The Assurance Desk
Part of the guide What is a Caldicott guardian, and who needs one?
What is the DSPT?
The DSPT is an online self-assessment tool. It lets an organisation measure its performance against the National Data Guardian's 10 data security standards.
It is a tool for health and care in England. Its organisation types are reviewed each year against the NHS and local authority structures in England.
The assessment is built in layers. Under each standard sit a number of assertions. For each assertion, you give evidence items that show you comply.
Category 1 organisations, such as NHS trusts, are also measured against the National Cyber Security Centre's Cyber Assessment Framework. They see the toolkit set out against that framework.
| Standard | In plain words |
|---|---|
| 1. Personal confidential data | All staff handle, store and send it securely, on paper or on screen |
| 2. Staff responsibilities | All staff understand their responsibilities under the standards |
| 3. Staff training | Staff understand information governance and cyber security |
| 4. Managing data access | Only staff who need the data for their role can see it, and access ends when the need ends |
| 5. Process reviews | Past breaches and near misses are recorded and used to fix problem processes |
| 6. Responding to incidents | Cyber attacks against services are spotted and resisted |
| 7. Continuity planning | A plan is ready for threats to data security, including significant breaches |
| 8. Unsupported systems | No unsupported operating systems, software or browsers are used |
| 9. IT protection | A strategy protects IT systems from cyber threats |
| 10. Accountable suppliers | IT suppliers understand their duties as data processors under the GDPR |
Who has to complete the DSPT toolkit?
If your organisation has access to NHS patient data and systems, it must use the toolkit. NHS England Digital says this is how you give assurance that you practise good data security and handle personal information correctly.
Completing it is a contractual requirement in the NHS England Standard Conditions contract. It also remains Department of Health and Social Care policy that all bodies that process NHS patient information give assurance through the DSPT.
What you complete depends on your organisation type. The type decides which of four categories of the toolkit you see.
A care home sits in the social care type. That type covers domiciliary care, care homes, residential homes and day services. It includes services commissioned by the NHS, by local authorities or by the people who use them. Providers count whether or not they are registered with the CQC.
A GP practice completes category 4. Social care, dentists, opticians, pharmacies, local authorities, universities and charities complete category 3.
Category 1 is set out against the Cyber Assessment Framework. NHS trusts, integrated care boards, commissioning support units and arm's length bodies moved to it in version 7. Independent providers designated as operators of essential services, and genomics organisations, followed in version 8. Version 9 is aligned to version 4.0 of the framework.
Some suppliers complete category 2. That applies to a company that supplies digital goods and services to the NHS or care, with 50 or more staff and a turnover of £10m or more. If you are not sure which type fits, the toolkit says to select Other. For Other, the toolkit covers only the health and care data you process.
| Organisation type | Category | What the assessment looks like |
|---|---|---|
| NHS trusts, integrated care boards, commissioning support units, arm's length bodies, genomics organisations, independent providers that are operators of essential services | 1 | Set out against the Cyber Assessment Framework |
| IT suppliers with 50 or more staff and a turnover of £10m or more | 2 | The IT supplier evidence items |
| Social care, including care homes, home care and day services | 3 | Category 3 items. A home care service sees a subset of an NHS trust's items, in plainer language |
| Dentists, opticians, pharmacies, local authorities, universities, smaller suppliers | 3 | The same category 3 evidence items |
| Other, including charities and NHS business partners | 3 | Covers only the health and care data you process |
| GP practices | 4 | The GP evidence items |
When is the DSPT deadline?
The deadline for the current toolkit is 30 June 2027.
That toolkit is version 9, for 2026-27. Its outcomes, assertions and evidence items were released on 2 October 2026.
The date follows a yearly pattern. Each organisation must publish at least one assessment by the deadline of 30 June every year. A guide written for an earlier toolkit will show an earlier year, so check which toolkit it describes.
It is a yearly job, not a one-off. Health and care organisations with access to NHS patient data and systems should complete a self-assessment every year.
What do Standards Met and the other results mean?
Standards Met is the result to aim for. You reach it by answering every question in the assessment that is marked as mandatory.
Approaching Standards is for social care organisations. It is a one-off assessment that shows good progress towards Standards Met.
Standards Exceeded goes further. For category 1 organisations, such as NHS trusts, integrated care boards and operators of essential services, it shows they have gone beyond Standards Met. For all other organisations, Standards Met plus a current Cyber Essentials Plus certification shows as Standards Exceeded.
You do not need Cyber Essentials Plus to complete the DSPT. If you hold it, some questions do not apply to you.
A renewal can also end in Standards Not Met. Some organisations send data to NHS England systems through an API. If one of them gets Standards Not Met, the toolkit's help pages say to assess the risk and, if necessary, stop sending data.
The toolkit shows your organisation's status, but no information on the content of your assessment is public. At Standards Met or Standards Exceeded, you can download a certificate. It can serve as evidence for the CQC, commissioners and NHS partners.
What happens if you do not complete the DSPT?
The DSPT is an information standard under section 250 of the UK Health and Social Care Act 2012. NHS England Digital says bodies that fail to submit a return may face enforcement action under that Act, which may include fines.
There are practical effects too. Completing the DSPT is needed to use national systems such as NHSmail and the e-referral service.
For a care provider, secure email depends on it. To use NHS.net Connect, you must first complete the toolkit to at least Approaching Standards. NHS.net Connect is free of charge to CQC-registered care providers in England.
Where can a small care provider get help with the DSPT?
A small care provider gets a shorter assessment and local help. A domiciliary care organisation sees a subset of the items an NHS trust provides, in language suited to a smaller organisation.
For social care, the DSPT's partners at Better Security, Better Care run national webinars. They also give support through 28 local organisations across the country.
The DSPT site also lists webinars on the 2026-2027 toolkit for GPs, dentists, opticians, pharmacies, local authorities, universities and others, including hospices and charities. The first is on Tuesday 17 November 2026.
If you run several sites as one company, one toolkit may cover them all. That applies to a single legal entity with a single ICO registration.
A first DSPT submission, step by step
- Register You need an email address and your organisation's ODS code.
- Fill in your profile Choose your sector, give key roles and say which certifications you hold. This sets your questions.
- Work through the assertions Give the evidence items for each assertion under each standard.
- Answer every mandatory question That reaches Standards Met.
- Publish by the deadline At least one assessment by 30 June each year. For the current toolkit, that is 30 June 2027.
What to do
- Check which organisation type fits you, because it decides your category.
- Find your organisation's ODS code, which you need to register.
- Record any current Cyber Essentials Plus certification in your profile.
- Publish at least one assessment by 30 June 2027.
- If you run a care service, look at the Better Security, Better Care webinars and local support.
Common questions
Does a privately funded care home have to complete the DSPT?
NHS England's test is access. All organisations that have access to NHS patient data and systems must use the toolkit. Its social care type also includes services commissioned directly by the people who use them.
Do I need Cyber Essentials Plus for the DSPT?
No. It is not mandatory, but holding it exempts you from some questions.
Can other people see what we wrote in our DSPT?
No. Your status is shown, but no information on the content of your toolkit is public.
Where next
Sources
- digital.nhs.uk, Data Security and Protection Toolkit assessment guides, NHS England Digital, checked 23 October 2026
- NHS England, DSPT version 9 notice, checked 23 October 2026
- NHS England, DSPT organisation types, checked 23 October 2026
- NHS England, DSPT frequently asked questions, checked 23 October 2026
- NHS England, DSPT overview, checked 23 October 2026
- digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital, checked 23 October 2026
- GOV.UK, Setting up and using secure email as an adult social care provider, checked 23 October 2026
- NHS England, DSPT 2026-27 webinars, checked 23 October 2026
This is an independent editorial guide, not legal advice.