Commercial contracts for web design agencies: seven records that keep a commission honest

What to take away

Name the seven records for commercial contracts for web design agencies: Companies House register, Cabinet Office Model Services Contract and IPO deed of assignment and licence schedule. Add the ICO Article 28 processor contract, NCSC Secure Development Collection, HMRC VAT and change record, and exit management plan.
Record parties and authority from Companies House, then verify signatory power separately.
Payment alone does not transfer intellectual property ownership without an effective contractual change.
If a processor relationship exists, the contract must cover Article 28 topics.
Tie change requests to revised scope, dependencies, acceptance and security. Tie them to accessibility, data, rights, timing and price.
Define termination triggers, notice, work in progress, export and credentials. Add licences, assistance, deletion and final acceptance.

Before you act

Record legal name, company number, address and signatory authority.
List deliverables, exclusions and buyer inputs. Add environments, milestones and acceptance authority.
Itemise background and new code, content, designs and images. Add fonts, data and third-party components.
Describe each processing purpose and decide roles from actual conduct.
Allocate repository access, dependencies, deployment and tests. Add vulnerability handling.
State currency, unit, period and scope. Add expenses, payment trigger and VAT treatment.
Define termination triggers, notice, work in progress and export. Add credentials, licences, deletion and final acceptance.

Method and limits

Review date: 6 September 2026.

Scope: an England buyer commissioning website design or development under an agreement intended for England and Wales. The governing law, parties and service facts still require confirmation.

Inclusions: a contract record needed an operational purpose and an authoritative source showing why the topic should be resolved.

Exclusions: clause wording, negotiation advice and market-standard terms. Prices, liability caps and enforceability conclusions also sit outside this review.

Ranking and conflicts: the seven records are non-ranked. No agency, lawyer, platform or insurer contributed to this desk review.

1. Companies House register and signatory authority record

Record legal name, company number, address and signatory authority for every buyer, supplier and guarantor. Add trading name and notices route. Use Companies House as one current public record, then verify authority and contracting capacity separately. Register data is not an endorsement or proof that a trading name can bind the company.

Companies House holds public filings, including confirmation statements and accounts. It does not confirm that the signatory has authority.

This contract record is recommended practice; the underlying company filings are legally required. Obtain the register data from Companies House on gov.uk.

2. Cabinet Office Model Services Contract scope and acceptance schedule

List deliverables, explicit exclusions, buyer inputs and environments. Add milestones, test artefacts, defect classes and acceptance authority. The Cabinet Office Model Services Contract materials cover implementation, testing and acceptance for certain complex public services. They are a reference, not a ready-made private website agreement.

The Model Services Contract is a public-sector reference, borrowed here for private commissions. It is recommended, not legally required. Obtain the materials from the Cabinet Office on gov.uk.

3. Deed of assignment and licence schedule

Itemise background and new code, content, designs and images. Add fonts, data and third-party components. State creator, owner, assignment or licence, permitted uses and territory. Add duration, attribution and delivery at exit.

The government IP overview explains that commissioning work from a self-employed creator does not usually transfer ownership without an effective contractual change. Payment alone does not establish ownership.

A written assignment signed by the assignor is legally required to transfer copyright; a licence is recommended. Obtain schedule wording from the IPO.

4. ICO Article 28 processor contract

Describe each purpose and decide roles from actual conduct. If a processor relationship exists, cover documented instructions, confidentiality, security and subprocessors. Add assistance, return or deletion and audit information. The ICO's contract requirements explain the Article 28 topics. A commercial allocation cannot authorise unlawful processing.

The ICO is the UK data protection regulator.

A written processor contract is legally required under UK GDPR Article 28 where a processor handles personal data. The ICO publishes a contract template on its website.

5. NCSC Secure Development Collection security schedule

Allocate repository access, dependencies, deployment, tests and vulnerability handling. Add logging, containment, notification, recovery and evidence retention. The UK National Cyber Security Centre secure development guidance spans the lifecycle and states that its principles do not guarantee security. The schedule should demand project evidence, not a broad promise.

Following the NCSC collection is recommended; Article 32 security measures are a legal duty where personal data is processed. The guidance page sits on the NCSC website.

6. Change control record with VAT invoice detail

Tie change requests to revised scope, dependencies, acceptance, security and accessibility records. Tie them to data, rights, timing and price records.

Name the person authorised to request, estimate and approve a change. Pause work if a proposed integration or new purpose bypasses an unopened gate. Silence, test use or partial payment is not a substitute for the agreed acceptance process.

A worked example: a request to add a booking widget would record the requester, date, revised scope, price, delivery date and acceptance criteria before work starts.

For each charge, state currency, unit, period and scope. Add expenses, payment trigger, VAT treatment and change approval. HMRC says VAT rates can change and currently identifies 20% as the standard rate for most goods and services. That is not a tax ruling for this supply. Obtain named tax and finance approval.

A valid VAT invoice is legally required for VAT-registered business-to-business supplies; the change-control record is recommended. Obtain VAT guidance from HMRC on gov.uk.

7. Exit management plan and deletion certificate

Define termination triggers, notice, work in progress, source and content export, and credentials. Add licences, supplier assistance, personal-data return or deletion, replacement access and final acceptance. The Model Services Contract reference includes exit-management material, but proportional drafting depends on this commission.

A worked example: an exit record might list the handover date, export format, credentials, deletion deadline and final acceptance sign-off.

An exit plan is recommended practice; personal-data return or deletion duties can be legally required. Obtain exit material from the Cabinet Office on gov.uk.

Accessibility, equality, claims and consumer protection need independent schedules or review where relevant. So do employment status and public procurement. A signed agreement allocates obligations and remedies; it cannot guarantee compliance or eliminate statutory exposure. Qualified commercial counsel should draft and approve the actual terms.

Common questions

How can a buyer confirm who can bind the supplier?

Record 1 covers this: check the register data, then verify authority and contracting capacity separately.

What intellectual property details should the contract itemise?

Record 3 covers this: name the creator, owner, assignment or licence, permitted uses and territory.

What should a termination and transition record cover?

Record 7 covers this: termination triggers, notice, work in progress, export, credentials and deletion.