Commissioning a website that serves your neighbourhood.

Council pages can be a good option if their editing, design and publishing arrangements meet the board’s needs. Ask what is included, how quickly changes can be made and who will provide support.

A dedicated site gives more room for local identity, project stories and participation. It also brings an ongoing job: keeping content, accounts, software and accessibility in good order. A combination can work well, with the council holding the formal record and a community site linking to it.

Agree ownership before registration

Check the board’s constitution and who can contract on its behalf. The local authority is normally the accountable body at the start, but arrangements can change. MHCLG anticipates a move towards community-led delivery, which may include incorporation or a different accountable body. Read the accountable-body guidance.

Record the domain registrant, account administrators, renewal arrangements and recovery contacts. A payment card is not proof of ownership. Avoid access depending on one volunteer or the supplier alone; use individual accounts, multi-factor authentication and an agreed recovery process. Include transfer rights for a future change of organisation.

Agree communication responsibilities

Programme requirement: the responsible MP sits on the Neighbourhood Board and has a role in supporting the Chair, informing the work and involving the community. The accountable body remains responsible for legal compliance and procurement. Read MHCLG’s guidance on parliamentary representatives and the accountable body’s responsibilities.

Our recommendation: agree how the Chair, board, responsible MP and accountable body contribute to and approve website content. Keep board communications focused on the programme and distinguish them from personal or party-political material. In England, ask the accountable body whether the local authority Publicity Code applies; elsewhere, ask it to confirm the relevant publicity and pre-election rules.

Choose a recognisable address

A council section or subdomain may be suitable. For a separate address, choose a short UK domain that the responsible organisation can retain. Nominet describes .org.uk as intended for not-for-profit or public-service enterprises; .uk is the shorter, general UK option. Either can be appropriate. The ending alone does not establish legitimacy: local recognition, clear ownership and accurate attribution matter more. Read Nominet’s current registration policy.

A broad programme-wide name can look official. If a domain belongs to one local board, a supplier or an independent resource, say so prominently in the page title, header and footer. Avoid names, branding or claims that could be mistaken for government endorsement.

Do not assume a board qualifies for its own .gov.uk domain, or that it is automatically excluded. Eligibility depends on the organisation; the published categories include partnership bodies. Check with the council and the Domains Team. Applications go through an approved registrar to the Domains Team, which may refer them to the Naming and Approvals Committee. Check eligibility and the application process.

Agree any applicable council design and assurance standards. Use appropriate local branding without implying that the site is GOV.UK. Programme requirement: follow the current Pride in Place publicity and logo guidance. Check the programme branding instructions.

MHCLG’s transparency guidance places membership and governance information on the lead local authority’s website. It also encourages a board webpage for communicating with residents. These are programme transparency requirements; they are not all separate statutory duties.

The guidance expects the following publications. Its wording for board papers is “in advance of the meeting within 5 working days”; agree the exact timetable with the accountable body rather than leaving editors to interpret it. Read the current transparency requirements.

Confirm who operates the site and whether it falls within the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. An outsourced site run for a council remains its responsibility. Where the Regulations apply, the current technical standard is Web Content Accessibility Guidelines (WCAG) 2.2 Level AA, subject to the Regulations’ specific exemptions and disproportionate-burden provisions.

A published accessibility statement is a separate requirement. It should describe the site’s accessibility, known problems and contact route, and be kept current. Reasonable-adjustment duties also apply under the Equality Act 2010 in Great Britain and the Disability Discrimination Act 1995 in Northern Ireland. Read the government’s accessibility guidance.

Ask for evidence at handover

Our recommendation: specify WCAG 2.2 AA in the brief and agree testing, defect correction and retesting before accepting delivery. Include the actual content, forms, documents and third-party tools residents will use.

A Lighthouse score of 100 does not establish conformance. Automated tools such as axe or WAVE detect some barriers; manual checks are needed too. Ask for tested pages and tasks, browsers and assistive technologies used, findings, fixes and remaining limitations. Include keyboard navigation, visible focus, zoom and reflow, screen-reader use and form errors. Testing with disabled users adds practical insight.

Conformance concerns all applicable success criteria at the claimed level, across the pages and complete processes in scope. An overlay widget or automated score cannot substitute for that assessment. Agree responsibility for new accessibility issues when editors add content or software changes.

Check documents and embedded tools

Choose accessible surveys, video players and maps. There are specific exemptions for qualifying third-party content outside your control and for maps with accessible alternatives; buying or commissioning a tool does not automatically make it exempt. Explain any applicable exemption in the statement and provide a usable route to the information or task.

Publish documents as web pages where practical. A scan without recognised text is an image. Exporting from a word processor preserves text, but an accessible PDF also needs correct structure, tags, reading order and alternatives. Check the result, and agree how signed originals are retained. Publish spending in a usable data format alongside a readable explanation. Read the accessible-document guidance.

Ask about language requirements early. In Wales, check the accountable body’s Welsh Language Standards and how they apply to the service, including translated content and its ongoing maintenance.

Specify reliable performance on phones and slower connections. Keeping essential information available when scripts fail is a useful resilience measure. Choose technology against resident needs and agreed acceptance criteria.

Contact details, identifiable survey answers and photographs can be personal data. Agree what you need, the lawful basis, who can access it and when it will be deleted. Avoid collecting identifiers merely because a form makes it easy.

The controller determines why and how personal data is processed. A supplier acting on its instructions is a processor, but some services act as separate or joint controllers. Ask the accountable body’s data protection officer (DPO) to confirm the actual roles. Read the ICO’s explanation of these roles. Where a controller uses a processor, put the required written contract or other binding legal act in place before processing starts. Read the ICO’s contract guidance.

Ask about sale, sharing and reuse

Ask the builder and check every service it proposes: will anyone sell visitor information, use it for advertising or profiling, combine it with other data, or reuse it for their own purposes? Include hosting, analytics, surveys, mailing lists and social-media embeds. A supplier saying “we do not sell data” does not answer all of those questions.

Our recommendation: require the service to work without monetising visitor information. Ask for a list of providers, recipients, purposes, retention periods and processing locations. Distinguish necessary service processing from use for a provider’s own benefit. Have the DPO review the terms, any international transfers and how changes to providers are approved. Put the agreed restrictions in the contract and describe the actual arrangements in the privacy notice.

Provide clear privacy information when collecting data. Ask the DPO to screen for a data protection impact assessment (DPIA), which is required where processing is likely to pose a high risk to individuals. Plan event photography and children’s participation before collecting or publishing images. Check the DPIA guidance.

Analytics and updates

Decide what you would do with visitor statistics before adding analytics. The Privacy and Electronic Communications Regulations (PECR) cover cookies and other storage or access technologies. Some uses require prior consent; current rules include a limited statistical-purpose exception with conditions, including clear information and a simple, free way to object. “Cookieless” does not by itself settle the question. Check the ICO’s exceptions and technologies covered.

Choose an accessible consent or objection mechanism where required, and ensure embeds respect it. A banner alone does not show that the underlying settings are correct.

Your council can consider GOV.UK Notify for updates. Emails are free; texts have a free allowance and letters are charged. Agree how subscriptions, preferences and opt-outs will work. A council can add a supplier to its service; private companies cannot hold their own Notify account. Check pricing and eligibility.

A contact address is no use if residents’ messages never arrive. If the domain or mail service is configured badly, legitimate email can be rejected or sent to spam. Ask the supplier to authenticate email sent from your domain, test delivery to common email services and explain the settings in plain language at handover. Authentication improves trust and delivery, but no setup can guarantee that every message reaches every inbox.

Compare bids over the same term. Include design, content preparation, hosting, licences, training, maintenance, accessibility testing, translation, support and exit. Ask what VAT applies, how renewal prices can change and what is charged separately.

Put the acceptance criteria in the brief: agreed resident tasks work, editors can publish, accessibility findings are resolved or have agreed owners and remediation dates, privacy settings match the agreed data use, and authorised staff can recover accounts. Any reliance on an exemption or disproportionate burden should be confirmed and recorded by the responsible body. Agree how outstanding defects affect acceptance and payment.

Name the people responsible for publishing and support. Specify response times, security updates, backups and tested restoration, incident notification, and cover for holidays or illness. Agree content review dates and who closes expired applications and consultations.

At handover, get the account inventory, editorial instructions, test evidence and asset licences. The contract should explain ownership or licence rights for design and code, as well as content and domain control. Specify export formats, transfer assistance, deletion of supplier-held data and any exit fee. Test a sample export before relying on it.

Written by Cool Unlimited, a software company in Tamworth led technically by Phil Davies. Our experience includes UK public-sector services delivered through managed service providers and agencies. Read about our work and website service.

If you would like a general explanation of an accessibility finding or a commissioning question, email hello@coolunlimited.co.uk. There is no charge or obligation for an initial conversation. Please do not send another supplier’s confidential proposal. If we may bid for your work, agree any advisory role with your accountable body first.

You may share or reproduce this guide, in full or in extracts, with attribution to Cool Unlimited and a link to the maintained guide. Identify any changes you make.

Reviewed on 5 September 2026, including MHCLG’s delivery guidance updated on 1 September 2026. The linked official sources explain the applicable rules; local arrangements and guidance can change. Confirm decisions with your accountable body, legal adviser and DPO.