DSPT for Dental Practices: A Principal Dentist's Compliance Guide

As a principal dentist or practice manager handling your practice's NHS obligations, the DSPT sits alongside GDC standards, CQC registrations, and BDA guidance as one of the annual compliance tasks that falls to you. Most guidance on the toolkit is aimed at care homes or GP practices — this one focuses specifically on what dental practices need.

Dental practices are Category 3 in the DSPT, alongside pharmacies, care homes, and opticians. That means a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, though the exact count is set by your organisation type, so confirm it in your own toolkit — an annual 30 June submission deadline, and no requirement for an independent audit. You complete the self-assessment and publish your result.

What makes dental practices different

The underlying 10 NDG standards are the same across all Category 3 organisations, but the evidence you gather is shaped by how a dental practice actually operates. Three things set dental practices apart from pharmacies or care homes.

Practice management software. Whether you use Dentally, SOE Exact, R4 Practice Management, or another system, your clinical and administrative data lives in that platform. Your DSPT evidence needs to include supplier assurance from your PMS provider — confirming they meet data security standards — and your own evidence of how you manage access to the system.

NHS Spine and NHSmail. Practices with NHS contracts typically have access to NHS Spine (for NHS Business Services Authority claims and real-time eligibility checking) and NHSmail accounts. These connections mean you have data-sharing obligations that extend beyond your own four walls. Your evidence needs to show that these access points are appropriately managed and that staff using NHSmail understand their responsibilities.

Staff mix and turnover. Many dental practices employ a mix of permanent staff (receptionists, nurses, practice manager), self-employed associates, and locum dentists. Each person with access to patient records needs to be covered by your training records and your access controls. Associates and locums are a common gap — your DSPT can't assume they'll organise their own data security training.

The evidence you'll need

Category 3 dental practices need to demonstrate compliance with all 10 NDG standards. Here's how each one plays out in a dental context.

Standard 1 — Personal confidential data: Your evidence needs to show that patient data is handled, stored and transmitted securely, and only shared for lawful and appropriate purposes. An information asset register and record of processing activities (item 1.1.2) works well: list each system that holds patient or staff data (PMS, NHSmail, NHSBSA portal, cloud storage), what data it holds, and who you share it with. Your data protection and cyber security policies also sit under Standard 1 (item 1.3.1). NHS England's tooltip says policies "should be updated every three years as a minimum"; reviewing them every year is good practice. The policy doesn't need to be long, but the tooltip sets a minimum: data protection and confidentiality (including data breach management, risk assessment and data subject rights), records management (including retention and disposal) and cyber security (including password management, device and network security, and backups). Name the person or people with overall responsibility for data security and protection (item 1.1.5). Who can access each system is Standard 4 evidence, and associates who access clinical records need to appear there.

Standard 2 — Staff responsibilities: An induction that covers data security and protection, and cyber security (item 2.1.1), and employment contracts and volunteer agreements that contain data security requirements (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality." Asking each staff member to confirm they have read the data security policy, by signature sheet or email, is good practice.

Standard 3 — Training: ⚠️ The 95% rule is not gone for dental practices — evidence item 3.2.1 is still marked mandatory for Category 3 in NHS England's version 9 (2026-27) workbook, as it was in version 8. The 2023 change that dropped it applies to Category one organisations only. You need both the 95% completion figure and a documented Training Needs Analysis completed in the last twelve months (item 3.1.1, also mandatory for Category 3). Checking that training worked, for example with a short quiz, is good practice, but no Category 3 evidence item asks for a separate evaluation. The NHS e-Learning for Healthcare data security awareness module is free and generates a certificate — useful for nurses, receptionists, and admin staff. For self-employed associates, you'll need to establish how they meet the training requirement.

Standard 4 — Managing data access: An access control register (who has access to which systems at what level), a joiner/leaver process, and a signed agreement holding your IT system administrators to higher standards. That is item 4.3.1: it was already in version 7, and version 8 made it mandatory for Category 3. Whoever administers your PMS, NHSmail admin access, and any NHSBSA portal administrator (including an external IT provider) all need to be covered by that agreement.

Standard 5 — Process reviews: A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none. Reviewing your processes annually anyway is good practice. Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies).

Standard 6 — Responding to incidents: An incident response procedure and an incident log. The procedure covers how staff identify, report, and escalate data incidents. The log records incidents (even minor ones like an email sent to the wrong address) and the actions taken. If you've had no reportable incidents, an empty log with the procedure attached demonstrates you have a working system.

Standard 7 — Continuity planning: A business continuity plan covering what happens if your PMS goes down, your internet connection fails, or you suffer a cyber attack. For a dental practice, this includes: paper backup procedures for appointments and patient notes, how to access NHSBSA claims if your system is unavailable, and who to contact in an emergency. Item 7.1.2 asks whether the plan is "regularly reviewed and tested", and item 7.2.1 asks how you test it, with NHS England's tooltip adding "This should be in the last twelve months." So review it and test it every year; a tabletop exercise with your team is enough.

Standard 8 — Unsupported systems: A list of all devices (computers, laptops, tablets) used in the practice, with their operating systems confirmed as currently supported. If any device runs an end-of-life OS (Windows 7 or 8, for example), replace it, or record why you are keeping it, the risks and what you are doing to reduce them: item 8.1.4 asks whether systems are "still supported by the manufacturer or the risks are understood and managed", and item 8.2.1 asks for that risk document. Ask your IT provider for a device list if you don't have one.

Standard 9 — IT protection: Confirmation that laptops, tablets and removable devices are encrypted (item 9.5.2), that router and network-device passwords have been changed from the originals (item 9.1.1), and that firewalls are in place (item 9.6.1, not mandatory). Anti-malware (Standard 6, item 6.2.1), patching (Standard 8, item 8.3.5) and multi-factor authentication (Standard 4, item 4.5.3) are numbered under other standards, but for most dental practices a single assurance letter from your IT provider covering all of these controls is the most efficient evidence. If you manage IT yourself, screenshots of Windows Security, Windows Update, and BitLocker suffice. Multi-factor authentication on remotely accessible accounts is a mandatory Category 3 item in version 9 (4.5.3), so if any staff access patient records from outside the practice, MFA should be in place.

Standard 10 — Accountable suppliers: Data processing agreements (DPAs) and assurance statements from suppliers handling patient data. For dental practices, this typically includes:

• Your practice management software provider
• Your managed IT provider (if you use one)
• Your cloud backup service
• Your NHSBSA portal access (if relevant)
• Any third-party appointment booking or patient communication platform

Most PMS providers have a standard DPA and DSPT assurance letter available on request or via their support portal. Your IT provider should be able to supply a letter confirming they meet data security standards.

Common evidence gaps in dental practices

Three areas consistently create gaps for dental practices at assessment time.

Associates and locums. Their training status and system access need to be documented even if they're self-employed, and asking them to acknowledge your data security policy is good practice. The simplest approach: include them in your training tracking spreadsheet, send them your policy for acknowledgement, and note whether they complete training through your route or independently.

PMS access for leavers. When a dental nurse, associate, or receptionist leaves, their PMS access, NHSmail account, and any shared drive access need to be revoked promptly. This sounds obvious, but access registers at many practices haven't been audited recently — accounts for staff who left 12+ months ago may still be active. Check your PMS user list and your NHSmail admin panel.

Supplier assurance. Many practices have a verbal relationship with their IT provider and PMS vendor but no written confirmation of their data security standards. The DSPT requires written evidence. A single email to each key supplier requesting either their DSPT submission reference or a brief assurance statement usually resolves this within a few days.

Preparing your submission

The most efficient approach for a dental practice:

1. Download the version 9 (2026-27) workbook and filter it to Category 3 from the official version 9 announcement page. This gives you the complete list of assertions and evidence items in a format you can annotate.
2. Work through each item and mark it red/amber/green — existing evidence, needs updating, or doesn't exist yet.
3. Group your gaps: policies (week 1), training records (week 2-3), IT evidence (one request to your IT provider), supplier assurance (email each key vendor).
4. Upload to the portal once evidence is gathered. The DSPT portal at dsptoolkit.nhs.uk is where you submit your assessment.
5. Submit at Standards Met. NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention dental practices, so build your plan around the full mandatory set and raise any risk of missing the deadline with NHS England early.

For a category-specific checklist of exactly which evidence items apply to you, use our free evidence checklist generator. For a week-by-week timeline, our DSPT 90-day action plan works for dental practices as well as care homes and pharmacies.

To see how a dental practice's evidence requirements compare with other Category 3 organisations, see our complete guide to DSPT evidence requirements.

FAQ

Is the DSPT mandatory for dental practices? Yes. Any dental practice providing NHS services — and most providing private services that connect to NHS systems — must complete the Data Security and Protection Toolkit by 30 June each year. NHS England describes it as a contractual requirement and DHSC policy, and it is relevant to CQC inspections under Regulation 17 (good governance).

What DSPT category are dental practices in? Dental practices are Category 3, the same category as pharmacies, care homes, and opticians. Category 3 has a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks; confirm your own count in the toolkit. No independent audit is required.

How is the dental practice DSPT different from other organisations? The core 10 NDG standards are the same across Category 3. What differs is the evidence context: dental practices rely heavily on practice management software, have patient record access through NHS Spine for some services, and may use NHSmail.

What happens if a dental practice misses the 30 June deadline? A missing or out-of-date DSPT can affect your NHS contract compliance and your ability to access NHS systems. Plan for Standards Met — NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention dental practices. If you're at risk of missing the deadline, contact NHS England before it passes. Check the DSPT help pages for current support options.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT organisation types — NHS England
• National Data Guardian data security standards — GOV.UK
• Data security awareness e-learning — NHS e-Learning for Healthcare