have:
A council-owned domain based official email address that's generic (and cease using free email)
A website that continues to meet accessibility regulations
An IT policy
And a reinforcement of compliance with UK GDPR and DPA responsibilities.