Assertion 10 explained: the AGAR question about your website and email

A new question with a familiar feel

There is a particular sigh clerks make when a new box appears on the AGAR. It sits somewhere between “oh, not again” and “right, where did I put the kettle”. Assertion 10 prompted plenty of those sighs when it arrived in the 2025 Practitioners’ Guide, and councils have now met it on the return for the 2025/26 year.

The good news is that Assertion 10 does not invent a mountain of new work. It gathers up things councils were already expected to do with their email, website, IT and personal data, and asks the council to confirm, formally and in public, that it is doing them. This guide explains what it covers, what a confident “yes” looks like, and where your website fits in.

What Assertion 10 actually asks

Assertion 10 sits in Section 1 of the AGAR, the Annual Governance Statement, alongside the other assertions the council approves each year before the accounts. Its theme is digital and data compliance. In short, the council is confirming that it manages its digital systems, information and personal data responsibly, lawfully and securely.

The exact wording and the full guidance are in the Practitioners’ Guide, and your internal auditor will be working from the same text, so it is worth reading those pages properly rather than relying on a summary (this one included). Broadly, it brings together four areas.

Email the council owns

Council business should be done using email accounts that belong to the council, not personal addresses. The phrase that makes some councillors wince is “no more Hotmail”. Personal accounts are hard to secure, they walk out of the door when someone stands down, and anything about council business inside them can still be caught by a Freedom of Information request or a subject access request. A council-owned domain, ideally a .gov.uk one, fixes all three problems at once, and our page on .gov.uk domains for parish councils explains how to get one.

A website that meets the accessibility rules

Council websites are covered by the Public Sector Bodies Accessibility Regulations 2018. The site should work for people using screen readers, keyboards and magnifiers, the documents on it should be readable too, and it needs an up to date accessibility statement. Our guide to understanding WCAG 2.2 explains what that involves day to day.

An IT policy people actually follow

Assertion 10 expects the council to have adopted sensible IT and information security arrangements: who has access to what, how passwords are handled, what happens to council data on a councillor’s laptop when they leave, and how the council would cope if something went wrong. A two-page policy that everyone has read beats a forty-page one that lives in a drawer.

Data protection

The council must be meeting its duties under UK GDPR and the Data Protection Act 2018. In practice that means a published privacy notice, a sensible approach to keeping and deleting records, a way of handling subject access requests, and a Data Protection Officer arrangement.

What a confident “yes” looks like

Auditors like evidence, and so do clerks, because evidence is what lets you sleep at night. Here is a simple way to check where you stand.

If one of those rows makes you wince, you are in good company, and it does not mean the council has failed. It means there is a job for the next few meetings. The AGAR is designed to be answered honestly, and a “no” with a clear plan behind it is far better than a hopeful “yes”.

Where your website comes in

It is tempting to file Assertion 10 under IT and hand it to whichever councillor once fixed the printer. In fact a surprising amount of it is answered by the council’s website. The accessibility statement lives there. The privacy notice lives there. The policies you adopt for Assertion 10 belong there too, so residents and auditors can find them without emailing you. And when a council moves to a .gov.uk domain, the same move usually gives every councillor a proper council email address.

A well-run website quietly does a lot of this work for you: documents go up in an accessible format, the accessibility statement stays current, and there is a single policies page you can point an auditor to with one link. That is how we build parish council websites, but whoever looks after yours, it is worth checking these pieces are in place well before the next AGAR comes round. Our checklist of what a parish council website must publish is a good place to start.

Questions clerks often ask