# What is the DSPT, and does your organisation have to complete it?

If your care home, GP practice or clinic has access to NHS patient data, this yearly check is how you show you keep it safe.

The Assurance Desk. Published 23 October 2026. Last checked 23 October 2026.

Part of the guide [What is a Caldicott guardian, and who needs one?](https://theassurancedesk.com/guides/caldicott-guardian.md).

**The short answer.** The Data Security and Protection Toolkit (DSPT) is an online self-assessment against the National Data Guardian's 10 data security standards. All organisations that have access to NHS patient data and systems must use it. The deadline for the current toolkit is 30 June 2027 ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), [digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit) and [NHS England, DSPT version 9 notice](https://www.dsptoolkit.nhs.uk/News/169), checked 23 October 2026).

## What is the DSPT?

The DSPT is an online self-assessment tool. It lets an organisation measure its performance against the National Data Guardian's 10 data security standards ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

It is a tool for health and care in England. Its organisation types are reviewed each year against the NHS and local authority structures in England ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

The assessment is built in layers. Under each standard sit a number of assertions. For each assertion, you give evidence items that show you comply ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

Category 1 organisations, such as NHS trusts, are also measured against the National Cyber Security Centre's Cyber Assessment Framework. They see the toolkit set out against that framework ([digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit) and [NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

**The National Data Guardian's 10 data security standards, in plain words. NHS England Digital's guides to them were written for the 2023-24 (version 6) standard.**

| Standard | In plain words |
| --- | --- |
| 1. Personal confidential data | All staff handle, store and send it securely, on paper or on screen |
| 2. Staff responsibilities | All staff understand their responsibilities under the standards |
| 3. Staff training | Staff understand information governance and cyber security |
| 4. Managing data access | Only staff who need the data for their role can see it, and access ends when the need ends |
| 5. Process reviews | Past breaches and near misses are recorded and used to fix problem processes |
| 6. Responding to incidents | Cyber attacks against services are spotted and resisted |
| 7. Continuity planning | A plan is ready for threats to data security, including significant breaches |
| 8. Unsupported systems | No unsupported operating systems, software or browsers are used |
| 9. IT protection | A strategy protects IT systems from cyber threats |
| 10. Accountable suppliers | IT suppliers understand their duties as data processors under the GDPR |

Source: digital.nhs.uk, Data Security and Protection Toolkit assessment guides, NHS England Digital, https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/data-security-and-protection-toolkit-assessment-guides (checked 23 October 2026)

## Who has to complete the DSPT toolkit?

If your organisation has access to NHS patient data and systems, it must use the toolkit. NHS England Digital says this is how you give assurance that you practise good data security and handle personal information correctly ([digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit), checked 23 October 2026).

Completing it is a contractual requirement in the NHS England Standard Conditions contract. It also remains Department of Health and Social Care policy that all bodies that process NHS patient information give assurance through the DSPT ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

What you complete depends on your organisation type. The type decides which of four categories of the toolkit you see ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

A care home sits in the social care type. That type covers domiciliary care, care homes, residential homes and day services. It includes services commissioned by the NHS, by local authorities or by the people who use them. Providers count whether or not they are registered with the CQC ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

A GP practice completes category 4. Social care, dentists, opticians, pharmacies, local authorities, universities and charities complete category 3 ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

Category 1 is set out against the Cyber Assessment Framework. NHS trusts, integrated care boards, commissioning support units and arm's length bodies moved to it in version 7. Independent providers designated as operators of essential services, and genomics organisations, followed in version 8. Version 9 is aligned to version 4.0 of the framework ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), [digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit) and [NHS England, DSPT version 9 notice](https://www.dsptoolkit.nhs.uk/News/169), checked 23 October 2026).

Some suppliers complete category 2. That applies to a company that supplies digital goods and services to the NHS or care, with 50 or more staff and a turnover of £10m or more. If you are not sure which type fits, the toolkit says to select Other. For Other, the toolkit covers only the health and care data you process ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

**Who completes which DSPT category, by organisation type. The type you choose in your profile decides the category and the questions you see.**

| Organisation type | Category | What the assessment looks like |
| --- | --- | --- |
| NHS trusts, integrated care boards, commissioning support units, arm's length bodies, genomics organisations, independent providers that are operators of essential services | 1 | Set out against the Cyber Assessment Framework |
| IT suppliers with 50 or more staff and a turnover of £10m or more | 2 | The IT supplier evidence items |
| Social care, including care homes, home care and day services | 3 | Category 3 items. A home care service sees a subset of an NHS trust's items, in plainer language |
| Dentists, opticians, pharmacies, local authorities, universities, smaller suppliers | 3 | The same category 3 evidence items |
| Other, including charities and NHS business partners | 3 | Covers only the health and care data you process |
| GP practices | 4 | The GP evidence items |

Source: NHS England, DSPT version 9 notice, https://www.dsptoolkit.nhs.uk/News/169 (checked 23 October 2026); NHS England, DSPT organisation types, https://www.dsptoolkit.nhs.uk/Help/Org-Types (checked 23 October 2026); NHS England, DSPT frequently asked questions, https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions (checked 23 October 2026)

## When is the DSPT deadline?

The deadline for the current toolkit is 30 June 2027 ([NHS England, DSPT version 9 notice](https://www.dsptoolkit.nhs.uk/News/169), checked 23 October 2026).

That toolkit is version 9, for 2026-27. Its outcomes, assertions and evidence items were released on 2 October 2026 ([NHS England, DSPT version 9 notice](https://www.dsptoolkit.nhs.uk/News/169), checked 23 October 2026).

The date follows a yearly pattern. Each organisation must publish at least one assessment by the deadline of 30 June every year. A guide written for an earlier toolkit will show an earlier year, so check which toolkit it describes ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

It is a yearly job, not a one-off. Health and care organisations with access to NHS patient data and systems should complete a self-assessment every year ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

## What do Standards Met and the other results mean?

Standards Met is the result to aim for. You reach it by answering every question in the assessment that is marked as mandatory ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

Approaching Standards is for social care organisations. It is a one-off assessment that shows good progress towards Standards Met ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

Standards Exceeded goes further. For category 1 organisations, such as NHS trusts, integrated care boards and operators of essential services, it shows they have gone beyond Standards Met. For all other organisations, Standards Met plus a current Cyber Essentials Plus certification shows as Standards Exceeded ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview) and [NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

You do not need Cyber Essentials Plus to complete the DSPT. If you hold it, some questions do not apply to you ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

A renewal can also end in Standards Not Met. Some organisations send data to NHS England systems through an API. If one of them gets Standards Not Met, the toolkit's help pages say to assess the risk and, if necessary, stop sending data ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

The toolkit shows your organisation's status, but no information on the content of your assessment is public. At Standards Met or Standards Exceeded, you can download a certificate. It can serve as evidence for the CQC, commissioners and NHS partners ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview) and [NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

## What happens if you do not complete the DSPT?

The DSPT is an information standard under section 250 of the UK Health and Social Care Act 2012. NHS England Digital says bodies that fail to submit a return may face enforcement action under that Act, which may include fines ([digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit), checked 23 October 2026).

There are practical effects too. Completing the DSPT is needed to use national systems such as NHSmail and the e-referral service ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

For a care provider, secure email depends on it. To use NHS.net Connect, you must first complete the toolkit to at least Approaching Standards. NHS.net Connect is free of charge to CQC-registered care providers in England ([GOV.UK, Setting up and using secure email as an adult social care provider](https://www.gov.uk/guidance/setting-up-and-using-secure-email-as-an-adult-social-care-provider), checked 23 October 2026).

## Where can a small care provider get help with the DSPT?

A small care provider gets a shorter assessment and local help. A domiciliary care organisation sees a subset of the items an NHS trust provides, in language suited to a smaller organisation ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

For social care, the DSPT's partners at Better Security, Better Care run national webinars. They also give support through 28 local organisations across the country ([NHS England, DSPT 2026-27 webinars](https://www.dsptoolkit.nhs.uk/News/webinars-v9), checked 23 October 2026).

The DSPT site also lists webinars on the 2026-2027 toolkit for GPs, dentists, opticians, pharmacies, local authorities, universities and others, including hospices and charities. The first is on Tuesday 17 November 2026 ([NHS England, DSPT 2026-27 webinars](https://www.dsptoolkit.nhs.uk/News/webinars-v9), checked 23 October 2026).

If you run several sites as one company, one toolkit may cover them all. That applies to a single legal entity with a single ICO registration ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

**A first DSPT submission, step by step**

1. Register: You need an email address and your organisation's ODS code.
2. Fill in your profile: Choose your sector, give key roles and say which certifications you hold. This sets your questions.
3. Work through the assertions: Give the evidence items for each assertion under each standard.
4. Answer every mandatory question: That reaches Standards Met.
5. Publish by the deadline: At least one assessment by 30 June each year. For the current toolkit, that is 30 June 2027.

The main steps, as the DSPT's own overview sets them out. A social care organisation that is not yet at Standards Met can publish a one-off Approaching Standards assessment.

Source: NHS England, DSPT overview, https://www.dsptoolkit.nhs.uk/Help/Overview (checked 23 October 2026); NHS England, DSPT version 9 notice, https://www.dsptoolkit.nhs.uk/News/169 (checked 23 October 2026)

## What to do

1. Check which organisation type fits you, because it decides your category ([NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).
2. Find your organisation's ODS code, which you need to register ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).
3. Record any current Cyber Essentials Plus certification in your profile ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview) and [NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).
4. Publish at least one assessment by 30 June 2027 ([NHS England, DSPT version 9 notice](https://www.dsptoolkit.nhs.uk/News/169), checked 23 October 2026).
5. If you run a care service, look at the Better Security, Better Care webinars and local support ([NHS England, DSPT 2026-27 webinars](https://www.dsptoolkit.nhs.uk/News/webinars-v9), checked 23 October 2026).

## Common questions

### Does a privately funded care home have to complete the DSPT?

NHS England's test is access. All organisations that have access to NHS patient data and systems must use the toolkit. Its social care type also includes services commissioned directly by the people who use them ([digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit) and [NHS England, DSPT organisation types](https://www.dsptoolkit.nhs.uk/Help/Org-Types), checked 23 October 2026).

### Do I need Cyber Essentials Plus for the DSPT?

No. It is not mandatory, but holding it exempts you from some questions ([NHS England, DSPT frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions), checked 23 October 2026).

### Can other people see what we wrote in our DSPT?

No. Your status is shown, but no information on the content of your toolkit is public ([NHS England, DSPT overview](https://www.dsptoolkit.nhs.uk/Help/Overview), checked 23 October 2026).

## Where next

- [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md)
- [What is a Caldicott guardian, and who needs one?](https://theassurancedesk.com/guides/caldicott-guardian.md)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md)
- [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md)
- [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md)

## Sources

- NHS England, DSPT overview: https://www.dsptoolkit.nhs.uk/Help/Overview (checked 23 October 2026)
- digital.nhs.uk, DAPB0086: Data Security and Protection Toolkit, NHS England Digital: https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit (checked 23 October 2026)
- NHS England, DSPT version 9 notice: https://www.dsptoolkit.nhs.uk/News/169 (checked 23 October 2026)
- NHS England, DSPT organisation types: https://www.dsptoolkit.nhs.uk/Help/Org-Types (checked 23 October 2026)
- digital.nhs.uk, Data Security and Protection Toolkit assessment guides, NHS England Digital: https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/data-security-and-protection-toolkit-assessment-guides (checked 23 October 2026)
- NHS England, DSPT frequently asked questions: https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions (checked 23 October 2026)
- GOV.UK, Setting up and using secure email as an adult social care provider: https://www.gov.uk/guidance/setting-up-and-using-secure-email-as-an-adult-social-care-provider (checked 23 October 2026)
- NHS England, DSPT 2026-27 webinars: https://www.dsptoolkit.nhs.uk/News/webinars-v9 (checked 23 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.