Operations
Web design agencies quality checklist: accessibility, privacy and security gates
A web design agencies quality checklist for commissioning work in England, with accessibility, privacy and security as separate evidenced gates.
This web design agencies quality checklist treats quality as a set of evidenced gates, not one combined score. Mark each line pass, fail or not evidenced, attach the artefact and name the reviewer. A fast site cannot offset an unlicensed asset; an accessible interface cannot excuse an unsafe data flow.
It is written for commissioning work in England, and for comparing web design agencies shortlisted from this directory on the same evidence rather than on presentation. Legal duties and contract obligations depend on the actual organisation, audience and service, so qualified reviewers must decide their own fields for each engagement.
What to take away
- Treat quality as separate evidenced gates, not one combined score that lets strengths offset failures.
- Mark each line pass, fail or not evidenced, and attach the artefact with the reviewer named.
- Commissioned work is generally first owned by its creator unless the parties agree otherwise in writing.
- Security does not inherit a privacy pass, so each discipline needs its own scoped evidence.
- Record failed and unknown items without averaging them, and hold release until mandatory owners supply acceptable results.
Purpose and acceptance
- Each user task has an eligible population, source, owner and acceptance condition.
- Research observations are separated from design inference and commercial preference.
- Page and component scope identifies exclusions, dependencies and the buyer's approver.
- Objective commercial claims link to evidence that covers their wording and currency.
Within its remit, the CAP Code's substantiation section requires documentary support before objective claims are published. Pass evidence is the dated source plus a review of the complete impression, not a note saying that marketing approved it.
Content, design and access
- Every content item has a source, review date, correction route and archive rule.
- Images, fonts, code, copy and commissioned designs have documented ownership or licence terms.
- Keyboard, focus, labels, errors, zoom, contrast and reflow have manual evidence on the agreed templates.
- Representative journeys were examined with named assistive technologies — NVDA, JAWS, VoiceOver and TalkBack — and with the browser-device combinations in scope.
- Conformance is stated against WCAG 2.2 level AA, with EN 301 549 named where the buyer is a public sector body.
The Intellectual Property Office explains copyright ownership, including that commissioned work is generally first owned by its creator unless the parties agree otherwise in writing. GDS's accessibility testing guidance combines automated, manual and assistive-technology work for government services. For a private site in England, the Equality Act 2010 is the duty that makes accessibility a legal question, and WCAG 2.2 level AA is the usual benchmark for the technical work. The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 apply where the buyer is a public sector body in scope, and they require a published accessibility statement. These sources inform evidence requests; none of them certifies a particular website on its own.
Privacy and data protection
- The data map identifies purposes, people, fields, systems, recipients, retention and transfers.
- Controller and processor positions follow actual decisions, with contract evidence where required, and the processing records required by UK GDPR Article 30 are kept.
- A data protection impact assessment is completed where the processing is likely to be high risk, using the ICO's guidance as the reference.
- Every storage or access technology has a PECR decision based on its behaviour, not its label.
- Test data is synthetic or properly authorised, minimised and removed through a recorded process.
The ICO's processor-contract guide lists subjects such as instructions, security, subprocessors, assistance and deletion. Its cookies material makes clear that similar storage or access techniques also need attention. In the UK the governing instruments are the UK GDPR and the Data Protection Act 2018, with PECR sitting alongside them for storage and access technologies.
Security
- Secrets, dependencies and permissions have named owners, with the route by which access is granted and removed.
- Logs, backups, vulnerabilities and incident routes have named owners, with the response the contract promises.
Security does not inherit a privacy pass: use scoped evidence and treat the NCSC's secure-development guidance as a starting discipline rather than a certificate. Cyber Essentials is a UK scheme covering basic technical controls and can be evidenced separately where the buyer asks for it.
Build, migration and release
- Code, content, configuration and database changes are versioned and traceable.
- Integrations have success, failure, timeout and recovery evidence in a representative environment.
- Migration totals reconcile at source and destination; redirects and critical journeys have named samples.
- Acceptance records show who reviewed which version, what remained untested and why.
- Release authority, rollback point, immediate checks, communications and restart authority are written down.
GDS guidance says public teams should run regular quality assurance across user and technical concerns. A private engagement still needs a buyer-owned test design rather than a copied government test list.
Operation and exit
- Support events, clock rules, evidence sources, exclusions and remedies come from the contract.
- Monitoring covers user harm and business failure, not only server availability.
- Changes repeat the relevant specialist gates instead of relying on launch approval.
- The exit pack includes usable exports, credentials, licences, operational notes and deletion evidence.
Record failed and unknown items without averaging them. Release stays on hold until every mandatory owner supplies an acceptable result or a properly authorised decision changes the scope.
Before you act
- Name the owner and acceptance condition for each user task.
- Document ownership or licence terms for every asset.
- Map data purposes, fields, recipients, retention and transfers.
- Version and trace code, content, configuration and database changes.
- Write down release authority, rollback point and restart authority.
- Keep the exit pack with exports, credentials, licences and deletion evidence.
Common questions
What evidence counts as a pass for an objective commercial claim?
Pass evidence is the dated source plus a review of the complete impression, not a note saying that marketing approved it. The CAP Code's substantiation section requires documentary support before objective claims are published, within its remit.
Why does a privacy pass not cover security?
Security does not inherit a privacy pass, so scoped evidence is needed, with the NCSC's secure-development guidance as a starting discipline. Privacy gates cover data purposes, controller and processor positions, and PECR decisions; security gates cover secrets, permissions, dependencies, logs, backups and vulnerabilities.
What should happen when an item fails or is not evidenced?
Record failed and unknown items without averaging them. Release stays on hold until every mandatory owner supplies an acceptable result, or a properly authorised decision changes the scope. A fast site cannot offset an unlicensed asset, and an accessible interface cannot excuse an unsafe data flow.
