Data Security Awareness Level 1: Still Needed?

Short answer: the course is still good, and it has never been the only option.

NHS England's DSPT training guidance says: "Until July 2023, the DSPT required that you train at least 95% of your staff using the national Data Security Awareness Level 1 e-learning or a local equivalent. This has changed for 2023/24." Note the "or a local equivalent": the national module was never the only accepted course. And the change applies to "Category one organisations".

For Category one organisations, what replaced the 95% figure in 2023 was an outcome, not a course. NHS England's training guidance quotes the assertion: "Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness." The same words are assertion 3.1, one of Standard 3's four assertions, in the version 9 workbook for Categories 2, 3 and 4; in 2026-27 Category one organisations see a CAF-aligned view instead.

For Category 3 and Category 4 the question has never been “did 95% complete the national module?” — any appropriate training counts, as it did before 2023 — and the 95% figure itself still stands: the v8 (2025-26) workbook marks evidence item 3.2.1 as “Required to meet standard (mandatory)” for both, and the v9 (2026-27) workbook published on 2 October 2026 keeps it mandatory for both. The guidance page quoted above scopes its change to “Category one organisations”. So a Category 3 organisation needs both: a documented decision about what your staff need (the Training Needs Analysis, item 3.1.1) and the 95% completion figure. The national module is one good way to get there — often the easiest.

This guide covers what the course actually is, how to get staff onto it, and when something else is the better call. For what your training records need to show, see our DSPT staff training records guide, which covers the Training Needs Analysis in detail.

A note on conflicting guidance

You will find the 95% rule stated on one NHS England page and a different approach on another, and it is worth knowing how they fit before you act on either.

The DSPT's e-learning FAQ page still answers a question about evidence item 3.2.1 like this: "To meet evidence item 3.2.1, 95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation have completed their annual Data Security Awareness Training (including passing a mandatory test)."

The DSPT's training guidance page says that requirement changed from 2023/24, but only for Category one organisations. For Category 3 and 4, the 95% figure is still evidence item 3.2.1, so the e-learning FAQ's answer still describes what you need to reach.

The e-learning FAQ reads as a page that has not been revised — it also refers to training "provided through the revised information governance toolkit", terminology retired in 2018.

The practical rule: work from the assertion text in your own toolkit, for your own category and the current version. That is the wording you are actually asserting against. Guidance pages, including this one, are a map rather than the territory.

What the course is

The full name is "e-Learning – data security awareness – level one", delivered by NHS e-Learning for Healthcare.

Structure	"split into four modules with an additional 'welcome module'"
Time per module	"around 20 minutes to complete"
Order	"can be completed in any order"
Pass mark	"80% for each of the four modules"
Assessment	Each module "concludes with an assessment"
Certificate	Issued on completing all modules and passing the assessments
Statutory/mandatory status	Meets "the statutory and mandatory training requirements and learning outcomes for Information Governance in the UK Core Skills Training Framework (UK CSTF)"

That last row is the one most small providers underuse. If you keep a mandatory training matrix for CQC or contractual purposes, this course sits in the information governance row of it. One completion, two purposes.

The content covers the ground the National Data Guardian standards care about: why data security matters in health and care and what the NDG standards are; how the law applies in the health and care sector; protecting information in practice; and breaches and incidents.

Getting staff onto it

Three access routes, and the right one depends on your size.

Self-registration — for a handful of people, or for testing it yourself first. Staff register at portal.e-lfh.org.uk/Register — the address NHS England's own FAQ links to, and a live registration form as at 2 September 2026 — then "sign in and search for data security to access the course." Use that address directly: www.e-lfh.org.uk/register/ redirects to the e-LfH hub home page rather than to the form.

Organisation registration — for a whole staff group. NHS England's route is an online form, after which "a member of the e-LfH support team will be in touch to discuss your requirements." Worth doing if you have more than a dozen staff, because it changes what you can report on. This is the link that is currently broken: the online-form address on NHS England's FAQ page returns a 404 as at 2 September 2026. If it has not been fixed by the time you read this, contact the e-LfH support team directly through support.e-lfh.org.uk — live chat or a support ticket — and ask for bulk enrolment.

Electronic Staff Record — "If your organisation is registered with ESR with access to e-learning, please contact your local team." Most independent care homes, pharmacies and dental practices are not on ESR; most NHS-employing organisations are.

The practical difference matters at evidence time. Individual self-registration means each person holds their own certificate and you are chasing 30 PDFs by email in May. Organisation registration means you can pull a completion report. If you do nothing else with this post, move from the first to the second.

When the module is the right choice — and when it is not

Use it when: most of your staff have similar access to patient data, they are comfortable enough with a computer to work through four modules of around 20 minutes each plus a welcome module, and you want a defensible, free, nationally recognised baseline with certificates attached.

Do something else, or something more, when:

• Your staff can't realistically do e-learning. Care assistants without regular computer access, staff for whom English is a second language, staff working nights on paper systems. A supervised group session covering the same material, with an attendance record and individual acknowledgements, is a legitimate approach under the current wording — the requirement is appropriate understanding, "with an effective range of approaches taken to training and awareness."
• Some roles carry much higher risk. A registered manager with administrator access to the care planning system needs more than the same hour a kitchen assistant gets. That difference is exactly what the Training Needs Analysis exists to record.
• You have role-specific risks the national module doesn't touch. Domiciliary care workers accessing records on mobile devices in people's homes. Pharmacy staff handling prescriptions at a counter within earshot of a queue. Reception staff taking appointment details in a waiting room. The generic course does not cover these; a fifteen-minute team briefing that does, documented, is worth more to the assessment than a second e-learning module.
• Agency and bank staff dominate your roster. Certificates from an agency are acceptable evidence, but they have to be obtained and dated. Build the request into your booking process rather than the June scramble.

Before you allocate the training

Two things to do first, in this order:

1. Write the Training Needs Analysis, then buy or assign training against it. Doing it the other way round — assign the module, then write a TNA that describes what you already did — is the most common way this evidence item ends up thin. For Category 3, NHS England's tooltip for item 3.1.1 says the TNA "should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation and a copy should be uploaded or the location of the plan recorded."
2. Check what your staff already hold. People arrive with certificates from previous employers, and a certificate inside the last 12 months is a certificate. Ask at induction; you will save some of them well over an hour and yourself a chase.

Then track completions somewhere you can pull them from in June rather than reconstruct. Our evidence checklist generator includes the Standard 3 items alongside the rest of your submission, and the readiness quiz will tell you whether training is actually your weak standard or whether something else is.

For the wider requirement rather than the course, see our DSPT staff training requirements guide.

This guide is based on NHS England's published DSPT training guidance and e-learning FAQ, and the NHS e-Learning for Healthcare course listing, as at September 2026. Where NHS England's pages differ, the assertion wording in the current toolkit governs. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Staff training, awareness and culture — DSPT guidance, NHS England
• e-Learning – data security awareness FAQ — NHS England
• Data Security Awareness Level 1 — NHS e-Learning for Healthcare
• e-LfH self-registration — NHS e-Learning for Healthcare
• DSPT Independent Assurance and Audit (current assertion wording) — NHS England