Reviews
Part of Seven England web agencies named, and identity checks to run before reputation
Web design agencies selection checklist: what to verify at every gate
Use this UK web design agencies selection checklist to check agency identity, delivery, accessibility, data, security, rights, quoted costs and exit evidence.
Use this web design agencies selection checklist after defining the website, its users and the work an agency would actually supply. Each mandatory gate receives pass, fail or unresolved, with an evidence owner and expiry date. Do not total the rows: an attractive design sample cannot compensate for a failed privacy, security, rights or exit requirement.
This draft was assembled on 6 September 2026 by desk research. There was no supplier funding, affiliate relationship, gift or hands-on work.
What to take away
- Each mandatory gate receives pass, fail or unresolved, with an evidence owner and expiry date.
- No agency, bid, contract, reference or website was assessed.
- A 2027 selection requires refreshed identity, service, contract and regulatory evidence.
Identity and authority
- Record the legal entity, trading name, company number, registered office and proposed contracting party.
- Match the signatory and payment account to approved due diligence. Resolve group companies and subcontractors in writing.
- Treat registration as identity evidence only. The Companies House disclaimer says company-supplied information is not verified or validated simply by appearing on the service.
Pass: The legal entity and registered office match the current Companies House record, and the proposal, contract and invoice identify the same contracting party. Signatory authority and subcontractor roles are documented. Fail: The parties are unexplained or inconsistent. Unresolved: Identity or authority evidence is missing.
Identity gate evidence
- Legal entity and trading name
- Company number and registered office
- Proposed contracting party
- Signatory and payment account match
- Group companies and subcontractors resolved
Delivery and acceptance
- Attach one scope covering research, content, design, development, integration, migration, hosting, support and excluded work. For each relevant requirement, such as the CMS, responsive build, search-engine optimisation (SEO) and hosting, name the deliverable and how it will be accepted.
- Name dependencies, decision owners, artefacts, review rounds, acceptance evidence, change control and recovery route.
- Test with synthetic or properly authorised fixtures. Record expected and actual outputs rather than a pass based on presentation.
Pass: The scope has observable acceptance tests and named accountable delivery roles for all agreed work. Fail: Success cannot be observed or the agency cannot identify accountable delivery roles. Unresolved: A dependency, decision owner or acceptance test is not agreed.
Accessibility
- Define visitor and editor tasks, browsers, assistive technologies, pages, components and evidence retained. Agree a conformance target, such as WCAG 2.2 Level AA, and identify whether EN 301 549 applies to the project. Consider duties under the Equality Act 2010 with competent advice; a standard or test report alone is not legal clearance.
- Commission competent review for the applicable equality and accessibility duties. W3C's conformance evaluation overview supports a documented scope, representative pages and evaluator expertise; it is not legal clearance.
Pass: Results are documented against the agreed target for representative pages and tasks, with defects assigned an owner and remediation route. Fail: Material tasks lack a test plan, owner or remediation route. Unresolved: The target, test scope or results are not agreed.
Data, privacy and marketing
- Map each party, purpose, data category, source, recipient, retention period, transfer and deletion step. Check whether each relevant organisation must pay the ICO data protection fee or qualifies for an exemption.
- Determine controller and processor roles from the facts. The ICO's contract guidance explains required controller-processor contract terms within its scope. Where the agency is a processor, check the contract against UK GDPR Article 28(3): it should set out the processing's subject matter, duration, nature and purpose, data types and data-subject categories, and the controller's rights and obligations. It should also cover documented instructions, confidentiality, security, subprocessors, assistance with individuals' rights and compliance duties, return or deletion of data, and information and audits.
- Review analytics, cookies and direct marketing separately under UK GDPR, the Data Protection Act 2018 and PECR. A contract does not create permission.
Pass: Roles, instructions, transparency, applicable ICO fee or exemption status, contract terms and deletion evidence are documented. Fail: Roles, instructions, transparency or deletion evidence are missing. Unresolved: A party's role, applicable requirement or evidence is not established.
Security and continuity
- Ask who controls hosting, domains, repositories, accounts, secrets, backups, incidents and recovery. Record backup frequency and retention, recovery objectives, who can restore service and evidence of a tested restoration.
- Use the NCSC supplier assurance questions to structure evidence on governance, data, incidents, offshoring, testing and contractual protection. Ask for relevant security evidence, such as Cyber Essentials, Cyber Essentials Plus, ISO/IEC 27001 certification or IASME Cyber Assurance, and check its scope and validity; certification is not a guarantee of security.
Pass: Control, access, incident escalation, backup and recovery responsibilities are documented, with agreed periods and restoration evidence. Fail: Privileged access, incident escalation or restoration ownership is unclear. Unresolved: Backup or recovery arrangements, or the evidence supporting them, are not established.
Rights and claims
- Schedule ownership and licences for code, designs, copy, images, fonts, data and third-party components. GOV.UK's IP overview distinguishes major forms of intellectual property; qualified advice must apply them to the contract.
- Require substantiation and approval for objective advertising or consumer claims. Separate agency promotional material from buyer evidence.
Pass: The buyer has documented rights to use, change and transfer required assets, and material claims have supporting evidence. Fail: The buyer cannot lawfully use, change or transfer a required asset, or a material claim lacks support. Unresolved: Ownership, licence scope or claim substantiation is unclear.
Commercial terms, support and exit
- Require a written, itemised quote with currency and actual amounts for the build, recurring hosting and support, third-party charges, expenses, renewals and change work. Record the VAT treatment, assumptions and charging period for each item for qualified review.
- Specify service boundaries, incident contacts, remedies, continuity, termination assistance, data and content export, account transfer, deletion evidence and supplier failure arrangements.
- Test export and handover before commitment where proportionate. Leave every unknown open.
Pass: The itemised quote, VAT treatment, liability allocation, support ownership and workable exit are documented and approved. Fail: Full cost, liability allocation, support ownership or a workable exit cannot be approved. Unresolved: Any charge, term or exit arrangement remains unquantified or unagreed.
The decision record should name each specialist reviewer, exception authority and recheck date. This checklist supplies questions, not a compliance conclusion or recommendation.
Decision record template: Gate: [name]; status: [pass/fail/unresolved]; evidence: [record]; owner: [role]; expiry or recheck date: [date]; exception authority: [role]. Complete it using the actual evidence for the agency; this template is not an assessed supplier outcome.
UK regulators, laws and standards referenced: Information Commissioner's Office (ICO); Companies House; National Cyber Security Centre (NCSC); UK GDPR; Data Protection Act 2018; Privacy and Electronic Communications Regulations 2003 (PECR); Equality Act 2010; WCAG 2.2; EN 301 549; Cyber Essentials; Cyber Essentials Plus; ISO/IEC 27001; IASME Cyber Assurance.
Before you act
- Define the website, its users and the work an agency would supply.
- Assign each mandatory gate a pass, fail or unresolved status.
- Name an evidence owner and expiry date for each gate.
- Name a qualified UK procurement reviewer before the checklist leaves hold.
Common questions
What should be recorded for identity and authority?
The identity gate fails if the proposal, contract and invoice would involve unexplained parties. Keep the legal entity, signatory and subcontractor records aligned with due diligence.
How should data, privacy and marketing be reviewed?
The data gate fails if roles, instructions, transparency or deletion evidence are missing. Map parties and purposes, then determine controller and processor roles under UK GDPR and PECR.
What must be specified for commercial terms, support and exit?
The commercial gate fails if full cost, liability allocation, support ownership or a workable exit cannot be approved. Record charges, service boundaries, termination assistance and export rights before commitment.
