Who keeps a website up to date

Once a website is built, somebody has to look after it. It might be your own team, a freelancer, an agency, the website builder or a managed service. Each one puts the logins and the domain in different hands.

Five arrangements, side by side

• Your own team. You edit the pages with the tools that came with the site, and you hold every login.
• A freelancer on a retainer. One person makes the changes you ask for, within an agreed amount of time each month.
• An agency plan. A firm covers changes, software updates and backups, to the extent the plan sets out.
• A website builder's subscription. The builder runs the hosting and its own software, and your team edits the pages. Wix, for one, says it performs software updates and releases new features for you automatically.
• A managed monthly service. A supplier both runs the site and makes the changes you ask for, for a regular fee.

Questions to ask before you agree

1. Whose name will the domain be in? ICANN oversees generic names such as .com. Its transfer policy says the registered name holder and the administrative contact are the only parties that have the authority to approve or deny a transfer to another registrar.
2. Who holds the logins? Ask for a list covering the site, the hosting and the domain. The NCSC lists the website, and domain hosting where it is a separate account, among a small organisation's important accounts.
3. Who keeps a copy of the site, and where? The NCSC's backup guidance includes a business's website in the data to copy.
4. What can you take with you if you stop? Platforms differ. Squarespace, for example, lists video blocks, product blocks and style settings among the content that doesn't export.
5. How much notice does each side give? Ask for it in writing alongside the rest.
6. Will the supplier handle personal data from the site? Messages from a contact form are personal data. The next section covers what the Information Commission (which took over from the ICO on 30 September 2026) expects.

Contracts and personal data

The Information Commission calls the organisation that decides why and how personal data is used the controller. An outside firm that handles the data on its behalf is a processor. The Information Commission says that whenever a controller uses a processor, there must be a written contract (or other legal act) in place.

A spoken agreement can count as well. Citizens Advice, writing for people in England who buy a service as consumers, says you may have a contract even if there's nothing in writing. Its examples are accepting a quote, paying the fee or a deposit, or telling the business to go ahead.

Useful links

• Domain name holder FAQs (ICANN)
• Transfer Policy (ICANN)
• Contracts between controllers and processors (Information Commission)
• What are controllers and processors? (Information Commission)
• Secure your important online accounts (National Cyber Security Centre)
• Cancelling a service you've arranged (Citizens Advice)
• Export your site content (Squarespace Help Center)