Stop guessing. Prove your parish council is compliant.

Assertion 10 is the newest addition to the SAPPP Practitioners' Guide, introduced in 2025. It requires parish and town councils to demonstrate digital and data compliance during their annual audit — covering council-owned domains, email systems, IT policies, website accessibility (WCAG 2.2 AA), GDPR compliance, and data handover procedures. Internal auditors now assess these areas as part of the Annual Governance and Accountability Return (AGAR).

Start by gathering evidence against each AGAR assertion, including Assertion 10. You need documentation showing: financial regulations are up to date, risk assessments reviewed, governance statement approved, transparency code requirements met, publication scheme current, and digital/data compliance addressed. Most clerks track this across scattered Word documents and emails — a compliance dashboard brings everything into one auditable view.

Parish councils with annual turnover under £25,000 must publish: all items of expenditure above £100, end-of-year accounts, annual governance statement, internal audit report, list of councillor responsibilities, the location of public land and assets, and minutes and agendas of formal meetings. Councils with turnover over £25,000 have additional requirements including quarterly expenditure data and procurement information.

The clerk is the Proper Officer and Responsible Financial Officer for most parish councils. Compliance responsibilities include: maintaining the publication scheme, ensuring the council website meets accessibility standards, managing GDPR obligations (privacy notices, FOI/SAR responses within statutory deadlines), preparing AGAR documentation, keeping financial regulations and standing orders current, and now addressing Assertion 10 digital requirements.

A parish council IT policy should address: acceptable use of council devices and email, data backup procedures, password requirements, use of personal devices for council business, social media guidelines, data retention and disposal, and incident response procedures. Since SAPPP Assertion 10, councils must also document their email systems, domain ownership, and data handover procedures for when the clerk role changes.

Parish councils must: designate a Data Protection Officer (or rely on their monitoring officer), maintain a privacy notice on their website, respond to Freedom of Information requests within 20 working days and Subject Access Requests within one calendar month, keep a Record of Processing Activities, and ensure council business is conducted via official (not personal) email addresses. The ICO has flagged three recurring parish council failures: personal email used for council business, missed FOI/SAR deadlines, and inadequate privacy notices.

ParishProof is designed to be affordable for even the smallest parish council budgets — priced for part-time clerks on £12-18/hour, not enterprise IT departments. Join the waitlist to hear about launch pricing first, including early-bird rates for founding members.

ParishProof is built by Crocker Digital Ltd (UK Company No. 17008789). Your data is stored securely in the UK, processed in accordance with GDPR, and never shared with third parties. We collect only your email address for the waitlist — no tracking cookies, no data selling.

ParishProof is built by Crocker Digital Ltd, a UK-registered company (No. 17008789) focused on building practical tools for underserved professional niches. The compliance challenges facing parish clerks — fragmented guidance, no tracking tools, and new audit requirements — are real problems that deserve a purpose-built solution.