HTML — PaddleOCR-VL (Baidu)

Page 1 Download HTML

Navigating Assertion 10 Digital and Data Compliance

Martyn Boyle and David Hall Cloudy IT

Daniel Purchese Breakthrough Communications

Mark Tomkins Aubergine 262

Page 2 Download HTML

CloudyIT

Assertion 10 Compliance & understanding the Practitioners Guide.

Domain Names, Emails, GDPR, Websites & IT Policies

For parish & town clerks

Page 3 Download HTML

What we'll cover

Updates to SAPPP 2025 (formerly JPAG) Practitioners Guide - What the new governance requirement actually means to councils:

New Email & domain name requirements and best practice

Ensuring website accessibility compliance with the new WCAG2.2AA rules

UK GDPR and data protection responsibilities

IT policies and Assertion 10 explained: – and how it all fits in together – creating the digital and data scope and purpose.

Page 4 Download HTML

What's it all about?

2025 edition of the Practitioners' Guide (Assertion 10: Digital and Data Compliance) states:

All smaller authorities, by AGAR 2025/2026, must have:

A council-owned domain based official email address that's generic (and cease using free email)

A website that continues to meet accessibility regulations

An IT policy

And a reinforcement of compliance with UK GDPR and DPA responsibilities.

Page 5 Download HTML

Assertion 10 - Digital and data compliance

WHY? (added to clarify data compliance, previously covered under Assertion 3)

Assertion 10 will appear on the AGAR 2025-26 By then, the authority needs to have taken the following actions:

(1.47) Email management

Every authority must have a generic email account hosted on an authority-owned domain, for example:

clerk@abcparishcouncil.gov.uk or clerk@abcparishcouncil.org.uk

Not abcparishclerk@gmail.com or abcparishcouncil@outlook.com

Page 6 Download HTML

Councillors & other staff email addresses.

Strangely, Assertion 10 doesn't talk about Councillors and other staff email address compliance – just the clerk/officer.

Best practice is for all council to have matching email: Cllr.bobsmith@abcparishcouncil.gov.uk

Free email services are permitted currently but NOT personal: cllrbobsmith@gmail.com - OK

BUT NOT bigbobsmith1968@yahoo.co.uk = GDPR risk/loss of email data/comms

Page 7 Download HTML

Why is that important?

The Council does not own those free platforms or domain (Gmail, Yahoo, Hotmail etc)

The data contained in it is not really yours

The Council has no legal rights over it

Getting access without the logins is impossible

Creates a GDPR exposures with FOI & SAR issues

No authenticity of message – anyone can set up a free email address!

Page 8 Download HTML

The domain - Your address on the internet

It's your website address you use in a web browser, like Google Chrome and Safari for people to see your web pages and information – agendas, minutes, AGAR, news etc

AND

Your email address – the address that people use to send you an email.

Page 9 Download HTML

.gov.uk

It's the ultimate official domain for a Council.

Elevated level of security

Improves compliance

Improves GDPR – and FOI & SAR situations

Added benefits and security services

More professional

Improved authenticity of message

■ Can only be used managed by authorised organisations for added security & governance

.org.uk

It's an acceptable UK-based domain for a Council.

Elevated level of security above free emails

Helps with compliance

■ Improves GDPR – and FOI & SAR situations

■ Requires less scrutiny so = less official than .gov.uk

You can also use .com, .co.uk or other council-owned domain suffix but they are not within the UK jurisdiction managed by Nominet.

Page 10 Download HTML

Domains - recap

Stop using free email (Gmail/Hotmail/Yahoo etc)

Use a council-owned domain for your official email for the council & website

Get your .gov.uk domain for best practice

Other council-owned domains are currently acceptable, but website and email should match

Make sure you set enough in the budget/precept planning for these services

Make sure the domain name is registered to the council – not an individual.

Page 11 Download HTML

Website Accessibility Compliance - update

Regulations for all public sector bodies, incl parish & town councils' websites must meet WCAG2.1AA standard since 2020 Regulations rose to WCAG2.2AA in October 2024

You must have a compliant website

Regardless of the domain type, SAPPP '25 & Public Sector Website laws require compliance

You must have an up to date and relevant Accessibility Statement

Risks? Challenged by vexatious MOP, audit failure, withdrawal of your .gov.uk domain

Page 12 Download HTML

Website Accessibility tips

Ensure the website & the content you upload is accessible

Define your Accessibility Statement and include the things you know are not accessible – 3rd party documents, content older than 2018

Avoid using ‘accessibility plugins’ to achieve compliance – they aren’t enough

Have a checking process – use the free browser checker Wave by WEBAIM to check as you go

Make sure any forms are web page forms, not documents

Consider commissioning an accessibility audit to understand your position

Consider commissioning a purpose-built website from council website experts, Aubergine, that's .gov.uk-ready and fully compliant from £499 + VAT

Page 13 Download HTML

Website Accessibility tips

✓ Avoid using tables where possible

Add ALT text for images

Avoid embedding text on images

events need the salient info on the web page

✓ High Contrast

✓ Use structured headings (H1, H2, H3..)

✓ Make documents accessible before uploading

Forms need to be web forms, not PDFs Use descriptive link text (not 'click here'!)

Use descriptive link text (not 'click here')

✓ Avoid pasting URLs on the page

✓ Avoid overly styled text formatting

✓ Avoid ‘accessibility plugins’

✓ Avoid scans where possible (3^{rd} party documents/AGAR/ROI excluded)

✓ Have a regular checking process

✓ Revisit your accessibility statement

Page 14 Download HTML

Page 15 Download HTML

IT Policies & Assertion 10

What Assertion 10 requires in relation to IT policies

What the Practitioners' Guide says an IT policy must do

What “securely and legally” means in practice

How email and domains link back to the IT policy

Page 16 Download HTML

Assertion 10: IT Policy Requirements

“All smaller authorities (excluding parish meetings) must also have an IT policy.”

The IT policy must explain how authority business is conducted

■ Applies to clerks, members and other staff

Covers authority-owned and personal equipment

Page 17 Download HTML

Practitioners' Guide: Purpose of an IT Policy

Prevents misunderstandings when using IT equipment

Ensures there are no excuses for unsafe or insecure behaviour

Sets clear expectations for everyone in the authority

Templates must be personalised to reflect how the council actually works

Page 18 Download HTML

“Securely and Legally”: What That Means in Practice

What an IT Policy Must Explain

“How everyone should conduct authority business in a secure and legal way”

What is expected when using passwords and user accounts

▶ How personal and council devices may be used

▶ Rules for remote working and mobile access

How incidents, mistakes or concerns are reported

Page 19 Download HTML

IT Policies, Domains, Email & Data Protection

IT Policy sets the rules for how council business is done

Authority-owned domains establish ownership and control

Authority-owned email keeps communications in a managed environment

Data Protection compliance depends on all three working together

"Secure and legal use of IT underpins GDPR, FOI and SAR obligations."

Rebuilt HTML — PaddleOCR-VL (Baidu)