TAKE A LOOK INSIDE
A fictional business. A real look at the report format.
THE OVERVIEW
This fictional design studio has a simple public website and an Instagram presence. The main opportunities are a clearer reporting route, a consistent response process and better evidence that safeguards work. Nothing in this sample establishes legal compliance or proves that a public website has been inspected.
Illustrative assessment of an ordinary business website and a business-operated social profile. The studio controls its own published material and account settings; the social platform controls its wider service. Proposed Digital Duty of Care coverage needs checking against the final law and actual service functionality.
The fictional owner describes a general contact form, but no documented process for harmful comments or impersonation reports.
WITHIN 30 DAYS
Add a clearly labelled reporting contact to the website and social bio. Assign an owner and backup, define an escalation route and test that a report reaches them.
Customers, prospective customers and staff.
The owner reports a contact form and manual checks of business social accounts. These controls have not been tested.
Send a harmless test report, check receipt and escalation, and record the result.
A named owner and documented process should make responses more consistent. Confirm this by testing a report and recording the response.
Basis: owner. Illustrative judgement based on the fictional owner answers. Public content and control effectiveness have not been verified. Review: Keep in place while the channel operates. Test quarterly and after changes.
The owner says comments are enabled on a business social account. Public comments can expose customers or staff to abuse or unwanted personal information.
WITHIN 30 DAYS
Set appropriate comment filters, publish simple participation rules and review tagged content. Record how staff should hide, report or escalate harmful posts without reproducing them.
Customers, prospective customers and staff.
The owner reports a contact form and manual checks of business social accounts. These controls have not been tested.
Send a harmless test report, check receipt and escalation, and record the result.
A named owner and documented process should make responses more consistent. Confirm this by testing a report and recording the response.
Basis: owner. Illustrative judgement based on the fictional owner answers. Public content and control effectiveness have not been verified. Review: Keep in place while the channel operates. Test quarterly and after changes.
A contact form collects customer enquiries. The owner has not supplied evidence showing what is collected, who can access it or when it is deleted.
WITHIN 30 DAYS
Review the form fields, collection notice, inbox permissions and retention settings. Avoid asking for sensitive information and test the deletion process.
Customers, prospective customers and staff.
The owner reports a contact form and manual checks of business social accounts. These controls have not been tested.
Send a harmless test report, check receipt and escalation, and record the result.
A named owner and documented process should make responses more consistent. Confirm this by testing a report and recording the response.
Basis: unknown. Illustrative judgement based on the fictional owner answers. Public content and control effectiveness have not been verified. Review: Keep in place while the channel operates. Test quarterly and after changes.
The fictional owner reviews accounts when time allows. No review log or change-trigger process has been described.
WITHIN 90 DAYS
Keep a simple safety log. Record complaints, review actions and safeguard tests. Revisit the assessment before adding public uploads, user messaging or an AI feature.
Customers, prospective customers and staff.
The owner reports a contact form and manual checks of business social accounts. These controls have not been tested.
Send a harmless test report, check receipt and escalation, and record the result.
A named owner and documented process should make responses more consistent. Confirm this by testing a report and recording the response.
Basis: owner. Illustrative judgement based on the fictional owner answers. Public content and control effectiveness have not been verified. Review: Keep in place while the channel operates. Test quarterly and after changes.
These gaps are part of the assessment. They have not been treated as evidence of low risk.
Something unclear or an idea to improve your report? Leave Lewis a message
“Sources found” means relevant cited public material was available. It does not mean every page, post or control was reviewed. Search-only and login-restricted content may be incomplete.
Get an assessment tailored to your business.