DSPT 2026/27 v9: What Changed for Category 3
DSPT version 9 is out, and the deadline is fixed: 30 June 2027. For a care home, pharmacy, dental practice or GP practice, the headline is that very little changed in what you must provide — the mandatory set for Category 3 is the same 45 items as last year — but four new questions appear, several familiar ones are reworded, and the free-text answers you wrote last year may no longer fit the question being asked.
NHS England's release notes record that "The 2026-27 (version 9) DSPT has been released" on 1 September 2026. The spreadsheets listing every outcome, assertion and evidence item followed on 2 October 2026, with the statement: "The deadline for the Data Security and Protection Toolkit is 30th June 2027."
What stayed the same
This is the part most summaries skip, and it is the part that saves you time.
The mandatory list for Category 3. We compared NHS England's version 8 (2025-26) and version 9 (2026-27) workbooks for Category 3 line by line. Both mark the same 45 evidence items as "Required to meet standard (mandatory)", with the same reference numbers. Nothing was added to the mandatory set and nothing was removed. GP practices (Category 4) are in the same position: the same 29 mandatory items in both years.
The view you see. Version 9 is aligned to the Cyber Assessment Framework at framework level — NHS England states "DSPT Version 9 is aligned to CAF version 4.0" — but that does not change your screen. The organisation-types guidance for 2026-27 still says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", and lists dentists, opticians, pharmacies and social care against the Category 3 evidence items. If you have read that the DSPT is "going CAF" for small providers, it has not happened in this version. Our guide to what CAF alignment means for Category 3 covers the background.
The 95% training question. Item 3.2.1 still asks: "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" It is still marked mandatory for Category 3. If you need a course for that, see Data Security Awareness Level 1.
The Approaching Standards subset. The same 26 items are flagged "Approaching standards mandatory" in both workbooks. Note what NHS England says about who can use that route: "Social Care organisations are eligible to complete a one-off 'Approaching Standards' assessment". It is a one-off, and the guidance names social care organisations as eligible; it does not mention pharmacies, dentists or GP practices. If you are one of those, plan for Standards Met.
What is new: four questions
Version 9's change log lists four new Category 3 evidence items. None is marked mandatory, but each will appear in your toolkit, and each is easier to answer if you have thought about it before April.
| Ref | What it asks (NHS England's wording, shortened) | What a small provider usually needs |
|---|---|---|
| 1.3.15 | Where staff or contractors take devices with access to service user information, NHSmail or NHS systems outside the UK, are the security risks formally managed and documented? | A short rule: staff tell you before travelling with a work device, and the device is encrypted and protected by multi-factor authentication. NHS England's tooltip sets the test for "Not applicable" as: "If your organisation/suppliers do not process identifiable patient/service user information outside of the UK". That turns on where information is processed, by you or your suppliers, not only on whether staff travel. |
| 7.1.7 | Has your organisation tested or exercised its business continuity plan for a data or cyber incident within the last 12 months? | NHS England: "A test does not need to be a full simulation." A team walk-through of losing your care records system or email counts, if you record the date, who took part and what you learned. See our DSPT business continuity guide. |
| 10.2.6 | Do you have policies and assurance so that non-IT suppliers — cleaners, contractors, HR or back-office staff, organisations renting space — do not have inappropriate access to information on your premises? | Confirm what your cleaning and maintenance contractors can reach, and that contracts limit any access to what you authorise. |
| 10.2.7 | If you or your suppliers process identifiable service user information outside the UK, have you risk-assessed it and put governance in place? | Ask your care-records and IT suppliers where data is hosted and supported from. If nothing leaves the UK, "Not applicable". |
What was reworded
The change log lists a long set of Category 3 items with "updated evidence item and tooltips". The ones most likely to catch you out are those where last year's free-text answer no longer matches the question:
- 1.1.2 now reads: "Does your organisation maintain an up to date information asset register (IAR) and a record of processing activities (ROPA) and review this regularly?" Both documents are named, and the tooltip expects management review within the last twelve months.
- 10.2.1 was updated twice — once in the main release and again in the version 1.1 spreadsheet, which NHS England says "includes updated 10.2.1 requirement for category 3 and 4 organisations". It now asks: "Does your organisation assure that your IT system suppliers have robust cyber security arrangements?" The tooltip points you to checking certifications such as Cyber Essentials, ISO 27001 or a supplier's own DSPT status, and says you can confirm a Cyber Essentials certificate on the IASME website. Our supplier assurance guide covers collecting DSPT and ISO 27001 evidence from suppliers; for Cyber Essentials, use the IASME certificate search the tooltip names.
- 5.1.1, 6.1.3, 6.2.1, 7.1.2, 7.3.1 and 7.3.2 — breach review, informing affected people, antivirus, business continuity, backups and emergency contacts — all carry new wording or tooltips. Read the question before pasting last year's answer.
Two other changes to be aware of. NHS England has "Changed the term 'IT supplier' to 'supplier' throughout the DSPT", so organisation-type labels you remember have moved. And the change log records a "New category for CQC market oversight organisations 3.a and Local Authorities 3.b" — if you are a single care home this does not apply to you, but large care groups should check which view they are on.
The webinars for your category
NHS England's 2026-7 programme for "Dentists, GPs, Local Authorities, Opticians, Others (including Hospice and Charities), Pharmacies and University (including Researchers)" runs monthly on Tuesdays, 12.30-13.15:
| 2026 | 2027 |
|---|---|
| 20 October | 19 January · 16 February · 16 March |
| 17 November | 20 April · 18 May · 15 June |
| 15 December |
Social care is supported separately: "Our partners at Better Security, BetterCare are running national webinars and delivering support through 28 local organisations across the country." Joining details are on the DSPT webinar page.
A plan for the next nine months
- Now — download your version 9 spreadsheet from the version 9 announcement and mark the four new items and the reworded ones above.
- October to December — the slow items. Supplier assurance under the new 10.2.1 wording, and any device or software replacement. Our supplier assurance guide covers what to ask suppliers for.
- January to March — the document set. Re-review and re-date policies, bring the IAR and ROPA up to date for 1.1.2, and run and record your continuity exercise for 7.1.7.
- April onwards — answer and publish. If the first three are done, the toolkit itself is the short part.
If you published last year, start from what changed since — new staff, suppliers, systems or premises. Our DSPT readiness check walks the ten standards, and the evidence checklist generator turns gaps into a working list.
This guide is based on NHS England's DSPT version 9 announcement (2 October 2026), the version 9 Category 2, 3 and 4 workbook (v1.1), the version 8 workbook it was compared against, the system release notes (1 September 2026) and the 2026-27 organisation-types guidance, as verified on 7 October 2026. The question set can be revised during the year — check the DSPT news page before relying on an item reference. This is not legal or compliance advice.
Sources
- Outcomes, Assertions and Evidence items for the DSPT 2026-27 version 9 (2 October 2026) — NHS England
- DSPT system changes and release notes — NHS England
- DSPT 2025-26 version 8 announcement — NHS England
- DSPT organisation types 2026-27 — NHS England
- DSPT overview and introductory guidance — NHS England
- DSPT webinars for 2026-7 — NHS England