Operations
Web design agencies: the team roles every project needs, whatever the job titles say
Define the capacities an England web project needs across decisions, research, design, engineering and assurance without prescribing titles or headcount.
What to take away
- A website commission needs eight capacities, and none of them is a job title.
- Name who performs, reviews and authorises each capacity before work starts.
- One competent person can carry several capacities on a small brochure site; payments, accounts or integrations usually force a split.
- Hold release wherever competence, independence or authority is missing.
- Redraw the map when scope changes and again before launch.
Capacities and the titles that usually carry them
Capacities and titles
| Capacity | Titles that often carry it in England |
|---|---|
| Decision and acceptance | Client sponsor, product owner, agency account or delivery lead |
| Research and service definition | UX researcher, business analyst, digital strategist |
| Content and interaction | Content designer, UX or UI designer, copywriter |
| Engineering and integration | Frontend developer, backend developer, technical lead, QA |
| Privacy and PECR | Data protection lead, external DPO, privacy consultant |
| Accessibility | Accessibility specialist, frontend developer with accessibility duties, external auditor |
| Security and operations | Platform or DevOps engineer, security lead, hosting partner |
| Rights, commercial and exit | Contracts lead, finance owner, procurement |
Read the right column as local habit, not as a rule. One England agency may split content design from visual design; another may hand that work to a freelancer. What matters is that every row has a named owner.
Ask a shortlisted supplier which person performs, reviews and authorises each row, and what evidence they will produce. Team shape often follows the delivery model rather than the brief, so how four web agency delivery models compare is worth reading before you shortlist.
Where England agency teams differ from the GDS model
Public sector teams are built as one multidisciplinary unit: product manager, delivery manager, user researcher, content designer, designer, developer and performance analyst. The GDS description of what each role does in a service team sets that out for government delivery and does not bind private commissions.
Agency teams are rarely shaped that way. The client sponsor carries decision and acceptance, an account or studio lead holds commercial authority, and one designer may cover content, interaction and accessibility. User research and performance analysis are usually bought in per project.
That arrangement can work, provided any missing capacity is named rather than assumed.
Example: a five-page brochure site and a booking service
Illustration only, not a benchmark.
For a five-page brochure site, a project lead, one designer and one frontend developer can cover decision, content, engineering and basic accessibility. The client marketing manager owns the cookie notice and the privacy policy wording, and research is a short round of stakeholder interviews.
A booking service that takes payments and holds customer accounts needs more separation: a UX researcher, a backend developer, a platform engineer, a data protection lead, an independent accessibility test and a commercial lead for contracts. Six to ten people across agency and client is a common shape.
Either way, the research capacity should check rival sites without copying their designs or collecting personal data, which is the method in our guide to researching rival web agencies.
Build the responsibility map
- List the eight capacities from the table.
- Name the person who performs each one.
- Name a separate reviewer where the risk is high.
- Name who authorises, and record any limit on that authority.
- Agree the evidence each capacity must produce.
- Redraw the map when scope changes and again before launch.
Written rights terms, acceptance criteria and exit terms belong in the contract. Our guide to seven commercial contract records lists the paperwork worth requesting before work starts.
A capacity with no named owner is an unmanaged risk, not a task to tidy up later.
Evidence each capacity should produce
- Decision and acceptancea decision log tied to a version.
- Researchsampling notes, consent records, and inference kept separate from observation.
- Content and interactionsource-controlled copy, claim substantiation, a correction route.
- Engineeringversioned artefacts and observable acceptance tests.
- Privacy and PECRpurposes, personal data, recipients, retention and transfers. The ICO's cookies guidance explains why each tool's technical behaviour matters, not just banner wording.
- Accessibilityautomated checks plus manual and assistive-technology testing. The reasonable adjustments duty in the Equality Act 2010 covers England, Wales and Scotland.
- Security and operationsthreat decisions, secrets handling, backups, monitoring and a recoverable release.
- Rights and exitwritten rights terms, licence scope, subcontractor list, charges and an exit plan.
Common questions
Do I need separate specialists for privacy, accessibility and security?
Not always. One person can hold all three on a low-risk brochure site, but each still needs its own evidence and its own authority to block a release.
Can one person cover several capacities?
Yes, and on small commissions that is normal. Split them when the service takes payments, holds accounts, handles health data or carries a public service duty.
How do I know when a capacity is missing?
You cannot see evidence you were never given. If nobody can name the artefacts for a row in the table, treat that capacity as absent and hold release.
What happens when scope grows?
Redraw the map, recheck authority limits and reissue acceptance criteria before the next sprint starts. A new integration usually brings new privacy, security and support work.
