UK rules around a web project in 2027, from data protection to employment status

A web project in 2027 has no single compliance switch. An England website project must identify the real service, people, content, technology, data and contract.

Each issue then goes to the reviewer responsible for that field. A privacy conclusion cannot approve an advertising claim. An accessibility test cannot settle copyright ownership. A contract cannot create permission that legislation withholds.

This guide is an issue map, not legal advice. It does not find any site, agency or practice lawful. Sources and status were checked on 6 September 2026.

Most data, privacy, advertising and IP material cited is UK-wide. The Equality Act 2010 covers England, Wales and Scotland; Northern Ireland has a different discrimination framework. Public procurement and sector rules need body and territory analysis.

What to take away

A website project has no single compliance switch, so route each issue to the right reviewer.
Controller and processor labels follow actual decision-making, not what a master agreement calls the agency.
PECR needs a fact-specific assessment of cookies, pixels and other storage or device access.
Public-sector accessibility rules apply to covered bodies, and outsourcing does not remove their responsibility.
A self-employed creator usually owns commissioned intellectual property unless the contract changes that position.
Security, contract and employment status each need their own gate with named evidence.
A hold on launch must name the missing evidence, the owner and a safe route to resolution.

Start with facts, roles and jurisdiction

Open one matter record before design begins:

Data Act 2025 Commencement Dates

5 Feb 2026
Most Part 5 data-protection changes
19 Jun 2026
Section 103 complaints to controllers

exact legal parties and trading names;
buyer location, intended user locations and sector;
whether users are businesses, consumers, children, workers or public-service users;
website task, content, payment and support routes;
data items, purposes, technologies, recipients and transfers;
creators, assets, licences and subcontractors;
acquisition channels and claims;
hosting, code, accounts, incident control and exit;
applicable nation, regulator, contract law and dispute forum.

England is not a shortcut for "UK law applies identically". Ask the qualified lawyer to record territorial extent, commencement, exemptions and any devolved or sector-specific rule. Guidance explains a regulator's view or an operational route. It is not legislation and may be under revision.

The Data (Use and Access) Act 2025 shows why dates matter. The government's commencement plan says most Part 5 data-protection and privacy changes took effect on 5 February 2026.

The sixth commencement regulations bring section 103 and Schedule 10, on complaints by data subjects to controllers, into force on 19 June 2026, with transitional provisions. Recheck the amended law and current ICO pages for the particular decision, rather than a pre-2026 template.

Data protection and PECR are related, not interchangeable

Map each processing purpose separately. Discovery research, account administration, form handling and analytics are separate rows. So are personalisation, recruitment, support and direct marketing.

Processing Purpose Row

Categories of people and data
Source, lawful basis and necessity
Retention, access, recipient and transfer
Security, rights route and deletion evidence

Controller and processor labels follow actual decision-making. The ICO's role guidance explains that a controller determines purposes and means, while a processor acts on behalf of a controller. An agency can occupy different roles for different operations. Calling it a processor in a master agreement does not settle every analytics, portfolio or business-development use.

Where a processor relationship exists, the UK GDPR contract requirements form their own gate. The ICO page on what a processor contract must contain covers instructions, confidentiality, security, subprocessors, assistance, end-of-contract data and audits. The parties still need a qualified reviewer to apply these requirements to the service.

PECR addresses particular communications and technologies. Inventory cookies, pixels, local storage, SDKs and other operations that store information or access a device. The ICO's current storage and access guidance requires a fact-specific assessment. A tag name such as "analytics" does not determine whether an exemption applies.

For email, text or social direct messages, document the subscriber type, data source and consent route. Also record the UK GDPR basis, sender identity, transparency and suppression.

The ICO's electronic-mail guidance was updated on 28 April 2026. Public contact details do not by themselves establish consent, and a platform's send button is not legal authority.

Penalties give the gate teeth. Under the UK GDPR, the ICO can fine up to £17.5m or 4% of global annual turnover, whichever is higher. PECR breaches can attract up to £500,000.

Most controllers also pay an annual data protection fee to the ICO. The tiers are £52, £78 or £3,763 a year, according to the ICO fee guidance, with a £5 discount for direct debit.

Advertising and consumer protection need the exact journey

Make a claim register before copy enters a design. Each row needs the exact wording, intended audience, placement and claim class. Add the evidence owner, substantiation file, qualification and approval date. Record the source date and expiry.

Claim Register Fields

Exact wording, audience and placement
Claim class and evidence owner
Substantiation file and qualification
Approval date, source date and expiry

Include comparisons, testimonials, reviews and price statements. Add savings claims, environmental claims and sector-specific material.

CAP Code Section 2 requires marketing communications to be recognisable, including advertorials. Section 3 covers material misleadingness, substantiation, qualifications, comparisons, availability and price presentation. These are UK non-broadcast advertising rules, not proof that a particular page is acceptable.

Where a website affects a consumer's transactional decision, current consumer law matters. The CMA's unfair commercial practices guidance says the relevant Digital Markets, Competition and Consumers Act 2024 provisions cover practices on or after 6 April 2025.

It covers always-prohibited practices, misleading actions and omissions, aggressive practices and professional diligence. The lawyer must decide whether the user, trader, invitation to purchase and practice fall within scope.

The same Act bans fake reviews and drip pricing from 6 April 2025, and mandatory fees must appear in the headline price. A claim can breach consumer law and pass the CAP Code, or the reverse.

Keep regulated-sector review separate. Financial, health, gambling and alcohol content may have further regimes. So may employment, charity or children's content. Neither an agency's general copy review nor an ASA search replaces the responsible regulator and qualified subject specialist.

Accessibility duties depend on the organisation and service

Accessibility is both a design discipline and a legal issue. Identify who provides the service, who uses it, the barriers present, any public-sector status and the governing territory. Do not tell a private buyer that the public-sector regulations automatically govern it, or that passing an automated scan proves compliance.

Accessibility Regime by Territory

England, Scotland, Wales

Equality law: Equality Act 2010
Public-sector rules: 2018 Regulations
WCAG test level: 2.2 AA for new work

Northern Ireland

Equality law: DDA 1995
Public-sector rules: 2018 Regulations
WCAG test level: 2.2 AA for new work

EU sales

Equality law: European Accessibility Act
Public-sector rules: Separate regime
WCAG test level: Own evidence

GDS guidance on public-sector website accessibility says the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 apply to covered public-sector sites and apps. It distinguishes the Equality Act 2010 in England, Scotland and Wales from the Disability Discrimination Act 1995 in Northern Ireland.

It also notes that outsourcing does not remove the public body's responsibility. Covered bodies must publish an accessibility statement, and the monitoring body is the Government Digital Service.

The 2018 Regulations reference the WCAG 2.1 AA level through EN 301 549. GDS guidance for new public-sector work now points to WCAG 2.2 AA, so the test plan should name the version used.

If the site sells into the EU, the European Accessibility Act applies to many products and services from 28 June 2025. That is a separate regime and needs its own evidence.

For an England project, a named accessibility and equality specialist should determine applicable duties and the test plan. Evidence covers component checks, keyboard journeys, screen-reader journeys and content alternatives. Add zoom and reflow, forms, documents, error recovery and user research.

Record tested pages, environments, assistive technology, failures and exclusions. Note the retest date. A WCAG statement is no substitute for that evidence.

Intellectual property must be itemised

List copy, code, designs, photographs and video. Add fonts, themes, plug-ins, databases and domain names. Trade marks and open-source components go on the same register.

IP Asset Register Row

Creator and employer or contractor status
First owner, assignment or licence
Permitted use, territory, term and attribution
Modification, source delivery and exit rights

The GOV.UK intellectual-property overview states that a self-employed creator usually owns commissioned IP unless the contract changes the position. Payment for a deliverable is therefore not enough evidence of ownership.

A written agreement should distinguish background material from new work, ownership from permission to use, and transferable assets from supplier or third-party components.

Under the Copyright, Designs and Patents Act 1988, an assignment of copyright must be in writing and signed by the assignor. A bare invoice does not transfer rights. Moral rights belong to the creator and must be waived in writing if the client wants unrestricted use.

Registered trade marks add a separate cost. A UKIPO online application is £205 for one class, plus £60 for each extra class, per the UKIPO application guidance. Renewal falls due every ten years. Check the register before you commit to a name.

Trade-mark clearance, moral rights and stock licences each need separate evidence. So do font deployment, open-source notices and portfolio use. Open-source licences such as MIT, Apache 2.0 and GPL carry different obligations. GPL can require source disclosure on distribution.

The agency should not publish client work in a case study unless the relevant rights, confidentiality and approval route genuinely permit it.

People labels do not determine employment status

An agency may use employees, workers, freelancers, personal-service companies and subcontractors. The parties should document supervision, substitution, integration and control. Also record equipment, financial risk and the real working arrangement.

Employment Status Key Figures

12 weeksAgency worker rights threshold
£5mMinimum employers' liability cover
6 Apr 2021Off-payroll rules for medium and large clients

GOV.UK's employment-status guidance warns that tax and employment-law status can differ. A contractor can be self-employed, a worker or an employee depending on the circumstances. The tests come from case law and statute, not from the label on the contract.

Key factors include personal service, control and mutuality of obligation. Cases such as Ready Mixed Concrete (1968), Autoclenz v Belcher (2011) and Uber BV v Aslam (2021) shaped the tests. A written contract is a starting point, not the answer.

Off-payroll working rules under Chapter 10 of ITEPA 2003 shift the tax burden to medium and large private-sector clients for engagements from 6 April 2021. Small companies, as defined in the Companies Act 2006, are exempt. HMRC's Check Employment Status for Tax tool gives an indicative answer only.

Agency workers gain rights under the Agency Workers Regulations 2010 after 12 weeks in the same role. Employers' liability compulsory insurance must cover at least £5m. Both apply regardless of what the engagement letter says.

Keep employment rights, off-payroll tax, health and safety and equality as separate reviews. Also keep confidentiality, access and IP creation separate. A statement that someone is "independent" does not decide any of them.

The Employment Rights Bill introduced in October 2024 is expected to change some tests and timelines. Check commencement regulations before relying on a 2026 position.

Security needs evidence from build through exit

Define security responsibilities across the buyer, agency, host and content system. Add plug-ins and other suppliers. Require access control, repository protection, dependency records and secure configuration.

Also require peer review, deployment authority and logging. Add testing, vulnerability handling, backup and incident escalation. Credential transfer at exit closes the loop.

The NCSC's secure development and deployment guidance spans development culture, repositories, pipelines, continual testing and planning for flaws. The NCSC expressly says those principles do not guarantee a secure product.

Cyber Essentials certification typically costs around £300 to £500 plus VAT in the UK, depending on the certification body. Cyber Essentials Plus adds a technical assessment. Both certificates expire after 12 months.

A personal data breach that meets the threshold must reach the ICO within 72 hours under UK GDPR Article 33. Keep an incident log with timings, decisions and notifications.

Treat certificates and supplier questionnaires as evidence inputs, not conclusions. Test the actual configuration and retain findings, exceptions and remediation owners.

Contracts allocate work but do not cancel statutory duties

A website agreement should name the correct legal parties, the scope, exclusions, dependencies and deliverables. Add acceptance, service levels, the change process, charges and VAT. Also cover expenses, subcontractors, IP and data terms.

It should also address confidentiality, security and accessibility. Claims approvals, liability, insurance and termination belong in the same document. So do transition and the dispute route.

Liability caps, indemnities and insurance limits need separate review. A common agency cap is a multiple of fees, often between one and three times the annual charge. Professional indemnity cover of £1m to £5m is typical for agencies, though the right level depends on the risk.

Do not let a broad warranty stand in for a control. If the buyer needs an accessible checkout, the schedule should name the journeys, standard or legal basis, environments and tests. Add defect categories and the retest process.

If the buyer needs source code at exit, state repository, branch, dependencies and documentation. Add credentials, format and acceptance.

For large or complex public services, the Cabinet Office Model Services Contract collection can provide an authoritative public-sector reference for implementation, testing, IP and exit. It is not a ready-made private web-agency contract and should not be copied without legal and procurement review.

Where the Procurement Act 2023 regime applies, use current procurement guidance and check territorial and body scope. The regime took effect on 24 February 2025 in England, Wales and Northern Ireland. Scotland runs its own rules under the Procurement Reform (Scotland) Act 2014. Private buying may follow different routes.

The Late Payment of Commercial Debts (Interest) Act 1998 gives a statutory right to interest, typically 8% above the Bank of England base rate, plus fixed compensation.

Tax, VAT and finance remain independent

Quotes should identify currency, unit, period, deliverables and exclusions. Add expenses, payment trigger and VAT status. Separate one-off build, recurring licences, hosting and support.

Also separate internal labour, specialist reviews, remediation and migration. Exit costs deserve their own line. A budget approval cannot validate tax treatment.

HMRC's VAT guidance says rates can change and currently describes a 20% standard rate for most goods and services. That UK-wide statement is not a ruling on an agency supply. A named tax adviser and finance approver should confirm registration, place of supply, invoicing and recoverability for the actual parties.

Making Tax Digital for VAT and place-of-supply rules for digital services need separate checks. Keep the priced schedule and the tax analysis apart.

Use a release gate with named evidence

Before publication or launch, the decision owner should receive a table with one row per gate:

Gate	Required record	Verdict options
Data and PECR	purpose map, roles, notices, technology list, contracts, rights and suppression	proceed, hold, stop
Advertising and consumer	claim register, substantiation, qualification and sector review	proceed, hold, stop
Accessibility and equality	applicable framework, test scope, findings and remediation	proceed, hold, stop
IP and asset chain	asset chain, licences, approvals	proceed, hold, stop
Employment status	working facts, status test, off-payroll analysis, insurance	proceed, hold, stop
Security	architecture, access, test, incident, recovery and exit evidence	proceed, hold, stop
Contract and procurement	parties, authority, award route, scope, acceptance, change and exit	proceed, hold, stop
Tax and finance	priced schedule, VAT analysis, approval and contingency	proceed, hold, stop

A hold must name the missing evidence, the owner and a safe route to resolution. A stop applies when a required permission or right is absent. Other stop triggers include a critical barrier, an unsubstantiated claim, an unacceptable security defect, or parties who cannot recover and exit safely.

This article remains editorial-draft-hold. Before publication, assigned UK specialists must re-open legislation, regulator guidance and contract references.

They should confirm commencement and jurisdiction, inspect the actual website facts, and record their names and conclusions. The defensible outcome is a traceable set of bounded decisions, never a blanket statement that the project "complies".

Before you act

Open one matter record before design begins.
Map each processing purpose separately with lawful basis and retention.
Build a claim register before copy enters a design.
Name an accessibility and equality specialist for the project.
Itemise every asset with creator, ownership and licence terms.
Record the applicable nation, regulator and dispute forum.
Document the real working arrangement and check off-payroll status.
Set security evidence, breach timings and exit transfer in the contract.
Price each gate separately, including VAT and specialist reviews.

Common questions

Why does the Data (Use and Access) Act 2025 matter for a 2027 project?

Its commencement dates changed the law. Most Part 5 data-protection and privacy changes came into force on 5 February 2026. Complaints by data subjects to controllers came into force on 19 June 2026. Recheck the amended law and current ICO pages rather than relying on a pre-2026 template.

Can an agency call itself a processor in the contract and settle every use?

No. Controller and processor labels follow actual decision-making. An agency can occupy different roles for different operations, and calling it a processor in a master agreement does not settle every analytics, portfolio or business-development use. A qualified reviewer must apply the requirements to the service.

Does passing an automated accessibility scan prove compliance?

No. A named accessibility and equality specialist should determine the applicable duties and test plan. Evidence may include component checks, keyboard journeys and screen-reader journeys. Add content alternatives, forms, documents and error recovery. A WCAG statement is not a substitute for that evidence.

How does employment status affect a web project in 2027?

An agency can use employees, workers, freelancers and personal-service companies. Status depends on the real arrangement, not the contract label. GOV.UK's employment-status guidance warns that tax and employment-law tests can differ.

Off-payroll rules under ITEPA 2003 shift the tax burden to medium and large clients for engagements from 6 April 2021. Keep the working facts, insurance and status analysis on file.

What security evidence should a 2027 launch gate require?

Access control, repository protection, dependency records and secure configuration are the starting point. Add peer review, deployment authority, logging and testing. Vulnerability handling, backup, incident escalation and recovery follow. Credential transfer at exit completes the set.

The NCSC's secure development and deployment guidance covers these areas but states that the principles do not guarantee a secure product. A personal data breach that meets the threshold must reach the ICO within 72 hours.