Hello everyone! I'm Mark Tomkins, Creative Director and Founder at Aubergine - leaders in providing accessible and compliant websites and .gov.uk services to parish, town and community councils. I also wear another hat that’s likely very familiar to you: I am a serving councillor for Eaton Bray Parish Council. 

This dual perspective allows me to see the challenges of council administration from both sides of the table - the technical requirements of the IT provider and the budget-conscious, community-focused reality of the council chamber.

I recently joined the Scribe Academy to break down a topic that has been causing a ripple of anxiety across the sector: Assertion 10. If you have looked at the SAPPP Practitioners’ Guide 2025, you will have noticed this new governance requirement. It focuses specifically on digital and data compliance and, with the 2025/26 AGAR (Annual Governance and Accountability Return) on the horizon, we need to ensure our houses are in order.

In this three part-series, we’ll cover some of the key requirements of Assertion 10 to empower you with the knowledge to tick that "Yes" box with confidence when the forms arrive later this year.

• Part 1 of 3: Website Domain & Emails (this blog)
• Part 2 of 3: Website Accessibility
• Part 3 of 3: IT Policy

👉 Why Digital Compliance Matters

It isn't just about bureaucracy. It is about professionalising our sector and protecting our communities. As parish and town councils, we are responsible for public money and public data. Whether we are managing a small village green or a large town hall, the principles of data security and accessibility remain the same.

Assertion 10 connects directly to how we operate daily. It asks us to confirm that we are managing our digital presence responsibly. If we get this wrong, we risk data breaches, lost information, and a lack of public trust. If we get it right, we build a robust, secure foundation for our council's future.

🏗️ The 4 Pillars of Assertion 10

Assertion 10 is essentially made up of four key components. To be compliant, you need to address all of them:

• Domain Names and Email: Using council-owned, generic email address for the clerk.
• Website Accessibility: Continuing to comply with existing accessibility regulations.
• GDPR and Data Protection: Reinforcing compliance with UK GDPR and the Data Protection Act.
• IT Policy: This is a new requirement - the introduction of a formal IT policy.

While all four are vital, the area that creates the most confusion, and the one I spent the most time on during the webinar, is the requirement for domain names and email management.

🪦 The Death of the "Free" Email

Let’s get into the specifics, particularly regarding section 1.47 of the SAPPP Practitioners Guide:

“1.47 Email management - Every authority must have a generic email account hosted on an authority owned domain, for example clerk@abcparishcouncil.gov.uk or clerk@abcparishcouncil.org.uk rather than abcparishclerk@gmail.com or abcparishclerk@outlook.com for example.”

The "Must Not" Rule

We must stop using free email services for official council business. This means addresses ending in @gmail.com, @hotmail.com, @yahoo.com, or @outlook.com are no longer permitted for the Clerk along with all other free email services that use domains not owned by the council.

Why? Because the council does not own that data. Alphabet owns Gmail; Microsoft owns Hotmail. If you have a Clerk who has used a Yahoo address in his or her own name for 15 years and leaves without handing over the password, that data is gone. The council has no legal right to access it, which makes fulfilling Freedom of Information (FOI) requests or Subject Access Requests (SAR) nearly impossible. Not to mention the loss of access to current data.

The "Must" Rule

Every authority must have a generic email account hosted on an authority-owned domain name. 

The Clerk's address must be generic - clerk@, townclerk@, or manager@ - we call it ‘role-based’. This ensures that when personnel change, the point of contact for the public remains consistent.

• Correct: clerk@abcparishcouncil.gov.uk or clerk@abcparishcouncil.org.uk
• Incorrect: abcparishclerk@gmail.com

The Gold Standard: .gov.uk

While you can use .org.uk or .com if the council owns the domain, the .gov.uk domain is the gold standard. It offers immediate authenticity. When a resident receives an email from a .gov.uk address, they know it is legitimate because these domains are strictly vetted. You cannot just buy one off the shelf; you have to prove you are a council.

Conversely, anyone can register johnsparishcouncil.org.uk right now without verification. That lack of scrutiny makes non-government domains less secure.

Naming Conventions 

If you are moving to a .gov.uk domain, you are restricted to specific naming conventions to ensure uniformity across the public sector:

• [location]parishcouncil.gov.uk
• [location]-pc.gov.uk
• [location]parish.gov.uk

And there’s variations for town and community councils, too.

🔓 Practical Strategies for Council Officers

Audit Your Current Setup

First, check your current status. Does the council own the domain name? I have seen cases where a domain was registered by a web developer who moved to Thailand five years ago. If that domain expires, your website and email vanish. Ensure the Registrant is the council itself.

Budget for IT

As a councillor, I see the pressure to save money, however, failing to invest in IT is a false economy. A data breach caused by antiquated systems will cost you far more in time, stress, and potential fines than a proper email subscription. Include a sensible line item in your precept for software, hardware, and security.

Migration Management

If you are moving from a Gmail address to a .gov.uk address, do not delete the old account immediately. Keep it stagnant. You may need to access historical data for finance, regulatory information or contracts. However, set a deadline to close it eventually. Leaving it open indefinitely is a "data time bomb."

⭐ Councillors and Best Practice

Let me bust a big myth: It is not a legal requirement for everyone in the council, including all the councillors to have a .gov.uk email address. At the moment, this is simply not true and is a widely-regurgitated inaccuracy.

However, it is highly recommended. Why?

• The Best Case: Councillor Bob uses cllr.bob@abcparishcouncil.gov.uk. The data is separate, secure, and the council owns it.
• The Acceptable Case: Councillor Bob sets up a specific free email specifically for council business, like cllr.bob.abcpc@gmail.com. This separates council work from personal life.
• The unacceptable Case: Councillor Bob uses bigbob1968@yahoo.co.uk for council business, Amazon orders, and family photos. This is a GDPR nightmare. If the council receives a data request, we have no way to extract council data from his personal emails without violating his privacy.

For The "Tech-Hesitant" Councillor

• Challenge: "I've used my Hotmail for 20 years; I don't want another login."
• Solution: Explain that this is about protecting them and the council. If they use a personal account, their personal emails could technically be subject to scrutiny during an investigation. A separate council email protects their private life.

For The Small Parish Council

• Challenge: "We can't afford expensive IT systems."
• Solution: The cost of a .gov.uk domain has come down significantly. Providers like us at Aubergine even offer the first year of the domain for free to help councils get started.

✅ Key Takeaways

• Own Your Domain: Use a council-owned domain for your website address and official council email.
• Go Generic: The Clerk must use a role-based email address (e.g., clerk@).
• Stop Using Free Email: Gmail, Yahoo, and Hotmail are not compliant for the Proper Officer.
• Aim for .gov.uk: It unlocks free government services (like cyber security tools) and provides the highest level of trust.
• Separate Data: Councillors must, at a minimum, separate council business from personal email accounts.

Conclusion

Assertion 10 is not just a box-ticking exercise; it is about protecting the integrity of local government. By securing our domains and professionalising our email systems, we protect our residents and ourselves.

When we use a .gov.uk domain, we signal to our community that we are a legitimate, trusted tier of government. It improves the authenticity of our message and defends against the cyber attacks that, sadly, target our sector daily. Let’s make sure we are ready for the 2025/26 governance return, not because we have to, but because it is the right thing to do for our communities.

📖 Read Next: Assertion 10 for Town & Parish Councils (Part 2 of 3): Website Accessibility 

Resources

• Watch the Council Domain & Emails Webinar
• Access the Assertion 10 Slides
• Use the government domain checker tools or contact a registrar like Aubergine to see what naming options are available for your parish.

Mark Tomkins, Aubergine

Aubergine are the UK’s leading experts in purpose-built, WCAG 2.2 AA compliant, accessible websites for Town & Parish Councils, including .gov.uk domain registration, email hosting, and website compliance. If you have specific questions about your council's compliance needs, feel free to get in touch.

Visit: https://www.aubergine262.com/

Contact: thestudio@aubergine262.com

‍