The DSPT Deadline Is 30 June: Your 90-Day Action Plan

The DSPT submission deadline falls on 30 June every year — NHS England requires that "your organisation has published at least one assessment by the deadline of 30 June every year". For the current 2026-27 (version 9) cycle, that is 30 June 2027; the 2025/26 (version 8) deadline was 30 June 2026. The 90-day shape works for any cycle: count back roughly 90 days, about 13 weeks, from the 30 June you are aiming at, which lands at the start of April. That's tight but workable — if you have a plan.

This guide breaks the submission down into a week-by-week action plan for Category 3 and Category 4 organisations. Each week has one clear task that takes 1-2 hours. No marathons, no June panic.

The 90-day timeline at a glance

Week	Dates (approx.)	Focus	Time
1	1-4 Apr	Log in, check category, download evidence spreadsheet	1 hour
2	7-11 Apr	Audit existing evidence (what you have vs what you need)	2 hours
3	14-18 Apr	Send staff training out to all employees	1 hour
4	21-25 Apr	Review and update data security policy	1-2 hours
5	28 Apr - 2 May	Review business continuity plan	1-2 hours
6	5-9 May	Document access controls (who has access to what)	1-2 hours
7	12-16 May	Request supplier assurance statements	1 hour
8	19-23 May	Chase outstanding training completions	1 hour
9	26-30 May	Upload all evidence to the portal	2-3 hours
10	2-6 Jun	Review, fill gaps, do final checks	2 hours
11	9-13 Jun	Submit at "Standards Met"	1 hour
12	16-20 Jun	Buffer week — handle any issues	As needed

Total time: approximately 15-20 hours spread over 12 weeks. That's under 2 hours per week — manageable alongside running a care home, pharmacy, or practice.

Week 1: Log in and orient yourself

Task: Log in to dsptoolkit.nhs.uk, confirm your organisation's category (3 or 4), and download the version 9 (2026-27) workbook from the version 9 announcement page, filtered to your category.

If you can't log in, your NHSmail account may need reactivating or your ODS code may not be linked. Contact the DSPT helpdesk (0300 303 5035, Monday to Friday, 8am to 5pm). NHS England asks you to "wait 5 days before escalating" a call that is not urgent, which is why it's Week 1.

Deliverable: Printed or saved copy of the version 9 workbook, annotated with your category's assertions.

Week 2: Audit what you already have

Task: Go through each evidence item in the spreadsheet and mark it red/amber/green:

Green: Evidence exists and is current (dated within 12 months, matches the current wording)
Amber: Evidence exists but needs updating (out of date, or written for an earlier version and may not match the current wording)
Red: No evidence exists — you need to create this

This audit tells you exactly how much work remains. In our experience, a typical Category 3 organisation with reasonable practices in place often finds roughly half their items green, with the remainder split between amber and red — though this varies widely by organisation.

Use our evidence checklist generator for a structured version of this audit.

Deliverable: Colour-coded evidence spreadsheet showing your gaps.

Week 3: Launch staff training

Task: Send annual data security awareness training to every member of staff. This is the longest lead-time item — it depends on other people completing something, and some will need chasing.

Free option: the NHS e-Learning for Healthcare data security awareness module. It is split into four modules of around 20 minutes each plus a welcome module, according to NHS England's e-learning FAQ, and generates a downloadable certificate.

Who needs to complete it: Every person with access to patient data or NHS systems. This includes:

Permanent staff (all roles, including kitchen, maintenance, and admin staff at care homes if they have any access to patient areas)
Part-time and bank staff
Agency staff (ask agencies for training certificates or require completion of your training)

Deliverable: Training sent to all staff. Set up a tracking sheet or use our tools to monitor completions weekly.

Weeks 4-5: Policies and plans

Week 4 — Data security policy:

Does your current policy reflect the current requirements?
Has it been updated in the last three years (NHS England's minimum for item 1.3.1), and ideally reviewed in the last year?
Have staff acknowledged reading it? (Good practice rather than an evidence item; a signature sheet or email confirmation is enough)

If it has not been updated for three years, update it now; if it has not been reviewed for a year, a quick review is good practice. It doesn't need to be long, but NHS England's tooltip for item 1.3.1 sets a minimum: data protection and confidentiality (including data breach management, risk assessment and data subject rights), records management (including retention and disposal) and cyber security (including password management, device and network security, and backups).

Week 5 — Business continuity plan:

Do you have a documented plan for what happens if you lose access to your IT systems?
Does it cover cyber attack scenarios (ransomware, data breach)?
When was it last reviewed, and when was it last tested? Item 7.1.2 asks for both; for Category 3, item 7.2.1 asks for a test in the last twelve months.

A business continuity plan for a 30-bed care home doesn't need to be a 50-page document. It needs to answer: who does what if the systems go down, how do we access patient records in the interim, and who do we contact?

Week 6: Access controls

Task: Document who has access to which systems, when access was last reviewed, and your process for removing access when someone leaves.

Specifically:

List every system containing patient data (clinical systems, email, shared drives, cloud storage)
For each system, record who has access and what level (admin, standard user, read-only)
Check for leavers who still have active accounts — this is a common gap
Document your joiner/leaver access process

For GP practices, this includes EMIS/SystmOne access, NHSmail admin, and any shared drives. For pharmacies, include PharmOutcomes, NHSmail, and dispensing system access. For care homes, include care planning software, NHSmail, and any electronic records systems.

Deliverable: Access control register and documented joiner/leaver process.

Week 7: Supplier assurance

Task: Contact your IT suppliers and request written confirmation that they meet data security standards.

Most managed IT service providers can supply a standard assurance letter covering:

Data handling and encryption
Patching and update schedules
Backup and recovery procedures
Staff vetting and training

For clinical system vendors (EMIS, SystmOne, PharmOutcomes), these organisations typically publish their own DSPT submissions or provide assurance documentation. Check their support portals or ask your account representative.

Deliverable: Assurance letters or statements from each supplier handling patient data.

Week 8: Chase training

Task: Check your training tracker. By now (mid-May), you should have 80%+ completion. Chase anyone who hasn't completed the training.

Common holdouts: night shift staff, part-time workers, and staff on leave. For staff on long-term leave, document that they'll complete training on return — this shows you have a process even if completion isn't 100%.

Deliverable: Updated training completion records. Aim for 100% or documented exceptions.

Week 9: Upload everything

Task: Work through each assertion in the DSPT portal and upload your evidence. This is the most time-intensive single session — budget 2-3 hours and do it in one sitting if possible.

Tips for efficient uploading:

Name files clearly before uploading (e.g., "Data_Security_Policy_v3_May2026.pdf")
Add a brief note for each evidence item explaining what it shows
Upload training completion records as a single summary document, not individual certificates
Cross-reference your colour-coded spreadsheet to ensure nothing is missed

Deliverable: All available evidence uploaded to the portal.

Week 10: Gap check

Task: Review the portal's completion dashboard. Identify any assertions still showing as incomplete. For each gap:

Can you source the evidence quickly? (e.g., a supplier hasn't replied — chase them)
Is it a mandatory assertion? (The mandatory set is what "Standards Met" requires — do those first)
Is it something you genuinely can't evidence? (Document why and check the DSPT help pages for support options)

Deliverable: All mandatory assertions complete, or a clear list of items to resolve in Week 11.

Week 11: Submit

Task: Submit your DSPT at "Standards Met" once the mandatory assertions are complete — that set is what Standards Met requires. If you cannot get there, "Approaching Standards" is the smaller fallback, and it commits you to an improvement plan — NHS England's guidance names social care organisations as eligible for this one-off assessment and does not mention pharmacies, dentists or GP practices.

Don't wait until 30 June. Submitting in mid-June gives you a buffer for technical issues, portal downtime, or evidence that needs correcting.

After submission: Save a copy of your submission summary for your records. This is your evidence of compliance for CQC inspections, ICB contract reviews, and your own internal audit trail.

Week 12: Buffer

Task: Handle any post-submission issues. Occasionally the portal flags items for review or requests clarification. Having a buffer week means these don't become a crisis.

If you're starting later than April

The action plan compresses, but the priorities stay the same:

Starting in May (60 days):

Staff training — send immediately, this is your bottleneck
Audit evidence — skip the detailed colour-coding, just identify red items
Policies — update only what's expired, don't rewrite everything
Upload and submit — aim for "Standards Met"; if you are a social care provider and cannot get there, the one-off "Approaching Standards" assessment is the fallback

Starting in June (30 days or less):

Focus exclusively on mandatory assertions
Send training today and chase daily
Upload what you have — partial evidence is better than no evidence
Contact NHS England before the deadline if you genuinely can't finish — check the DSPT help pages for current support options

Check exactly how many working days you have left with our DSPT deadline calculator. For help choosing the right approach for tracking your progress, see our guide on what to look for in a DSPT compliance tracker. If you're already in the final stretch and need a quick sense-check of what to prioritise, our DSPT final checklist before the deadline covers the highest-impact items to confirm in the last weeks.

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.