DSPT Compliance: What to Look for in a Compliance Tracker

Most care homes, pharmacies, and GP practices manage their DSPT submission using one of three approaches: the NHS portal alone, a spreadsheet, or a consultant. Each has real limitations that become obvious around April when the 30 June deadline starts feeling close.

This guide breaks down what actually matters in a DSPT compliance tracker, so you can evaluate your options — whether you stick with your current approach or look for something better.

The three default approaches (and where they break down)

The DSPT portal itself

The official DSPT portal is where you submit, but it's not designed to help you prepare. It shows assertions one at a time with no progress overview, no gap analysis, and no way to track who's doing what. You upload evidence, tick boxes, and submit.

Where it breaks down: No reminder system. No year-on-year evidence tracking. No way to see at a glance which evidence items are missing, which policies need updating, or which staff haven't completed training. You log in, do what you can, log out, and try to remember where you left off.

Spreadsheets

The NHS publishes downloadable evidence spreadsheets for each category. Many providers print these out or copy them into their own Excel tracker, adding columns for status, responsible person, and evidence location.

Where it breaks down: A spreadsheet doesn't remind you of deadlines. It can't track whether staff have completed training. It doesn't carry forward evidence from last year. And by May, the spreadsheet you started in January has been emailed between three people and nobody's sure which version is current.

Consultants

DSPT consultants (typically around £500–£2,000 per submission, based on market observations) complete the process for you. They gather evidence, upload it, and submit on your behalf.

Where it breaks down: You spend the same amount every year. Your team never learns the process. If the consultant is unavailable or raises prices, you're starting from scratch. And you have no visibility into what was submitted — making it harder to maintain compliance between submissions.

What a good compliance tracker should do

If you're evaluating tools (or deciding whether your current approach is good enough), here's what matters for a small Category 3 or Category 4 organisation:

1. Show your completion status at a glance

You need a dashboard that answers three questions instantly:

How many evidence items are complete, in progress, and not started?
Which items are blocking "Approaching Standards" vs "Standards Met"?
What percentage of mandatory assertions have uploaded evidence?

The DSPT portal gives you some of this, but only by clicking through each assertion individually. A tracker should aggregate it.

2. Map evidence to assertions automatically

Some evidence items satisfy multiple assertions. Your information asset register, for example, answers item 1.1.2 under Standard 1, and NHS England's tooltip for item 7.1.1 (the digital asset register, Standard 7) says "You can have a separate list of digital assets or combine it into one document with your Information Asset Register". A tracker that maps one document to multiple assertions saves duplicate uploads and makes coverage gaps obvious.

3. Track staff training completion

Standard 3 asks whether at least 95% of staff, directors, trustees and volunteers have completed data security training in the last twelve months (item 3.2.1), so in practice you are chasing almost everyone, every year. For a care home with 30 staff — including part-time carers, night shift workers, and agency staff — tracking who has and hasn't completed training is the single biggest operational challenge of the DSPT.

A tracker should show you:

Which staff members have completed training (with certificate dates)
Which staff still need to complete it
When each person's training expires (annual renewal)

If you're managing this in a spreadsheet, it works until someone joins, leaves, or goes on long-term leave — then the spreadsheet quietly falls out of date.

4. Carry evidence forward year to year

The DSPT is annual. Much of the evidence you gather this year — policies, access control records, supplier assurance letters — will be relevant next year too (assuming nothing has changed). A tracker that carries forward unchanged evidence items means year 2 takes significantly less effort than year 1.

You publish a new assessment every year. The assertions themselves have been stable: NHS England's workbooks show the same 36 assertions in versions 7, 8 and 9. What changes is the evidence items, which are added, reworded and occasionally removed each year. A good tracker maps last year's evidence to this year's items for you.

5. Send deadline reminders

A 90-day, 60-day, and 30-day reminder before 30 June doesn't sound sophisticated, but it's the difference between a planned submission and a panicked one. Bonus if the reminders include your current completion percentage — "You're 65% complete with 42 days to go" is actionable. "The deadline is approaching" is not.

6. Generate a submission-ready report

Before submitting, you should be able to export a summary showing every assertion, its status, and the evidence uploaded against it. This serves as your internal audit trail and makes it easy to hand over if you change roles or if the CQC asks about your data security practices.

What doesn't matter (for small providers)

Features designed for larger organisations that add complexity without value for a 20–40 bed care home or single-site pharmacy:

Multi-framework support (ISO 27001, Cyber Essentials, SOC 2) — unless you're pursuing these separately, you don't need one tool covering all of them
Risk scoring algorithms — useful for enterprise risk management, overkill for a Category 3 provider
Audit workflow tools — NHS England's 2026-27 mandatory audit areas cover NHS Trusts, ICBs, ALBs, CSUs, OES, Genomics organisations and IT suppliers, not Category 3 and 4 providers
API integrations — you're not piping DSPT data into a SIEM or GRC platform

The real cost comparison

Approach	Annual cost	Time (year 1)	Time (year 2+)	Evidence carry-forward	Training tracking
Portal + spreadsheet	£0	20-40 hours	15-25 hours	Manual	Manual
Consultant	£500-£2,000	5-10 hours (your time)	5-10 hours	Depends on consultant	Depends on consultant
Purpose-built tracker	£30-£50/month	15-25 hours	8-15 hours	Automatic	Built-in

The portal is free but costs time. A consultant is fast but costs money every year and doesn't build your team's capability. A tracker sits in the middle — less time than DIY, less cost than a consultant, and it gets faster each year. If the consultant row is the one you are seriously considering, our guide to DSPT consultancy or DIY sets out what to ask before you sign.

Questions to ask when evaluating options

Before choosing any tool or service, ask:

Does it cover my specific category? Category 3 and Category 4 have different assertion sets. A tool built for enterprise (Category 1-2) may not map correctly to your requirements.
Does it stay current with DSPT versions? The toolkit changes annually. A tool built for version 8 (2025/26) may not include the four evidence items version 9 (2026-27) added. Check when it was last updated.
Can I see what was submitted? Whether you use a tool or a consultant, you should always have access to your complete submission and evidence records.
What happens if I stop paying? Can you export your data? Is your evidence accessible outside the platform?
Is it priced for my size? A 25-bed care home shouldn't pay the same as a 500-bed NHS trust.

If you're a residential or domiciliary care provider deciding between approaches, our DSPT for care homes evidence guide breaks down what good evidence looks like for each Category 3 assertion — useful context for evaluating whether a tool actually understands your obligations.

Next steps

Assess your current approach — is it actually working, or are you scrambling every June?
Try our DSPT readiness quiz to see where your gaps are, and read how to check your DSPT status before you rely on the result
Read our complete DSPT guide for a full overview of the current requirements
Use the evidence checklist generator to audit your current evidence against the core evidence items
Once you've submitted, what to do after the DSPT deadline covers keeping evidence current so next year's submission starts from a better place

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.