DSPT for Domiciliary Care: A Home Care Provider's Compliance Guide

If you manage a domiciliary care agency, the DSPT creates compliance requirements that residential care homes don't face. Your care workers access patient records while working in patients' homes, often over mobile networks, on devices that travel between multiple addresses every day. That combination — mobile workforce, dispersed data access, devices outside your premises — shapes everything about how you need to approach the DSPT.

Domiciliary care providers fall under Category 3 in the DSPT, the same category as residential care homes, pharmacies, and dental practices. The submission deadline is 30 June each year — the 2026-27 (version 9) deadline is 30 June 2027. Category 3 requires a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, though the exact count is set by your organisation type, so confirm it in your own toolkit — and no independent audit.

What makes domiciliary care different

Mobile devices holding patient data. Care workers in a residential home might access care planning software on a desktop or a tablet that never leaves the building. In domiciliary care, the device travels with the worker to every client visit. If a worker loses their phone or tablet, it may contain appointment schedules, care notes, or access credentials. Every device holding patient data needs to be encrypted — not just locked.

Data access in transit. Some domiciliary care workers use mobile apps to log care notes, medication administration, and visit times in real time. This data travels over the worker's mobile connection, through your care management software, and into your systems. The security of that transit depends partly on your software provider and partly on whether workers are using secure connections. Accessing patient records over a public Wi-Fi hotspot without a VPN or encrypted connection is a risk that needs addressing in your policies.

Workforce structure. Many domiciliary care agencies use a mix of employed staff, bank workers, and sometimes self-employed carers. Each person accessing patient data needs to be covered by your training records and your access controls, and ideally by your policy acknowledgements. Bank workers who work infrequently are a common gap — they may not have completed your annual training refresher, or their access may not have been reviewed recently.

Multiple client locations. Unlike a care home where data relates to residents on site, a domiciliary care agency's records span dozens or hundreds of client addresses. Business continuity planning needs to account for what happens if your care management software is unavailable — how do workers know where to go and what care is needed?

The evidence you'll need

Standard 1 — Personal confidential data: An information asset register and record of processing activities (item 1.1.2) showing which systems hold client and staff data, what they hold and who you share it with. Who accesses each system, and at what level, is Standard 4 evidence. For domiciliary care, this typically includes your care management platform, NHSmail (if used), and any scheduling or communication apps. Note which data is accessed in the field and on which device types. Your data protection and cyber security policies also sit under Standard 1 (item 1.3.1): cover mobile device use, remote access and the specific risks of domiciliary care, and if staff use their own phones for work, item 1.3.11 asks for a bring-your-own-device policy.

Standard 2 — Staff responsibilities: An induction that covers data security and protection, and cyber security (item 2.1.1), and employment contracts and volunteer agreements with data security clauses (item 2.2.1). NHS England's tooltip says these clauses should cover "confidentiality, integrity and availability", not just confidentiality. Include bank and agency staff in your induction records. Asking staff to confirm they have read the policy, by signature sheet or email, is good practice.

Standard 3 — Training: At least 95% of staff need to have completed data security training in the last twelve months (item 3.2.1, mandatory for Category 3). The NHS e-Learning for Healthcare module is free and suitable for most care worker roles. You need a Training Needs Analysis (TNA) completed in the last twelve months (item 3.1.1) and delivery records for every staff member. Checking that training worked is good practice, but it is not a separate Category 3 evidence item. Bank workers and infrequent staff are a common gap — document how they access and complete training.

Standard 4 — Managing data access: An access control register covering every system with patient data, your joiner/leaver process, and a signed agreement holding your IT system administrators to higher standards (item 4.3.1, which version 8 made mandatory for Category 3) (including any external IT provider that administers your systems). Your access register should cover field worker app accounts, not just back-office logins. Document what happens to system access when a carer leaves or moves to bank status.

Standard 5 — Process reviews: A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none. NHS England's tooltip adds that "It is good practice to review processes annually even if a breach or near miss has not taken place." (Policy review belongs to Standard 1: NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum".)

Standard 6 — Responding to incidents: An incident response procedure and an incident log. For domiciliary care, common incidents include lost or stolen mobile devices, care notes accessed on the wrong client, and messages sent to the wrong contact. Your procedure needs to address these field-based scenarios specifically, including reporting timelines and what constitutes a notifiable breach to the ICO.

Standard 7 — Continuity planning: A business continuity plan covering what happens if your care management software is unavailable. In domiciliary care, this is operationally critical: care workers need to know where to go and what care to deliver even if they can't access the digital system. Your plan needs paper-based backup procedures for visit schedules and essential care notes. Item 7.1.2 asks whether the plan is "regularly reviewed and tested", and item 7.2.1 asks how you test it, with NHS England's tooltip adding "This should be in the last twelve months."

Standard 8 — Unsupported systems: All devices, including those used by field workers, should run supported operating systems. For employer-owned devices, your IT provider can confirm this. For bring-your-own-device arrangements, you'll need a policy addressing minimum OS requirements and how workers confirm their device meets them.

Standard 9 — IT protection: Device encryption (item 9.5.2), router and network-device passwords changed from the originals (item 9.1.1), and firewalls (item 9.6.1, not mandatory). The toolkit numbers three related controls under other standards: anti-malware (Standard 6, item 6.2.1), patching (Standard 8, item 8.3.5) and multi-factor authentication for remote access (Standard 4, item 4.5.3). For domiciliary care, device encryption is particularly important: every device leaving your premises with patient data on it needs full-disk encryption. For employer-provided devices, your IT or device management provider can confirm this. For BYOD arrangements, document your policy and how workers confirm compliance.

Standard 10 — Accountable suppliers: Data processing agreements and assurance from suppliers handling client data. For domiciliary care, key suppliers include:

• Your care management software provider
• Your scheduling/workforce management platform
• Your managed IT provider (if used)
• Any cloud backup or storage service
• Your NHSmail account (managed through NHS England — assurance typically comes via their own DSPT status)

Common evidence gaps

Device encryption for field workers. This is the most common gap in domiciliary care DSPT submissions. If care workers use employer-provided tablets or phones, your IT provider should be able to confirm that full-disk encryption is enabled. If workers use personal devices (BYOD), you need a policy requiring encryption and a way to confirm compliance. Assertion without evidence doesn't satisfy the DSPT.

Training for bank and temporary workers. Workers who cover shifts infrequently may not appear in your main training tracking system. Establish a process for confirming training status before a bank worker accesses patient systems, and keep records of how and when training was completed.

Incident log gaps. Small incidents — a care note uploaded to the wrong client profile, a scheduling message sent to the wrong carer — often go unrecorded. Your incident log doesn't need to record every minor administrative error, but it should capture anything involving patient data handled incorrectly. An empty log that clearly captures zero incidents is fine; an absent log suggests no incident-tracking process exists.

Getting your submission ready

Use the version 9 (2026-27) workbook from the official version 9 announcement page, filtered to Category 3, to work through your evidence systematically. Group the work:

1. Policies — update your data security policy to address domiciliary-specific risks, and ask all staff, including bank workers, to read and acknowledge it (good practice).
2. Training records — run a training needs analysis, confirm completion records for every worker, address gaps.
3. Device inventory and assurance — confirm encryption for all devices; get assurance letters from your IT and care management software providers.
4. Access controls — update your access register, check for leavers still with active accounts, and get your IT system administrators (internal and external) to sign the administrator accountability agreement (4.3.1).
5. Incident log and BCP — review your incident procedure and ensure your business continuity plan addresses field-specific scenarios.

For a structured checklist of the evidence items for your category, use our free evidence checklist generator. For a timeline to the submission deadline, use the DSPT deadline calculator.

Our DSPT for care homes guide covers the residential care context — many of the same standards apply, with different evidence challenges around fixed-premises operations.

FAQ

Do domiciliary care providers need to complete the DSPT? Yes. Any domiciliary care provider that handles NHS patient data, uses NHSmail, or connects to NHS systems must complete the DSPT annually. This applies even where all care is provided outside a fixed premises.

What DSPT category are domiciliary care providers in? Category 3, alongside residential care homes, pharmacies, dental practices, and opticians. A pre-determined set of mandatory evidence items (45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks; confirm your own count in the toolkit), no independent audit required.

How is the domiciliary care DSPT different from residential care homes? The 10 NDG standards are the same. The difference is in the evidence: domiciliary care workers access patient data in patients' homes on mobile devices, which introduces risks around device encryption, mobile data transmission, and field-worker training that don't exist for fixed-premises care homes.

What happens if a domiciliary care provider misses the DSPT deadline? A missing or out-of-date DSPT can affect your data sharing arrangements and ICB contract compliance. If you're at risk of missing the deadline, submit at Approaching Standards rather than not submitting. Check the DSPT help pages for current support options.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT organisation types — NHS England
• DSPT overview and introductory guidance — NHS England
• Data security awareness e-learning — NHS e-Learning for Healthcare