How to Write a DSPT Data Security Policy: What NHS England Expects
Your data security policy is evidence for Standard 1 of the DSPT, Personal Confidential Data. Item 1.3.1, mandatory for Category 3 and 4, asks whether your organisation maintains "up-to-date data protection and cyber security policies aligned with best practice and national guidance". Staff acknowledging the policy is not a separate evidence item, but it is good practice and fits with Standard 2, which asks for an induction that covers data security (item 2.1.1).
Getting this right isn't about writing a lengthy document. It's about having a policy that's specific to your organisation, kept up to date (NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum"; an annual review is good practice), and acknowledged by staff. The usual weak spot is not a badly written policy but one that hasn't been reviewed recently, or one that no one has been asked to read.
What the policy needs to cover
NHS England's tooltip for item 1.3.1 sets the minimum: "As a minimum your policy/policies should cover:" data protection and confidentiality, "including data breach management, risk assessment, data subject rights, and data protection by design and default"; records management, defining "how records will be safeguarded from their creation to disposal, including accuracy, access, retention and disposal"; and cyber security, for example "password management, device and network security, backups, and technical security controls". "If relevant, remote working and bring your own device" should be covered too. You can have one policy or several, and the areas below can overlap and combine, but the content needs to be there.
Data handling expectations. How staff should handle patient or client data: on which systems, on which devices, what to do if they need to share data with a third party. The key principle is that personal data is used only for the purpose it was collected, shared only with authorised recipients, and kept no longer than needed.
Data subject rights and breach management. How you respond when someone asks for a copy of their data or asks you to correct it, and how a data breach is managed and reported. NHS England's minimum lists both under data protection and confidentiality.
Records management. How records are kept accurate and secure from creation to disposal: who can access them, how long you keep each type (item 1.4.1 asks for a timetable setting out how long you retain records), and how you dispose of them securely.
Access management. Who has access to which systems, how new access is authorised, and what happens when someone leaves. Your policy should state that access is role-appropriate, that leavers have access removed promptly, and that admin accounts are minimised and documented.
Device use. Whether staff can use personal devices for work purposes and, if so, under what conditions. If you allow BYOD, the policy needs to address encryption requirements and what happens if a personal device is lost or stolen. If you don't allow BYOD, the policy should state that clearly. NHS England's minimum also puts password management, network security and backups under cyber security, so say how each is handled, even if your IT provider does the work.
Incident reporting. How staff identify a data security incident (from a lost USB drive to an email sent to the wrong person) and who they report it to. The policy should name the reporting contact and include a brief description of what counts as a reportable incident.
Named responsibility. The name or role of the person or people with overall responsibility for data security and protection. Item 1.1.5 asks you to name them and say how the responsibility was formally assigned. This can be the registered manager, practice manager, or a named lead, and naming them in the policy helps staff know who to go to.
Training expectations. A statement that staff are expected to complete annual data security awareness training as a condition of their role.
What makes evidence strong vs weak
The DSPT doesn't require a perfect policy. It requires a policy that demonstrates your organisation is actively managing data security rather than ignoring it.
Strong evidence:
- A recent review date in the document header (within NHS England's three-year minimum; within the last year is better)
- Staff acknowledgement records — signature sheets, email confirmations, or a training completion record that includes the policy acknowledgement (good practice rather than a separate evidence item)
- Organisation-specific content — your actual systems, your named lead, your processes
- Consistent with other evidence items (your access register should reflect what the policy says about access management)
Weak evidence:
- A policy with no review date at all, or one not updated for more than three years
- A downloaded template with the placeholder organisation name still in it
- A policy that references systems or roles your organisation doesn't have
- No sign that staff have ever been asked to read it
No one is reading it for legal precision. What matters is whether you've genuinely engaged with the requirement or just ticked a box.
Reviewing and updating an existing policy
If your policy has not been updated for three years, update it before your next submission: NHS England's tooltip says policies "should be updated every three years as a minimum"; if it has not been looked at for a year, a review is good practice. Reviewing doesn't mean rewriting from scratch — it means:
- Read it and check it's still accurate. Have your systems changed? Has your staffing structure changed? Is the named data lead still in that role? Update what's out of date.
- Check it covers Standard 3's training requirement. For Category 3, the DSPT asks for a Training Needs Analysis (item 3.1.1, mandatory in version 9) (see the DSPT training change guidance) — your policy should reflect that staff training is TNA-driven and role-appropriate, not just "complete the e-learning module".
- Update the review date. Change the date in the document header to today's date and record the review in your review schedule.
- Re-circulate for acknowledgements. Even if the content barely changed, the annual review is a good opportunity to confirm that all current staff have seen the current version.
Collecting staff acknowledgements
Acknowledgements are not a separate DSPT evidence item, but they are good practice: a policy staff have never read does little, and the Standard 2 induction (item 2.1.1) is a natural place to collect them.
Ways to record it:
- Physical signature sheet — staff name, signature, date, policy version. Keep a copy in your HR file or data security folder.
- Email confirmation — ask staff to reply confirming they've read and understood the current policy. Keep the email chain.
- Training platform record — if you use an LMS or e-learning platform for data security training, include the policy acknowledgement as a step in the training module.
- A tick in your staff records spreadsheet — if you track training and acknowledgements in a spreadsheet, a column for "Policy acknowledged (date)" works, as long as you can show when it was completed.
What doesn't help: asserting that "staff are all aware of the policy" with nothing to show for it.
Keeping the policy current year to year
A data security policy only needs significant rewriting when your systems or processes change materially. For most small providers, the annual review involves:
- Updating the review date
- Checking named contacts are still current
- Checking any referenced system names are still accurate
- Adding a brief note if anything significant changed (new cloud storage platform, change in staff mix, new device policy)
Use the DSPT evidence checklist generator to see how your policy (Standard 1) fits alongside the induction and contract items in Standard 2 and the training items in Standard 3. For a full breakdown of what the DSPT requires across all 10 standards, see our evidence requirements guide.
This guide was written for DSPT v8 (2025/26). Version 9 (2026-27), the current toolkit, keeps the same mandatory items for Category 3 and 4, so it still applies; check item wording against the version 9 workbook. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.