Foundations
Part of Community management foundations in England: models and law
Before you launch a community offer, test need, scope, data, moderation and exit
Use this market-entry checklist to test an English community offer, covering member need, service scope, data, moderation, security and exit.
A new community offer needs a defined member problem and an operating system behind it. Completing this checklist does not guarantee demand. It exposes assumptions that should be tested before an English provider hires a team, signs a platform contract or promises coverage.
What to take away
- A community offer needs a defined member problem and an operating system behind it.
- Completing the checklist does not guarantee demand but exposes assumptions to test before hiring or signing contracts.
- Separate who benefits, who pays and who approves the purchase; they may be different people.
- Test a bounded pilot with written success and stop criteria before full launch.
- If the service only works under unusually favourable conditions, revise the offer before entering the market.
Member need and buyer
- Name the people who will participate and the task they cannot complete easily today.
- Identify who benefits, who pays and who approves the purchase. They may be different people.
- Interview likely members separately from budget owners.
- Record alternatives already used, including email lists, events, support desks and informal groups.
- State who is outside the initial service.
Do not count social followers as prospective members without evidence that they want sustained peer interaction. A waiting list is more useful when it asks about the intended activity and willingness to participate, not merely an email address.
Scope and responsibilities
- Define whether the offer supplies software, strategy, daily management, moderation, events, analytics or a combination.
- Set hours of cover and an urgent escalation route.
- Allocate decisions on rules, removals, appeals and member complaints.
- Describe what happens when an answer requires legal, safeguarding, technical or customer-account expertise.
- Separate included work from chargeable change.
A service boundary should be understandable to the buyer's operational team, not only its procurement lead. Run a tabletop example involving a difficult post and trace who receives it, decides and records the outcome.
Difficult post escalation route
- Difficult post appears
- Moderator receives it
- Decides on removal or appeal
- Escalates legal or safeguarding
- Records outcome
Data and privacy
- List personal data collected at registration and during participation.
- Document the purpose and lawful basis for each use.
- Establish controller and processor roles from the actual arrangement.
- Set retention, deletion, access and export procedures.
- Check transfers and sub-processors before agreeing terms.
The Information Commissioner's Office provides a data protection fee self-assessment and detailed guidance for controllers and processors. Fee status is only one question; completing the assessment does not replace privacy work for the service.
Data and privacy checks
- List personal data collected
- Document purpose and lawful basis
- Set controller and processor roles
- Set retention, deletion, access, export
- Check transfers and sub-processors
Safety and moderation
- Write participation rules in language members can understand.
- Define moderator powers and evidence retained after action.
- Provide a route for appeals or corrections.
- Plan for threats, harassment, illegal content and vulnerable participants according to the actual risk.
- Train anyone who covers an escalation channel.
Avoid copying a generic policy without testing it against likely cases. A professional peer network and a public consumer forum do not face identical behaviour or consequences.
Decide how rule changes will reach existing members. Silent policy edits can leave moderators applying a new standard that participants have not seen. Version the rules, retain the effective dates and provide a clear contact for questions. If children or other higher-risk groups may participate, stop and obtain appropriate specialist advice.
Technology and security
- Map administrator privileges and require strong authentication.
- Confirm backups, recovery objectives and incident contacts.
- Test exports before launch, including relationships between posts and member records.
- Review accessibility on the journeys members will use.
- Record which integrations can change or delete data.
The National Cyber Security Centre's guidance for small organisations offers practical security measures, including backups and protection from malware. Apply them to the selected architecture and obtain specialist review where the risk requires it.
Commercial proof and exit
- Price the full delivery model, including people and irregular incidents.
- Choose measures tied to the member task rather than raw activity.
- Test a bounded pilot with written success and stop criteria.
- State ownership of configuration, content, data and work created for the client.
- Rehearse how members, records and responsibilities move at termination.
The launch decision should name unresolved risks and an owner for each one. If the service only works when participation, moderation load or supplier terms remain unusually favourable, revise the offer before entering the market.
Before you act
- Name the member problem and who pays.
- Define scope, hours and escalation routes.
- Document data purposes, roles and retention.
- Write understandable rules and moderation powers.
- Map admin privileges and test exports.
- Price full delivery and rehearse exit.
Common questions
What should a community offer define before launch?
It needs a defined member problem and an operating system behind it. This includes naming participants, the task they cannot complete easily, who benefits, who pays and who approves. Also define scope, responsibilities, data handling, moderation and commercial proof.
How should a provider test demand for a community offer?
Interview likely members separately from budget owners. Record alternatives already used. Do not count social followers without evidence of sustained peer interaction. A waiting list should ask about intended activity and willingness to participate, not just an email address. Test a bounded pilot with written success and stop criteria.
What data protection steps are needed for a community offer?
List personal data collected at registration and during participation. Document the purpose and lawful basis for each use. Establish controller and processor roles. Set retention, deletion, access and export procedures. Check transfers and sub-processors before agreeing terms. The ICO provides self-assessment and guidance.
