Complete Your DSPT in Half the Time

The Data Security and Protection Toolkit (DSPT) is an annual online self-assessment that every organisation accessing NHS patient data or systems must complete by 30 June. This includes care homes, pharmacies, GP practices, domiciliary care agencies, and dental practices in England. It measures you against the National Data Guardian's ten data security standards. How many questions you answer depends on who you are — NHS England states that "the number of mandatory questions are determined by your organisation type" — so take your own count from your toolkit rather than from any guide, including this one.

The DSPT is a contractual requirement, not a technical switch: no source states an automatic same-day cutoff. NHS England describes completion as a contractual requirement specified in the NHS England Standard Conditions contract, and says it is also necessary for organisations which use national systems such as NHSmail and the e-referral service. NHS England Digital says a DSPT assessment is required to access national applications such as the NHS e-Referral Service. A missed 30 June submission puts that access at risk. For care homes, losing NHSmail would disrupt communication with GPs and hospitals.

There is no single number that covers every small provider. NHS England states that "the number of mandatory questions are determined by your organisation type", and that each of the four DSPT categories "has a pre-determined set of evidence items, with some mandatory and some non-mandatory". For adult social care specifically, Digital Care Hub's publishing guidance describes completing "the 26 mandatory questions for Approaching Standards" and then the full set for Standards Met — though that same page gives the full set as both 45 and 42 questions in different sentences, so treat any published total as indicative. GP practices fall under Category 4, which has a different set again. The count shown inside your own toolkit assessment is the only reliable one.

DSPT evidence requirements vary by question but typically include: data security awareness training certificates for all staff, an up-to-date data security policy, a risk assessment log, business continuity plans, records of data access controls, and incident reporting procedures. Each evidence item must be uploaded to the DSPT portal individually.

From 2024/25 the DSPT adopted the National Cyber Security Centre's Cyber Assessment Framework (CAF) for large NHS organisations such as Trusts and ICBs. NHS England had planned a checklist-based, CAF-aligned DSPT for Category 3/4 providers — care homes, pharmacies, GP practices — for summer 2026, "subject to review", but it did not arrive. For 2026-27 (DSPT version 9, released on 1 September 2026), only Category 1 organisations see the CAF-aligned view; care homes, pharmacies, dentists and GP practices complete the Category 3/4 evidence items. For them the changes have been to individual evidence items: version 8 (2025/26) made the IT administrator agreement mandatory for Category 3 (it was already mandatory for GP practices) and made a digital asset register mandatory for both, and version 9 kept the same mandatory items while adding four optional ones. Check each year's items against the evidence you used before.

Yes. Community pharmacies fall under Category 3 and GP practices under Category 4 of the DSPT — they are different categories with different evidence requirements. Both must complete the toolkit annually by 30 June. Pharmacies accessing the NHS Spine or Electronic Prescription Service and GP practices accessing NHS clinical systems are all in scope. A group that is a single legal entity, with sites that follow the same policies, can publish one assessment at HQ level for its sites; a separate legal entity with its own ICO registration completes its own DSPT.

DSPTready is launching with free DSPT tools including a deadline calculator, evidence checklist generator, and readiness quiz. The full guided workflow — with evidence tracking, gap analysis, reminders, and staff training management — is designed to cost less than a single hour of consultant time per month. Join the waitlist for early-bird pricing.

DSPT consultants typically charge £500–£2,000 per submission and complete the process for you — useful but expensive for small providers doing this every year. DSPTready guides you through each evidence requirement yourself, with plain-English explanations, example evidence, and gap tracking. You build internal capability rather than depending on a consultant annually.

DSPTready is built by Crocker Digital Ltd (Company No. 17008789), a UK technology company focused on compliance tools for small organisations. The product is designed specifically for Category 3 and Category 4 NHS providers who need affordable, self-serve DSPT compliance support.

DSPTready takes data security seriously — you'd expect nothing less from a DSPT compliance tool. We collect only your email address for the waitlist. Our analytics use GoatCounter, which collects no personal data and uses no cookies. Full details are in our privacy policy. The production platform will be built with NHS-grade data handling standards.