DSPT 2026/27: The Complete Guide for Care Homes, Pharmacies and GP Practices

If you manage a care home, community pharmacy, or GP practice in England, you're required to complete the Data Security and Protection Toolkit (DSPT) every year by 30 June. NHS England says completion "is also necessary for organisations which use national systems such as NHSmail and the e-referral service", so a missed deadline puts that access at risk.

This guide covers the DSPT version 9 (2026-27) requirements specifically for Category 3 and Category 4 organisations. No enterprise jargon, no assumptions about having an IT department.

What is the DSPT?

The Data Security and Protection Toolkit is an annual online self-assessment run by NHS England. It measures how well your organisation protects patient data against the 10 National Data Guardian (NDG) data security standards.

Every organisation that accesses NHS patient data or connects to NHS systems must complete it. That includes:

• Residential and nursing care homes
• Domiciliary care agencies
• Community pharmacies
• GP practices
• Dental practices
• Opticians

The toolkit is hosted at dsptoolkit.nhs.uk. The 2025/26 submission deadline was 30 June 2026; for the 2026/27 cycle (version 9), NHS England states that "The deadline for the Data Security and Protection Toolkit is 30th June 2027."

What's in DSPT version 9 (2026-27)?

Version 9 is the current toolkit. NHS England's release notes record that "The 2026-27 (version 9) DSPT has been released" on 1 September 2026, and its outcomes, assertions and evidence items were published on 2 October 2026 in the version 9 announcement.

What this means for small providers:

• The same mandatory items. NHS England's version 9 workbook marks 45 evidence items mandatory for Category 3 and 29 for Category 4, the same items as version 8 (2025/26).
• Four new evidence items, none mandatory. 1.3.15 (devices taken outside the UK), 7.1.7 (testing your business continuity plan), 10.2.6 (non-IT suppliers' access) and 10.2.7 (processing outside the UK).
• Reworded items. Several existing items have new wording or tooltips, including 1.1.2 (the information asset register and record of processing activities) and 10.2.1 (supplier assurance).
• The CAF stays in the background for Category 3 and 4. NHS England says "DSPT Version 9 is aligned to CAF version 4.0", but "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements". Category 3 and 4 organisations still answer evidence items under the ten standards.

The previous version, v8 (2025/26), kept the same assertions as version 7 and changed a small number of evidence items; for Category 3 it made the IT administrator agreement (4.3.1) and the digital asset register (7.1.1) mandatory. Our DSPT v8 changes explained guide sets out the detail, and our Cyber Assessment Framework explained guide covers what CAF alignment actually means for small providers.

Check the version 9 announcement for the downloadable workbook showing the exact assertions and evidence items for your category.

DSPT categories: which one are you?

Your DSPT category determines which assertions and evidence items apply to your organisation.

Category	Typical organisations	Scope
Category 1	NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and OES independent providers	CAF-aligned assessment + independent audit
Category 2	Large suppliers (50+ staff, £10m+ turnover)	Extended assessment + independent audit
Category 3	Care homes, domiciliary care, pharmacies, dentists, opticians	Core assessment — no independent audit required
Category 4	GP practices	Core assessment — a smaller mandatory set (29 items)

If you have been told you need an audit, our guide to who actually needs a DSPT audit explains which categories are in scope.

Most readers of this guide will be Category 3 or Category 4. The key difference is size: in NHS England's version 9 workbook Category 4 has 49 evidence items, 29 of them mandatory, against Category 3's 80 and 45. All but two Category 4 items (6.3.5 on repeat incidents and 8.3.1 on software updates) are also Category 3 items.

If you run a residential or domiciliary care provider, our DSPT for care homes guide walks through the Category 3 evidence requirements with care-home-specific examples.

If you're a GP practice, our DSPT for GP practices guide covers Category 4-specific evidence items and the GP systems (EMIS, SystmOne) that most of the technical evidence relies on.

Dental practices sit in Category 3 alongside care homes and pharmacies. Our DSPT for dental practices guide works through the evidence items that hang off practice management software and NHSmail access.

If you deliver care in people's own homes rather than from one site, the DSPT for domiciliary care guide covers the device and data-in-transit questions that only come up when records travel with care workers.

If you're unsure of your category, log in to dsptoolkit.nhs.uk and open your Organisation Profile — your category follows from the sector recorded there, not from your ODS code, and NHS England lets you "change your answers at any time".

The 10 National Data Guardian standards

The DSPT is structured around these 10 standards. Each one maps to specific assertions and evidence items:

1. Personal confidential data — handled, stored and transmitted securely, and only shared for lawful and appropriate purposes
2. Staff responsibilities — everyone understands their data security duties
3. Training — at least 95% of staff, directors, trustees and volunteers complete data security training each year (item 3.2.1 counts the twelve months before you publish)
4. Managing data access — access is limited to what each person needs
5. Process reviews — after a breach or near miss, the process behind it is reviewed (item 5.1.1)
6. Responding to incidents — data breaches are detected and reported
7. Continuity planning — plans exist to respond to threats to data security
8. Unsupported systems — no unsupported operating systems, software or internet browsers in the IT estate
9. IT protection — technical controls are in place (encryption, changed network-device passwords, firewalls)
10. Accountable suppliers — third-party suppliers meet data security standards

For Category 3 organisations, the evidence across these standards includes items like staff training records, data security policies, risk assessment logs, business continuity plans, and records of who has access to what systems.

Several of these standards have a companion guide on this site. Your data security policy (Standard 1, item 1.3.1) is covered in how to write a DSPT data security policy, and Standard 6 in our guide to DSPT incident response — both written around what a Category 3 provider actually has to produce rather than what a large trust would.

Key dates for the 2026-27 cycle

Date	What's due
1 September 2026	DSPT version 9 (2026-27) released
2 October 2026	Version 9 outcomes, assertions and evidence items published
30 June 2027	DSPT submission deadline

The deadline is a standing annual one rather than a one-off date: NHS England requires that "your organisation has published at least one assessment by the deadline of 30 June every year". The previous cycle, version 8 (2025/26), closed on 30 June 2026.

Missing the 30 June deadline has consequences beyond the toolkit itself:

• Your contract position — NHS England describes completion as "a contractual requirement specified in the NHS England Standard Conditions contract"
• NHSmail and the e-referral service — NHS England says completion "is also necessary for organisations which use national systems such as NHSmail and the e-referral service"
• National applications — NHS England Digital's HSCN connection guidance says "A DSPT assessment is still required to access NHS Digital's national applications (such as the NHS e-Referral Service (ERS), Personal Demographics Service (PDS) and Secondary Uses Service (SUS))"

Neither source describes an automatic cut-off on 1 July, so treat a missed deadline as a risk to that access, and speak to your commissioner before the deadline if you are going to miss it. For a care home, losing NHSmail would disrupt communication with GPs and hospitals.

"Approaching Standards" vs "Standards Met" vs "Standards Exceeded"

For Category 3 and 4 organisations the DSPT has three published levels (NHS England also uses a "Standards Not Met" status, which larger organisation types can publish with an improvement plan):

• Approaching Standards — a fallback below the mandatory set, not the mandatory set itself: NHS England's version 9 (2026-27) workbook flags 26 items as "Approaching standards mandatory", the same set as version 8. NHS England's guidance says "Social Care organisations are eligible to complete a one-off 'Approaching Standards' assessment" — it does not name pharmacies, dentists or GP practices. Publishing here obliges an improvement plan, so treat it as a deadline safety net rather than a target.
• Standards Met — you've completed every evidence item marked mandatory for your organisation type, with full evidence. NHS England describes it as "responding to all the questions within the assessment which are indicated as being MANDATORY". NHS England's version 9 (2026-27) workbook marks 45 items mandatory for Category 3 and 29 for Category 4 (GP practices), the same as version 8. Digital Care Hub's adult social care guidance gives that full set as 45 questions in one sentence and 42 in another, and the count varies by organisation type in any case, so take the total from your own toolkit. This is the higher bar most providers should work toward across the year.
• Standards Exceeded — for most organisations, shown where you have gone beyond Standards Met and hold Cyber Essentials Plus recorded in your Organisation Profile. NHS England's wording opens "For all other organisations" for a reason: NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and independent providers designated as OES instead reach it by meeting the achievement levels forecast for the following year.

Practical advice: Plan for "Standards Met" by 30 June. If you are a social care provider completing the DSPT for the first time and cannot finish the mandatory set in time, you are eligible for a one-off "Approaching Standards" assessment — publish there with an action plan rather than miss the deadline, then work toward "Standards Met"; the toolkit stays open for updates throughout the year. Pharmacies, dentists and GP practices are not named as eligible for that route, so build your plan around the full mandatory set. If you're in the final weeks before the deadline, our DSPT final checklist covers the highest-impact evidence items to confirm before you submit. Once your submission is in, what to do after the DSPT deadline covers closing the gaps you flagged and keeping evidence current for next year.

Common evidence items you'll need

While the exact requirements depend on your category and the version 9 workbook, most Category 3 organisations will need:

• Staff training certificates — proof that every member of staff has completed annual data security awareness training. This is consistently the item that causes the most last-minute scrambling.
• Data security policy — a current, reviewed policy (item 1.3.1). Asking staff to read and acknowledge it is good practice.
• Risk assessment log — documenting identified data security risks and what you've done about them.
• Business continuity plan — what happens if your systems go down, you suffer a cyber attack, or you lose access to patient records.
• Access control records — who has access to which systems, when access was last reviewed, and how leavers' access is removed.
• Incident response procedure — how you detect, report, and respond to data security incidents.
• Supplier assurance — evidence that your IT suppliers (managed service providers, software vendors) meet data security standards.

For a more structured breakdown, try our free evidence checklist generator — select your category and get a categorised list of what you need to gather. If you're evaluating tools to help with tracking, see our guide on what to look for in a DSPT compliance tracker.

How long does it take?

There's no single answer — it depends on how organised your existing records are. But based on typical Category 3 organisations:

• First submission: 20-40 hours over 3-5 months. The bulk of the time is gathering evidence, not answering questions. If your training records are scattered across email, your policy is three years old, and you've never documented your access controls, expect to be at the higher end.
• Repeat submissions: 8-15 hours if you maintained your evidence throughout the year. Much less if your evidence from last year carries forward cleanly (though each version adds or rewords some items, and version 9 added four, so some need refreshing regardless).

The most effective approach is to spread the work across January to May rather than scrambling in June. A 90-day action plan starting in April gives you enough time without it consuming every spare moment. See our DSPT deadline action plan for a week-by-week breakdown.

FAQ

What does DSPT stand for? Data Security and Protection Toolkit. It replaced the old Information Governance Toolkit (IGT) in 2018. If you last filed under the old name, our guide to moving from the IG Toolkit to DSPT covers what is different now.

Is the DSPT mandatory? Yes, for any organisation accessing NHS patient data or systems. NHS England's guidance says completion is "a contractual requirement specified in the NHS England Standard Conditions contract", and that it "remains Department of Health and Social Care policy that all bodies that process NHS patient information for whatever purpose provide assurances via the DSPT". Digital Care Hub adds that "Commissioners, CQC inspectors, families and people using care services can also check the DSPT status of a care service."

Can I complete the DSPT without a consultant? Yes. The DSPT is designed as a self-assessment. Many small providers complete it independently — it takes longer the first time, but you build capability for future years. Tools like our readiness quiz can help you identify gaps before you start. If you are still weighing it up, we have set out whether to use a DSPT consultant or do it yourself, including what a consultant cannot do on your behalf.

What if I can't meet the 30 June deadline? Contact NHS England before the deadline to discuss your options. Check the DSPT help pages for current guidance on support routes available to your organisation category. If you are a social care provider, NHS England's guidance makes you eligible for a one-off "Approaching Standards" assessment, and submitting there with an action plan is better than a missed submission. The guidance does not name pharmacies, dentists or GP practices as eligible, so check with NHS England what applies to you.

How often does the DSPT change? Annually, in late August or early September: NHS England's release notes date version 6 to 30 August 2023, version 7 to 30 August 2024, version 8 to 1 September 2025 and version 9 to 1 September 2026. Across versions 7, 8 and 9 the 36 assertions stayed the same; the changes were to individual evidence items. For the current cycle, see the 2026/27 DSPT (version 9).

Next steps

1. Check your category — log in to dsptoolkit.nhs.uk and confirm whether you're Category 3 or 4.
2. Prepare for first login — our DSPT toolkit prep guide covers what to gather before you open the portal so you don't waste your first session hunting for documents.
3. Download the version 9 workbook — see exactly which assertions and evidence items apply to you.
4. Audit your current evidence — use our evidence checklist generator to see what you need and identify gaps.
5. Plan your timeline — the DSPT deadline calculator shows how many working days you have left and suggests milestones.
6. Start with training records — this is the evidence item most providers leave until last. Get it done first.

If you run a community pharmacy, our DSPT for pharmacies guide covers pharmacy-specific evidence patterns and the NHSmail/EPS access points that matter most for pharmacy continuity. For the underlying nationally-mandated framework, see our overview of the NHS Data Security and Protection Toolkit.

This guide reflects DSPT version 9 (2026-27) requirements as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
• DSPT system changes and release notes — NHS England
• Organisation types — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• National Data Guardian review of data security — GOV.UK
• Cyber Assessment Framework — NCSC