Breakthrough Communications Blog

Understanding how the cost limit works can make handling FOI requests feel much more manageable.

Data protection should not be something you add on at the end. It should shape how your service is designed from the start.

Parish and town councils are currently focusing a great deal of attention on Assertion 10 of the Annual Governance Statement. This new assertion requires councils to confirm that they have proper arrangements in place in relation to several distinct areas of council digital and data governance. The Practitioners’ Guide explains that this includes data protection, web accessibility, the use of a compliant domain and appropriate IT controls and policies . In relation to data pr

Town and parish councils have spent the last few months getting to grips with Assertion 10. Many councils have been working hard to understand what the requirement means in practice. We have supported councils across the country and have noticed the same questions have come up repeatedly. From data protection duties to email management and record keeping, councils want clarity so they can feel confident they are meeting the standard. To make things clearer, our Head of Counci

Every town and parish council is unique ; they face their own challenges and strengths. As public bodies, councils play a vital role in promoting transparency and protecting personal data. Two key pieces of legislation that help deliver this are the Freedom of Information Act 2000 (FOIA) and the UK General Data Protection Regulations (UK GDPR). The FOIA allows anyone in the world to request information, and the UK GDPR includes a mechanism called the Subject Access Request (

At some point, every council gets asked for information. Some requests are simple. Some are significantly more complex, time consuming and even stressful. Whether it’s a Freedom of Information (FOI) request or a Subject Access Request (SAR), both can sometimes feel challenging. A common source of confusion is the distinction between FOI and SAR. Members of the public often mix them up when submitting requests. The rule is: If the requester is asking for their own personal dat

Parish and town councils process personal data on an almost a daily basis, sometimes without realising it. The result? Councils can feel overwhelmed, and unsure if they are meeting their obligations. Fearful of making a mistake that could damage trust, attract complaints. Our Head of Council Information Compliance has compiled his top ten most common pitfalls when it comes to data protection.   1. Forgetting to consider a lawful basis Every project or service involving person

From the 2025/26 AGAR, parish and town councils will be required to complete a new Assertion 10 as part of its Annual Governance Statement. This new requirement goes beyond the expectations previously that came under Assertion 3. This change will not just require a generic policy or an out of date impact assessment. Councils must be able to evidence compliance, not just their positive intentions. Yet the challenge is that local council professional are busy running their coun

Starting from the 2025/2026 financial year, councils must formally declare their compliance with UK GDPR as part of their AGAR.

Yesterday the new Data Use and Access Act 2025 passed royal assent, meaning the UK now has new data protection legislation in place. The legislation will arrive in a rolling fashion over the next two to twelve months. This blog post is designed to be an introductory guide to the changes that will impact local councils. So, what the big changes? The great-big, critical change to the way you do things is… nothing. (That is, if you've been doing what we've recommended council

Following recent local elections, many councils are welcoming new councillors into their councils. Many local council professionals have been in touch with our team to ask: How do we publish councillor contact information in a GDPR-compliant way? Lets start with the basics. Data protection and UK GDPR compliance is concerned with the protection of people’s personal data. So what counts as personal data when it comes to councillor contact details? In this case we are likely re

Councils will have to declare GDPR compliance in the 2025/26 AGAR. Discover what this means for your council today.

A new version of The Practitioners’ Guide is out, and for those of us working in the world of local councils and information compliance, there’s a crucial key update that’s really worth paying attention to: Assertion 10: Digital and Data Compliance.

As a parish or town council you will be aware of the need to follow the strict rules around processing peoples 'personal data'. The UK...

Parish and town councils of all shapes and sizes have a legal obligation to comply with information governance legislation, including UK...

Look after the pennies and the pounds will look after themselves, as the saying goes. In other words, look after the little problems and...