Your DSPT Final Checklist: What to Do in the Last Weeks Before 30 June

It's the final stretch before the 30 June DSPT deadline — the date NHS England sets every year. If your submission is mostly done and you want to confirm you haven't missed anything, or you're behind and need to know where to focus, this checklist is built for the last few weeks rather than a leisurely spring run-up.

The aim here isn't to teach the DSPT from scratch — it's to catch the high-impact gaps that commonly trip up small providers at the last minute, and to give you a clear plan if time is short.

First: know exactly how long you have

This checklist covers the 2026-27 (version 9) toolkit, released on 1 September 2026, whose deadline is 30 June 2027. It was first written for version 8 (2025/26), and the mandatory items are the same in both versions, so the last-weeks checks below apply in the same way. If you're not sure how many working days that leaves you, our DSPT deadline calculator gives you a personalised countdown with milestones for your organisation type.

If you're already short on time, decide your target now. Standards Met — the mandatory set — is the target. If you are a social care provider and cannot get there, Approaching Standards (a smaller subset of 26 items, available to social care as a one-off) with an improvement plan is a legitimate, on-time outcome — far better than chasing a perfect submission and missing the date. NHS England's guidance does not name pharmacies, dentists or GP practices as eligible for that route — if you are one of those, plan for Standards Met.

The last-weeks checklist

Work through these in order. The first few are the ones most likely to be incomplete and most likely to hold up a submission.

1. Supplier and IT-provider assurance is in hand

Much of your technical evidence depends on someone else. If you haven't already:

• Confirm your clinical/PMR system supplier's DSPT assurance (e.g. EMIS, TPP SystmOne, or your pharmacy PMR provider) — most publish a DSPT status you can reference.
• Confirm your IT support provider has given you the assurance or documentation you need for access control, patching, and backups.

This is the item most likely to stall at the last minute because it depends on a third party's turnaround. Chase it first.

2. Staff training records are complete and current

• Data security awareness training completed by all staff in the current period — including locums, bank, agency, and recent starters.
• Records are dated within the last 12 months and you can produce the completion list, not just the training policy.

Training completion is a frequent gap because of turnover and temporary staff. Item 3.2.1 asks whether at least 95% of staff have completed training in the last twelve months, so in a team of fewer than 20, a single untrained person takes you below the line.

3. The asset register and administrator agreement are in place

Two items became mandatory for Category 3 in version 8 (2025/26) and remain mandatory in version 9 for both Category 3 and Category 4:

• Digital asset register (7.1.1) — "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" NHS England's tooltip adds that "The register should have been reviewed at least once in the last twelve months."
• Administrator agreement (4.3.1) — "Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?" That includes administrators at your IT supplier.

If either of these is missing, build it now — both are straightforward, but providers who last checked before version 8 can easily have missed them. For the full picture of what changed, see our DSPT v8 changes explained guide.

4. Governance evidence is in place

• Named IG lead (and Caldicott Guardian / SIRO where applicable), with evidence the role is active.
• Information governance policy and privacy notice accessible to staff and patients.
• ICO registration as a data controller is current (a Data Protection Act 2018 / UK GDPR requirement).

5. Incident response and continuity are documented

• An incident response process naming who to contact and how you'd report a personal data breach to the ICO within 72 hours where required.
• A business continuity plan covering a system outage — how you'd operate safely if your clinical/PMR system or NHSmail went down. Item 7.1.2 asks whether it is "regularly reviewed and tested"; for Category 3, item 7.2.1 asks how you tested it, and NHS England's tooltip says "This should be in the last twelve months."

6. Every mandatory assertion has evidence attached

Open the toolkit and go assertion by assertion. Where an item asks about a policy or process, attach the document or record that shows it is in place and in use. Confirm each mandatory item has a document or record attached, not just a tick.

7. Publish — don't just save

The most avoidable miss of all: completing every item but never clicking Publish. A saved-but-unpublished assessment does not count as submitted. Publish before 30 June.

If you're not going to finish in time

If you realistically can't reach your target by 30 June:

1. Publish at Standards Met if the mandatory items are done — that set IS Standards Met. Approaching Standards is a smaller fallback below it, for which NHS England names social care organisations as eligible. It's an on-time submission.
2. Note your gaps as an improvement plan. The toolkit lets you record what you'll strengthen and by when.
3. Tell the right people early. Contact your ICB or NHS England before the deadline if you're at risk of missing it — don't wait until 1 July.

For a social care provider, a published Approaching Standards submission on 30 June, improved over the following months, is a good outcome. A missed deadline is the thing to avoid.

Next steps

• Run the DSPT readiness quiz for a quick gap score before you do your final review.
• Use the evidence checklist generator to confirm you've covered your category's items.
• For the week-by-week version of this run-up, see our DSPT deadline action plan.
• New to the toolkit this year? Start with the complete DSPT guide.

This checklist was first written against DSPT v8 (2025/26) requirements and has been updated for version 9 (2026-27), whose deadline is 30 June 2027. Always confirm current requirements and deadlines on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2025-26 (version 8) — assertions, evidence items, and deadline — dsptoolkit.nhs.uk
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• DSPT release notes — NHS England
• Data Security and Protection Toolkit portal — dsptoolkit.nhs.uk