Legal requirements for public sector websites

Public sector websites have a number of different requirements to a website for a business or charitable organisation. They need to do more than simply meet their objectives. They are often the first point of contact for essential services, and for many people they are the only way to access information or support.

Because of this, public sector websites are subject to specific legal requirements. They exist to protect people’s data, ensure fairness, and make sure services are usable by everyone. Some of these are required of all organisations, such as consent for collecting person data, but for public sector sites, it is even more important and they will be under more scrutiny to comply.

Below is a breakdown of the main legal duties that apply to public sector websites in the UK, and what they mean in practice.

Data protection (UK GDPR)

Most public sector websites collect personal data in some form, even if it is just a simple contact form or enquiry email. In some cases, that data might relate to a child, a vulnerable adult, or someone accessing a critical service, which makes the responsibility even greater.

Under UK GDPR, public sector organisations must be able to clearly explain what data they collect, why they collect it, and how it is protected. This information needs to be easy to understand and easy to find. People should never be left guessing how their data is being used.

In practical terms, this means privacy notices must be specific rather than generic, forms should only ask for information that is genuinely needed, and data must be stored and transmitted securely. It also means being careful about third-party tools and services, and understanding where data is going once it leaves the website.

Compliance is not just about having the right wording in place. Organisations are expected to show that data protection has been thought about properly and embedded into how the website works.

Cookie and tracking compliance

Public sector websites are expected to take a cautious and transparent approach to cookies and tracking.

Non-essential cookies, such as analytics or marketing tools, cannot be used unless a user has actively given consent. This includes many tools that are often added by default to websites without much thought.

Consent must be informed and meaningful, and a user must have clearly opted in. Users should be told what cookies do, why they are used, and given a genuine choice. Tracking should not start until that choice has been made, and it should be easy for users to change their mind at any point.

This is not about restricting insight but about respecting the user’s right to privacy. In a public sector context, trust matters, and how a website handles tracking can have a real impact on that trust.

Accessibility as a legal duty

Accessibility is one of the clearest legal obligations for public sector websites.

Public sector bodies are required to meet WCAG 2.1 AA standards under the Public Sector Bodies Accessibility Regulations. This applies to websites, intranets, extranets, and mobile applications.

Accessibility is about making sure people can use a website regardless of disability, technology, or circumstance. That includes people using screen readers, keyboard navigation, voice control, or other assistive tools.

Beyond making the site itself accessible, organisations must also publish an accessibility statement. This should explain how accessible the website is, highlight any known issues, and tell users how to report problems or request information in an alternative format.

Accessibility is not a one-off task. When content changes, documents are added, or systems evolve, it can affect the accessibility of a site. Ongoing awareness and regular checks are essential to staying compliant.

Transparency and accountability

Public sector websites play a key role in supporting openness and accountability.

People should be able to clearly understand what an organisation does, how its services work, and who is responsible for decisions. This information should not be hidden away or written in a way that is difficult to follow. For example, with a school they are required to display statutory policies.

Content needs to be accurate, up to date, and structured so users can find what they need without frustration. When information is outdated or unclear, it creates confusion and can undermine confidence in the organisation.

Transparency is not just about meeting a legal requirement. It is about respecting the time and needs of the people who rely on these services, often in stressful or urgent situations.

Security and service reliability

Public sector organisations have a legal duty under UK GDPR and the Data Protection Act 2018 to keep websites and digital services secure.

This includes implementing appropriate technical and organisational measures to protect personal data, maintain system availability, and ensure services can be restored quickly if something goes wrong. In practice, this means keeping software updated, controlling access to admin systems, maintaining backups and recovery plans, and regularly reviewing security controls.

Even where hosting or development is outsourced, the organisation remains legally responsible for security and must ensure suppliers meet the same standards.

In summary

Public sector websites require a careful consideration of law, technology, and public trust.

However, if you look at most public sector websites, you are likely to find flaws on them, particularly when it comes to accessibility. When these responsibilities are taken seriously, websites become more inclusive, more reliable, and more supportive of the people who depend on them.

If any of these areas feel difficult to manage, that usually points to a need for clearer processes and better support.

We have experience in building a number of public sector websites. If you need any help or are looking for a digital partner, get in touch.