How to tackle the “monsters” lurking in public sector websites

As a website administrator, you face an increasingly demanding job. It’s not enough to create engaging content, master SEO, and keep your organization’s information up-to-date. On top of that, you also need to comply with the requirements of the Information Management Act, the Digital Services Act, and data protection laws. These “monsters” often end up lurking under the bed because you’re unsure where to even begin.

In this blog, I’ll briefly outline these “monsters” and provide a few tips to help you get started. These guidelines won’t cover everything or guarantee perfection, but a little is better than nothing.

Accessibility

Website accessibility means that as many people as possible, regardless of their abilities, can easily use the service. This includes technically error-free implementation, a clear and understandable user interface, and content that is easy to comprehend.

At a minimum, check the following:

• Visit a random page from your site’s footer menu. Imagine a user lands on this page via Google. Can they understand where they are within the site and what topic the page relates to?
• Ask a colleague to find a guide or page unrelated to their usual tasks. Does the menu make sense? Can they find the page in multiple ways (menu, sitemap, internal search)?
• Can you navigate your site using only the keyboard (tab, space, and enter keys will be your friends here)?
• Test your site on a mobile device.
• Does your site have an accessibility statement?

Additional tips:

• Use Google’s PageSpeed Insights tool for more guidance on improving accessibility, along with other useful information.
• Explore the accessibility guides from Papunet and AVI’s Saavutettavuusvaatimukset.fi website (both in Finnish).

Data security and privacy

Data security is about ensuring the availability, integrity, and confidentiality of the service. Data privacy, on the other hand, refers to using personal data for its intended purposes and minimizing the amount of collected data.

Improving both data security and privacy starts with identifying what data is used and what risks are associated with it, followed by preparing for potential issues.

First steps to improve data security:

1. Gather information:
   • What non-public data is stored in your service? For example, feedback, inquiries, or data behind login systems.
   • List all the services connected to your platform, such as the content management system, analytics, chatbot, server capacity, domain management, etc.
   • Collect a list of companies and contact information related to the services mentioned above.
   • Gather a list of administrators and user accounts for the services.
2. Risk assessment:
   • Do you know all the entities involved with your platform? Do you know who can modify the content?
   • Would data leaks cause any harm?
   • How long can the service be down without significant impact?
   • What if all data in the service is completely or partially lost?
3. Get the basics right:
   • Are user accounts only given to the right people, with appropriate access permissions?
   • Do you know who logged into the system and when?
   • Can you view the content’s version history?
   • Do you know where backups are stored, and have you practiced restoring them?
   • Have security updates been installed for your software? Who is responsible for this?
   • How do you receive information about security threats?
4. Prepare for the unexpected:
   • What steps should be taken if the service is down for an extended period?
   • How can you restore backups?
   • What if the service needs an emergency shutdown? For example, if it starts distributing viruses.
   • How could you switch to an alternative service if things go wrong?

Checklist for improving data privacy:

• Make sure your privacy policy is easily accessible, and that you understand its contents.
• Ensure you aren’t collecting more data than specified in the privacy policy.
• Keep personal data up-to-date, and don’t retain unnecessary information longer than necessary.
• Are you transferring data outside the EU/EEA?
  • If so, ensure this is mentioned in your policies, and that transfer mechanisms are covered in agreements.
  • If not, avoid installing tools like Facebook Pixel or Google Analytics on your site.
• If you use cookies that are not strictly necessary for the technical functionality of the service, ensure your cookie policy is on the website, and that it’s as easy to reject cookies as it is to accept them.

Remember, achieving perfection is nearly impossible. The key is to make continuous improvements step by step, focusing on what is most relevant and practical.

Would you like to hear more? Get in touch using the form, and I will get back to you shortly.