After the DSPT Deadline: What to Do Next and How to Prepare for Next Year
The 30 June 2026 DSPT deadline has passed. If you've submitted — even at Approaching Standards — you've met the most important requirement. Now comes the less visible but genuinely useful work: improving what you submitted, keeping evidence current, and getting ahead in the next annual cycle, which opened on 1 September 2026 with version 9.
This guide covers what actually happens after you submit, the difference between maintaining your submission and starting over, and what to expect when the next version of the DSPT arrives.
What your submission status means now
For Category 3 and 4 organisations the published statuses are Approaching Standards, Standards Met and Standards Exceeded. (NHS England also uses a "Standards Not Met" status: its release notes record that it "Added the ability for larger organisation types to submit a ‘standards not met’ assessment".) Most of this section is about the first two. Standards Exceeded sits above Standards Met: for most organisations it means Standards Met plus a current Cyber Essentials PLUS certificate recorded in the Organisation Profile, while NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and independent providers designated as OES reach it by meeting the achievement levels forecast for the following year.
Approaching Standards is a fallback below the mandatory set — completing the mandatory assertions is Standards Met. Publishing at Approaching Standards obliges an improvement plan. Your organisation's compliance status is shown as "Approaching Standards" on the public register at dsptoolkit.nhs.uk. NHS England's guidance names social care organisations as eligible for this one-off assessment; it does not mention pharmacies, dentists or GP practices, which should plan for Standards Met.
Standards Met means you completed the evidence items marked mandatory for your organisation type — NHS England describes it as "responding to all the questions within the assessment which are indicated as being MANDATORY". For NHS-contracted organisations, Standards Met is often the expectation in your data sharing agreement — check your contract terms.
If you submitted at Approaching Standards, you can continue working toward Standards Met by adding evidence to the portal. The deadline is when you publish your initial submission, not when you stop improving it.
Improving your submission after June
The portal remains open throughout the year. Common post-deadline improvements:
Filling gaps in non-mandatory items. You may have left some non-mandatory assertions incomplete to hit the deadline. Work through these systematically over July and August while the submission is fresh.
Replacing partial evidence. Some providers submit a policy that was outdated but the only one available, or a training log that was incomplete. Replace these with updated evidence once you've had time to gather it properly.
Updating the assessment notes. Where you wrote "in progress" or "we are working on this" against evidence items, replace those notes with confirmed evidence once it's complete.
Requesting updated supplier assurance. If you submitted a supplier assurance letter that was close to 12 months old, request a fresh one now and upload it. You'll want current documentation before the next cycle opens anyway.
Maintaining evidence between submissions
The most common reason organisations struggle with the DSPT year after year is treating it as a June task rather than an ongoing process. Organisations that submit comfortably in future years — in a fraction of the time compared to the first cycle — typically do three things throughout the year.
Keep training records current. Every new staff member, every joiner after June, needs data security awareness training. If you update your training log as people complete it rather than chasing everyone in April, the evidence is ready when you need it. The same applies to leaving dates: remove leavers from your active staff list at the point they leave, not when the DSPT opens.
Date-stamp policy reviews. NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum", so a policy with a visible, recent review date is acceptable evidence and a policy with no review date at all is not. Reviewing it every year is good practice: when you do, mark the review date in the document header and on your review schedule.
Ask your IT provider about changes. If your IT setup changes — new server, new cloud platform, new device management solution — ask your provider to confirm in writing how the change affects your data security posture. You'll need this confirmation for the next cycle.
What to expect from the next cycle
NHS England typically releases a new version of the DSPT in late August or early September: versions 6 and 7 came out on 30 August 2023 and 30 August 2024. Version 8 was released on 1 September 2025, with its assertions and evidence items published on 18 September 2025, and its cycle ran to 30 June 2026. Version 9 (2026-27) followed the same pattern: it was released on 1 September 2026, NHS England published its outcomes, assertions and evidence items on 2 October 2026, and its deadline is 30 June 2027.
Each new version reflects updated guidance from NHS England and, where relevant, changes to the underlying Cyber Assessment Framework. For Category 3 and 4 organisations, the structure tends to be more stable than for larger organisations: NHS England's workbooks show the same 36 assertions in versions 7, 8 and 9, and version 9 kept the same mandatory items as version 8 while adding four optional ones. For the detail, see what changed in DSPT version 9.
With v9 open, your previous answers should still be there. NHS England's linked guidance says "Your answers from your previous publication will be saved on your DSPT account", but each new toolkit year "the word COMPLETED will have disappeared from the final column", so you review each answer, update what has changed and mark it complete again. One caveat for version 9: NHS England's 1 September 2026 release notes record that it "Added the ability to clear previous answers and completion statuses when required for the new version", and several items were reworded, so answers to reworded items may have been cleared. Check each one. Your underlying documents stay valid while they are current: a data security policy reviewed in May 2026 will still be inside NHS England's three-year minimum for a v9 submission, as long as you confirm it against any new requirements. Training counts if it was completed in the last twelve months before you publish: the 3.2.1 tooltip says "it is the last twelve months prior to the date of publication".
If you have not opened your v9 assessment yet, do it now — and set a diary reminder for late August next year, when NHS England typically releases the following version; the DSPT portal news page is where it is announced. Organisations that start the new cycle in September or October tend to submit comfortably by June; those who wait until March scramble.
Check your evidence stays live
One thing that's easy to forget after submission: some of your evidence has an expiry horizon. Training is the tight one: certificates for staff who completed training in June 2026 will be approaching 12 months old by June 2027, and 3.2.1 counts only the twelve months before you publish. Policies have more room — NHS England's minimum is an update every three years — but a policy reviewed in May 2026 is worth a quick annual review before your v9 submission.
A simple review schedule helps:
| Evidence type | Typical refresh frequency |
|---|---|
| Data security policy | Annual review as good practice (NHS England's minimum: updated every three years) |
| Staff training records | Annual per staff member |
| IT assurance letter from IT provider | Annual |
| Supplier assurance (PMS, cloud storage) | Annual or on renewal |
| Access control register | Review quarterly; confirm annually |
| Business continuity plan | Annual review and test (for Category 3, item 7.2.1 asks for a test in the last twelve months) |
| Incident log | Ongoing (add incidents as they occur) |
Using your submission for other purposes
A current DSPT submission is useful beyond the toolkit itself:
- CQC well-led assessments reference data security governance. A current, Standards Met or Approaching Standards submission is positive evidence.
- Your NHS contract. NHS England describes completion as "a contractual requirement specified in the NHS England Standard Conditions contract".
- NHS.net Connect. Digital Care Hub says "Approaching Standards also enables you to get NHS.net Connect (previously NHSmail)", the secure email system used to share confidential information with NHS and local authority colleagues.
- Staff onboarding. Your data security policy and training records are the foundation of good information governance for new starters — not just DSPT paperwork.
Next steps
- Take the DSPT readiness quiz to identify any standards where your evidence could be strengthened.
- Use the evidence checklist generator to track which items you've completed and which need work.
- If you're a GP practice, pharmacy, or care home, our ICP-specific guides cover the evidence requirements most relevant to your setting: GP practices, pharmacies, care homes.
This guide was written for DSPT v8 (2025/26) as published by NHS England and updated for the version 9 (2026-27) release: the v9 release date is from NHS England's release notes and the 30 June 2027 deadline from its version 9 announcement. Always check the official DSPT portal for current guidance. This is not legal or compliance advice.