Rules and ethics
Part of UK rules around a web project in 2027, from data protection to employment status
Web design agencies: regulations that change by UK nation
Which regulations change when a web design agency in England works for a client in Scotland, Wales or Northern Ireland, and which stay the same.
A web design agency in England that takes a client in Scotland, Wales or Northern Ireland meets the same data and advertising rules as at home. It does not meet the same discrimination, procurement or language rules. The client's territory and the service decide which set applies, not the agency's postcode.
What to take away
- Data protection and advertising rules are the same in all four nations. Discrimination, procurement and language rules are not, and accessibility enforcement differs in Northern Ireland.
- The client's territory and the service decide the route, so an English agency can still meet Welsh or Scottish rules.
- Northern Ireland uses the Disability Discrimination Act 1995, not the Equality Act 2010.
- Scottish public contracts follow the 2014 Act and the 2016 regulations, not the Procurement Act 2023.
- Name the nation beside every duty before the statement of work is signed.
Rules that stay the same in every nation
UK GDPR, the amended Data Protection Act 2018, PECR and the CAP Code apply in all four nations. An agency in Cardiff and an agency in Leeds start from the same data and advertising rules, so a border never explains a gap there.
The Data (Use and Access) Act 2025 changed parts of the UK data framework, and the Commencement No. 6 Regulations put section 103 and Schedule 10 into force on 19 June 2026, with transitional rules. These changes reach every agency in every nation. Check the data duties of each project by purpose, role and technology, not by territory.
Rules that change at the border
Four things change at the border: discrimination law, public procurement, Welsh-language duties and accessibility enforcement. The starting point for each nation is below, and each cell still needs a check against the body and the service involved.
| Nation | Discrimination law | Public procurement | Further duty |
|---|---|---|---|
| England | Equality Act 2010 | Procurement Act 2023, where in scope | 2018 accessibility regulations for covered public bodies, enforced by the Equality and Human Rights Commission |
| Scotland | Equality Act 2010 | Procurement Reform (Scotland) Act 2014 and Procurement (Scotland) Regulations 2016 | 2018 accessibility regulations, enforced by the Equality and Human Rights Commission |
| Wales | Equality Act 2010 | Procurement Act 2023 for devolved Welsh authorities, with Welsh Government guidance | Welsh Language Standards under the Welsh Language (Wales) Measure 2011, set by the Welsh Language Commissioner |
| Northern Ireland | Disability Discrimination Act 1995, enforced by the Equality Commission for Northern Ireland | Procurement Act 2023 covers Northern Ireland | 2018 accessibility regulations, also enforced by the Equality Commission for Northern Ireland |
An England-only register hides these differences. Give every entry a nation column, so a reviewer can see at once which Act, regulation or standard the entry rests on. Add the nation to every gate of the selection checklist too.
A London agency building for a Welsh public body
A London agency building for a Welsh public body still has to meet the Welsh Language Standards. Under the Welsh Language (Wales) Measure 2011 they can require bilingual public-facing services from Welsh public bodies, so the brief should ask early whether the website falls inside them.
The Welsh Language Commissioner decides which standards a body must meet, so ask the body for its compliance notice.
The register follows the client's territory and the service, because agencies trade across borders. Write the Welsh public body, the standards that may apply and the person who confirms coverage into the commercial contract, so scope and cost are agreed before design begins. The Equality Act 2010 applies in Wales as well.
An Edinburgh public body and a Scottish contract
A covered Scottish public contract follows the Procurement Reform (Scotland) Act 2014 and the Procurement (Scotland) Regulations 2016, not the Procurement Act 2023. An agency bidding from England should read the Scottish regime first and not reuse a tender answer written for an English buyer.
Do not apply the 2023 Act to private buying, whichever nation the client sits in. The Equality Act 2010 still applies in Scotland. The 2018 accessibility regulations apply across the UK, and the Equality and Human Rights Commission enforces them in Scotland as in England, so ask which body monitors the service.
A Belfast client and Northern Ireland's own framework
Northern Ireland replaces the Equality Act 2010 with the Disability Discrimination Act 1995, enforced by the Equality Commission for Northern Ireland. An accessibility brief written for an English client therefore cites the wrong discrimination law when the client is in Belfast and needs rewriting before the work starts.
The 2018 accessibility regulations are enforced there by the same commission. The Procurement Act 2023 covers Northern Ireland, so a covered public award there uses current Procurement Act procure-phase guidance, as in England. Data and advertising rules stay the same. For the testing itself, use the accessibility gate of the quality checklist and record which discrimination law the test results are measured against.
Public-sector accessibility rules across the UK
The full name of the 2018 rules is the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. They apply across the UK to covered public bodies. A private England website should not be labelled subject to them without checking the body and the service.
The Government Digital Service monitors public sector bodies' compliance on behalf of the Minister for the Cabinet Office. The Equality and Human Rights Commission enforces the requirement in England, Scotland and Wales, and the Equality Commission for Northern Ireland enforces it there.
GDS guidance on public sector accessibility requirements says the Equality Act 2010 covers England, Scotland and Wales, and the Disability Discrimination Act 1995 covers Northern Ireland, for all public sector bodies. Record the duty, the technical criteria, the tested sample and the complaint route. Outsourcing does not by itself decide or remove the service provider's responsibilities.
Four steps to route a cross-border project
Run the same four steps for every commission, whichever nation the agency sits in. Each step produces one line on the register, and each line ends in a proceed, hold or stop verdict with a recheck date.
- Name the client's nation and say whether the body is public or private.
- List the service the website provides and who will use it.
- Take the nation's discrimination, procurement and language rules from the table, then confirm coverage.
- Record a proceed, hold or stop verdict, the reviewer and the next recheck.
Keep the verdicts independent. Legal, privacy, advertising, accessibility and IP verdicts stay separate, as do people, security, procurement and contract verdicts. Tax and finance stay separate too. The UK rules guide sorts the same gates by topic, so use it when a verdict needs the topic view and keep the register itself sorted by nation.
Common questions
Does an English agency need to follow the Welsh Language Standards?
It can. The standards can require bilingual public-facing services from Welsh public bodies, and the register follows the client's territory and the service, not the agency's office.
Which discrimination law applies in Northern Ireland?
The Disability Discrimination Act 1995 replaces the Equality Act 2010 there, and the Equality Commission for Northern Ireland enforces it.
Does the Procurement Act 2023 apply to a Scottish public contract?
Not for covered contracts. They follow the Procurement Reform (Scotland) Act 2014 and the Procurement (Scotland) Regulations 2016.
Do data protection rules differ between the four nations?
No. UK GDPR, the amended Data Protection Act 2018, PECR and the CAP Code apply in all four nations.
