===== PAGE 1 =====
## Navigating Assertion 10 Digital and Data Compliance

Martyn Boyle and David Hall

Cloudy IT

Daniel Purchese

Breakthrough Communications

Mark Tomkins

Aubergine 262

<div style="text-align: center;"><img src="imgs/img_in_image_box_255_1678_939_1935.jpg" alt="Image" width="19%" /></div>


<div style="text-align: center;"><img src="imgs/img_in_image_box_1177_1681_2144_1868.jpg" alt="Image" width="27%" /></div>


<div style="text-align: center;"><img src="imgs/img_in_image_box_2391_1689_3225_1884.jpg" alt="Image" width="23%" /></div>


===== PAGE 2 =====
<div style="text-align: center;"><img src="imgs/img_in_image_box_293_731_753_819.jpg" alt="Image" width="13%" /></div>


<div style="text-align: center;"><img src="imgs/img_in_image_box_811_725_1173_860.jpg" alt="Image" width="10%" /></div>


CloudyIT

## Assertion 10 Compliance & understanding the Practitioners Guide

## Domain Names, Emails, GDPR, Websites & IT Policies

For parish & town clerks

===== PAGE 3 =====
## What we'll cover

Updates to SAPPP 2025 (formerly JPAG) Practitioners Guide - What the new governance requirement actually means to councils:

New Email & domain name requirements and best practice

Ensuring website accessibility compliance with the new WCAG2.2AA rules

UK GDPR and data protection responsibilities

IT policies and Assertion 10 explained: – and how it all fits in together – creating the digital and data scope and purpose.

===== PAGE 4 =====
## What's it all about?

2025 edition of the Practitioners' Guide (Assertion 10: Digital and Data Compliance) states:

All smaller authorities, by AGAR 2025/2026, must have:

A council-owned domain based official email address that's generic (and cease using free email)

A website that continues to meet accessibility regulations

An IT policy

And a reinforcement of compliance with UK GDPR and DPA responsibilities.

===== PAGE 5 =====
## Assertion 10 - Digital and data compliance

WHY? (added to clarify data compliance, previously covered under Assertion 3)

Assertion 10 will appear on the AGAR 2025-26 By then, the authority needs to have taken the following actions:

### (1.47) Email management

Every authority must have a generic email account hosted on an authority-owned domain, for example:

clerk@abcparishcouncil.gov.uk or clerk@abcparishcouncil.org.uk

Not abcparishclerk@gmail.com or abcparishcouncil@outlook.com

===== PAGE 6 =====
## Councillors & other staff email addresses

Strangely, Assertion 10 doesn't talk about Councillors and other staff email address compliance – just the clerk/officer.

<div style="text-align: center;"><img src="imgs/img_in_image_box_232_1378_400_1508.jpg" alt="Image" width="4%" /></div>


Best practice is for all council to have matching email: Cllr.bobsmith@abcparishcouncil.gov.uk

<div style="text-align: center;"><img src="imgs/img_in_image_box_234_1579_401_1718.jpg" alt="Image" width="4%" /></div>


Free email services are permitted currently but NOT personal: cllrbobsmith@gmail.com - OK

<div style="text-align: center;"><img src="imgs/img_in_image_box_250_1867_379_1991.jpg" alt="Image" width="3%" /></div>


BUT NOT bigbobsmith1968@yahoo.co.uk = GDPR risk/loss of email data/comms

===== PAGE 7 =====
## Why is that important?

The Council does not own those free platforms or domain (Gmail, Yahoo, Hotmail etc)

The data contained in it is not really yours

The Council has no legal rights over it

Getting access without the logins is impossible

Creates a GDPR exposures with FOI & SAR issues

No authenticity of message – anyone can set up a free email address!

===== PAGE 8 =====
# The domain - Your address on the internet

It's your website address you use in a web browser, like Google Chrome and Safari for people to see your web pages and information – agendas, minutes, AGAR, news etc

## AND

Your email address – the address that people use to send you an email.

<div style="text-align: center;"><img src="imgs/img_in_chart_box_2107_367_3505_1141.jpg" alt="Image" width="39%" /></div>


<div style="text-align: center;"><img src="imgs/img_in_image_box_2014_289_3509_2206.jpg" alt="Image" width="42%" /></div>


## Our Office:

The White House

Hockliffe Street, Leighton Buzzard

Bedfordshire, LU7 1HD

Call us on:

General enquiries: 01525 631920

Email us at:

info@leightonlinslade-tc.gov.uk



come to Leighton-Linslade To

mmunity to be proud of"

WE WOULD LOVE YOUR FEEDBACK

We would love to hear what you think of the About provide your feedback. You could be in for a chance

3571.35 354735476

===== PAGE 9 =====
#### .gov.uk

It's the ultimate official domain for a Council.

Elevated level of security

Improves compliance

Improves GDPR – and FOI & SAR situations

Added benefits and security services

More professional

Improved authenticity of message

■ Can only be used managed by authorised organisations for added security & governance

#### .org.uk

It's an acceptable UK-based domain for a Council.

Elevated level of security above free emails

Helps with compliance

■ Improves GDPR – and FOI & SAR situations

■ Requires less scrutiny so = less official than .gov.uk

You can also use .com, .co.uk or other council-owned domain suffix but they are not within the UK jurisdiction managed by Nominet.

===== PAGE 10 =====
## Domains - recap

Stop using free email (Gmail/Hotmail/Yahoo etc)

Use a council-owned domain for your official email for the council & website

Get your .gov.uk domain for best practice

Other council-owned domains are currently acceptable, but website and email should match

Make sure you set enough in the budget/precept planning for these services

Make sure the domain name is registered to the council – not an individual.

===== PAGE 11 =====
## Website Accessibility Compliance - update

Regulations for all public sector bodies, incl parish & town councils' websites must meet WCAG2.1AA standard since 2020

Regulations rose to WCAG2.2AA in October 2024

You must have a compliant website

Regardless of the domain type, SAPPP '25 & Public Sector Website laws require compliance

You must have an up to date and relevant Accessibility Statement

Risks? Challenged by vexatious MOP, audit failure, withdrawal of your .gov.uk domain

===== PAGE 12 =====
## Website Accessibility tips

Ensure the website & the content you upload is accessible

Define your Accessibility Statement and include the things you know are not accessible – 3rd party documents, content older than 2018

Avoid using ‘accessibility plugins’ to achieve compliance – they aren’t enough

Have a checking process – use the free browser checker Wave by WEBAIM to check as you go

Make sure any forms are web page forms, not documents

Consider commissioning an accessibility audit to understand your position

Consider commissioning a purpose-built website from council website experts, Aubergine, that's .gov.uk-ready and fully compliant from £499 + VAT

===== PAGE 13 =====
Add ALT text for images

## Website Accessibility tips

✓ Avoid using tables where possible

✓ Avoid embedding text on images

– events need the salient info on the web page

✓ High Contrast

✓ Use structured headings (H1, H2, H3..)

✓ Make documents accessible before uploading

Forms need to be web forms, not PDFs

Use descriptive link text (not 'click here'!)



✓ Avoid pasting URLs on the page

✓ Avoid overly styled text formatting

✓ Avoid ‘accessibility plugins’

✓ Avoid scans where possible

(3^{rd} party documents/AGAR/ROI excluded)

✓ Have a regular checking process

✓ Revisit your accessibility statement

===== PAGE 14 =====
<div style="text-align: center;"><img src="imgs/img_in_image_box_113_248_3364_2010.jpg" alt="Image" width="92%" /></div>


===== PAGE 15 =====
## IT Policies & Assertion 10

What Assertion 10 requires in relation to IT policies

What the Practitioners' Guide says an IT policy must do

What “securely and legally” means in practice

How email and domains link back to the IT policy

===== PAGE 16 =====
## Assertion 10: IT Policy Requirements

“All smaller authorities (excluding parish meetings) must also have an IT policy.”

The IT policy must explain how authority business is conducted

■ Applies to clerks, members and other staff

Covers authority-owned and personal equipment

===== PAGE 17 =====
<div style="text-align: center;"><img src="imgs/img_in_image_box_1077_382_2507_520.jpg" alt="Image" width="40%" /></div>


# Practitioners' Guide: Purpose of an IT Policy

Prevents misunderstandings when using IT equipment

Ensures there are no excuses for unsafe or insecure behaviour

Sets clear expectations for everyone in the authority

Templates must be personalised to reflect how the council actually works

===== PAGE 18 =====
<div style="text-align: center;"><img src="imgs/img_in_image_box_1082_381_2507_521.jpg" alt="Image" width="40%" /></div>


# “Securely and Legally”: What That Means in Practice

What an IT Policy Must Explain

“How everyone should conduct authority business in a secure and legal way”

What is expected when using passwords and user accounts

▶ How personal and council devices may be used

▶ Rules for remote working and mobile access

How incidents, mistakes or concerns are reported

===== PAGE 19 =====
# IT Policies, Domains, Email & Data Protection

IT Policy sets the rules for how council business is done

Authority-owned domains establish ownership and control

Authority-owned email keeps communications in a managed environment

Data Protection compliance depends on all three working together

"Secure and legal use of IT underpins GDPR, FOI and SAR obligations."

<div style="text-align: center;"><img src="imgs/img_in_image_box_442_1865_1713_2148.jpg" alt="Image" width="36%" /></div>


Cyber Security Audit

SECURE NOW