DSPT Consultancy or DIY: How to Decide
If you are pricing outside help for your DSPT, start with the one fact that shapes every option: NHS England calls it "an online self-assessment tool that enables organisations to measure and publish their performance against the National Data Guardian's ten data security standards."
Self-assessment, and published in your organisation's name. That means nobody can take the submission off your hands entirely. A consultant can do the gathering, the drafting and the gap analysis — genuinely useful work — but the assertions are still yours, and the underlying facts have to be true whoever types them in.
This guide sets out what outside help actually buys you, the funded support most small providers do not know exists, and a straight test for whether paying is the right call for your organisation.
What a consultant can genuinely do for you
The useful things, in rough order of how much time they save:
- Tell you what "good" looks like. The single biggest time cost for a first-time filer is not writing the policy, it is not knowing whether the policy you have is enough. Someone who has seen fifty submissions can answer that in minutes.
- Draft the documents. A data security policy, an incident procedure, a business continuity plan and a risk register are all standard artefacts. Drafting them from scratch is a day's work; adapting a good template with someone who knows the assessment is an hour.
- Run the gap analysis. Walking your current position against the current evidence items and producing a list.
- Chase the technical evidence. Getting supplier assurance statements and administrator account lists out of an outsourced IT provider is often faster with a third party asking.
- Absorb the annual version churn. The toolkit has been through eight versions. Someone tracking it professionally starts from the current one.
What a consultant cannot do for you
- Make the underlying facts true. If eleven of your forty staff have not completed data security training, no amount of consultancy changes that. The work is the training, not the paperwork.
- Carry the consequence. The submission publishes in your name. If a commissioner queries a control you asserted was in place, the conversation is with you.
- Build the habit. The DSPT is annual, and the providers who find it easiest are the ones whose evidence is a by-product of how they already run — dated policy reviews, a joiner-leaver checklist, a training completion report they can pull any week. Buying the submission each year does not build that; it rents around it.
- Answer for the year in between. Most of the assertions describe an ongoing state, not a June activity.
The support most small providers never check
Before pricing anything, check what your sector already funds for you.
Adult social care providers in England have Better Security, Better Care, described by its operators as "the national and local support programme to help adult social care providers to store and share information safely… focuses on helping care providers to complete the Data Security and Protection Toolkit". The Department of Health and Social Care has confirmed £21 million of funding for it over three and a half years to March 2029, including new "voluntary data and cyber health checks, delivered via local care associations".
What is actually on offer:
- A helpline on 0808 196 4848, 9am to 5pm Monday to Friday
- Regular national webinars on using the DSPT for the first time, and on reviewing and republishing an existing submission
- Guidance to help you complete the DSPT, including step-by-step materials
- Template policies and resources you can adapt for your organisation
- Local workshops, webinars and one-to-one sessions through a Local Support Partner
Scope matters: the programme states it is for "all adult social care providers, including services like day services which are not registered with CQC" — care homes, residential homes, domiciliary care and day services. It does not name community pharmacies, dental practices, opticians or GP practices among that eligibility, so treat it as being for adult social care unless your own provider type is explicitly listed.
Community pharmacies should start with Community Pharmacy England's DSPT guidance, which is written against the pharmacy question set.
GP practices should ask their ICB or commissioning support unit what IG support is included in existing arrangements before going to market — see our DSPT for GP practices guide for the Category 4 specifics.
The price problem
Nobody publishes a figure.
As at September 2026, working through the consultancies ranking on page one for DSPT search terms, not one lists a fee. Every route is a contact form or a phone number, and several present DSPT as a single line on a broader certification menu offered to organisations of any size — which tells you the DSPT work is not necessarily specialised to a 30-bed care home.
Two practical consequences:
- You cannot comparison-shop without a round of calls. Budget the time.
- Scope varies far more than price does. "DSPT support" can mean a two-hour document review or a done-with-you submission with supplier chasing. Ask what is included in writing before comparing anything.
When you do ask, the questions worth putting in the email:
- What exactly do you produce, and what remains ours to do?
- Do we get the source documents in an editable format we can reuse next year?
- Is this a one-off or does it renew annually, and at what price?
- Have you completed submissions for our organisation type and category specifically?
- Who is answerable if a commissioner queries something you drafted?
An honest test
Work through these. More "yes" answers on the left means DIY is realistic.
| Do it yourself if… | Get help if… |
|---|---|
| You have completed a DSPT before and know roughly where the documents live | This is a first submission and nobody in the organisation has seen the assessment |
| Your staff training records are current and pullable | Your training position is genuinely unknown and untangling it is the real job |
| You have someone who can give it half a day a week from January to June | The only person who could do it is already covering shifts |
| Your IT is either in-house or your provider answers emails | Your IT is outsourced to someone who does not respond, and supplier assurance is the blocker |
| You are aiming for "Approaching Standards" this cycle | A commissioner has flagged your submission and there is a deadline attached |
| Your sector has a funded support programme you have not used yet | You have used it and still cannot close the gap |
The most common honest answer for a small provider is neither column: the work is doable, but the gathering is what defeats it. If that is the position, the fix is usually a structure to work through — not a consultant. Our DSPT evidence checklist generator produces a categorised list for your organisation type, and the readiness quiz will show you which of the ten standards you are actually short on before you decide whether to pay anyone.
If you do pay, stay in the room
Whatever you decide, three things protect you:
- Read every assertion before it is submitted. You are the one asserting it.
- Keep the source documents. Editable, in your own storage, not only in the consultant's system. Next year starts from them.
- Note what changed. A one-page record of what was done, by whom, and what was still outstanding turns next year's submission from a restart into an update.
For the full picture of what you are being asked to evidence, see our DSPT evidence requirements guide and the complete DSPT guide.
This guide is based on NHS England's published DSPT guidance and the published scope of the Better Security, Better Care programme as at September 2026. It is not an endorsement or criticism of any individual provider of consultancy services. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.
Sources
- Data Security and Protection Toolkit — NHS England Digital
- DSPT overview and deadline — NHS England
- Better Security, Better Care — Digital Care Hub
- Better Security, Better Care national support — Digital Care Hub
- £21m confirmed for care provider data and cyber security support — Digital Care Hub
- Data Security and Protection Toolkit — Community Pharmacy England