DSPT Compliance: What to Look for in a Compliance Tracker
Most care homes, pharmacies, and GP practices manage their DSPT submission using one of three approaches: the NHS portal alone, a spreadsheet, or a consultant. Each has real limitations that become obvious around April when the 30 June deadline starts feeling close.
This guide breaks down what actually matters in a DSPT compliance tracker, so you can evaluate your options — whether you stick with your current approach or look for something better.
The three default approaches (and where they break down)
The DSPT portal itself
The official DSPT portal is where you submit, but it's not designed to help you prepare. It shows assertions one at a time with no progress overview, no gap analysis, and no way to track who's doing what. You upload evidence, tick boxes, and submit.
Where it breaks down: No reminder system. No year-on-year evidence tracking. No way to see at a glance which evidence items are missing, which policies need updating, or which staff haven't completed training. You log in, do what you can, log out, and try to remember where you left off.
Spreadsheets
The NHS publishes downloadable evidence spreadsheets for each category. Many providers print these out or copy them into their own Excel tracker, adding columns for status, responsible person, and evidence location.
Where it breaks down: A spreadsheet doesn't remind you of deadlines. It can't track whether staff have completed training. It doesn't carry forward evidence from last year. And by May, the spreadsheet you started in January has been emailed between three people and nobody's sure which version is current.
Consultants
DSPT consultants (typically around £500–£2,000 per submission, based on market observations) complete the process for you. They gather evidence, upload it, and submit on your behalf.
Where it breaks down: You spend the same amount every year. Your team never learns the process. If the consultant is unavailable or raises prices, you're starting from scratch. And you have no visibility into what was submitted — making it harder to maintain compliance between submissions.
What a good compliance tracker should do
If you're evaluating tools (or deciding whether your current approach is good enough), here's what matters for a small Category 3 or Category 4 organisation:
1. Show your completion status at a glance
You need a dashboard that answers three questions instantly:
- How many evidence items are complete, in progress, and not started?
- Which items are blocking "Approaching Standards" vs "Standards Met"?
- What percentage of mandatory assertions have uploaded evidence?
The DSPT portal gives you some of this, but only by clicking through each assertion individually. A tracker should aggregate it.
2. Map evidence to assertions automatically
Some evidence items satisfy multiple assertions. Your data security policy, for example, may be relevant to Standard 1 (personal confidential data), Standard 2 (staff responsibilities), and Standard 5 (process reviews). A tracker that maps one document to multiple assertions saves duplicate uploads and makes coverage gaps obvious.
3. Track staff training completion
Standard 3 requires every member of staff to complete annual data security awareness training. For a care home with 30 staff — including part-time carers, night shift workers, and agency staff — tracking who has and hasn't completed training is the single biggest operational challenge of the DSPT.
A tracker should show you:
- Which staff members have completed training (with certificate dates)
- Which staff still need to complete it
- When each person's training expires (annual renewal)
If you're managing this in a spreadsheet, it works until someone joins, leaves, or goes on long-term leave — then the spreadsheet quietly falls out of date.
4. Carry evidence forward year to year
The DSPT is annual. Much of the evidence you gather this year — policies, access control records, supplier assurance letters — will be relevant next year too (assuming nothing has changed). A tracker that carries forward unchanged evidence items means year 2 takes significantly less effort than year 1.
The official portal does not carry evidence forward between DSPT versions. If v9 next year restructures the assertions again (as v8 did from v7), you'll need to re-map everything. A good tracker handles this remapping for you.
5. Send deadline reminders
A 90-day, 60-day, and 30-day reminder before 30 June doesn't sound sophisticated, but it's the difference between a planned submission and a panicked one. Bonus if the reminders include your current completion percentage — "You're 65% complete with 42 days to go" is actionable. "The deadline is approaching" is not.
6. Generate a submission-ready report
Before submitting, you should be able to export a summary showing every assertion, its status, and the evidence uploaded against it. This serves as your internal audit trail and makes it easy to hand over if you change roles or if the CQC asks about your data security practices.
What doesn't matter (for small providers)
Features designed for larger organisations that add complexity without value for a 20–40 bed care home or single-site pharmacy:
- Multi-framework support (ISO 27001, Cyber Essentials, SOC 2) — unless you're pursuing these separately, you don't need one tool covering all of them
- Risk scoring algorithms — useful for enterprise risk management, overkill for a Category 3 provider
- Audit workflow tools — Categories 3 and 4 don't require independent audits under DSPT v8
- API integrations — you're not piping DSPT data into a SIEM or GRC platform
The real cost comparison
| Approach | Annual cost | Time (year 1) | Time (year 2+) | Evidence carry-forward | Training tracking |
|---|---|---|---|---|---|
| Portal + spreadsheet | £0 | 20-40 hours | 15-25 hours | Manual | Manual |
| Consultant | £500-£2,000 | 5-10 hours (your time) | 5-10 hours | Depends on consultant | Depends on consultant |
| Purpose-built tracker | £30-£50/month | 15-25 hours | 8-15 hours | Automatic | Built-in |
The portal is free but costs time. A consultant is fast but costs money every year and doesn't build your team's capability. A tracker sits in the middle — less time than DIY, less cost than a consultant, and it gets faster each year.
Questions to ask when evaluating options
Before choosing any tool or service, ask:
- Does it cover my specific category? Category 3 and Category 4 have different assertion sets. A tool built for enterprise (Category 1-2) may not map correctly to your requirements.
- Does it stay current with DSPT versions? The toolkit changes annually. A tool that worked for v7 may not reflect v8's restructured assertions. Check when it was last updated.
- Can I see what was submitted? Whether you use a tool or a consultant, you should always have access to your complete submission and evidence records.
- What happens if I stop paying? Can you export your data? Is your evidence accessible outside the platform?
- Is it priced for my size? A 25-bed care home shouldn't pay the same as a 500-bed NHS trust.
If you're a residential or domiciliary care provider deciding between approaches, our DSPT for care homes evidence guide breaks down what good evidence looks like for each Category 3 assertion — useful context for evaluating whether a tool actually understands your obligations.
Next steps
- Assess your current approach — is it actually working, or are you scrambling every June?
- Try our DSPT readiness quiz to see where your gaps are
- Read our complete DSPT guide for a full overview of v8 requirements
- Use the evidence checklist generator to audit your current evidence against v8 assertions
This guide is based on DSPT v8 (2025/26) requirements. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.