DSPT for GP Practices: A Practice Manager's Compliance Guide

If you manage a GP practice, the Data Security and Protection Toolkit (DSPT) sits on a long list of annual obligations alongside CQC, QOF, the GP contract, and day-to-day operations. The good news: general practice has its own DSPT category, Category 4, with a smaller set of evidence items than care homes and pharmacies answer. The catch: most DSPT guidance online is written for care homes or NHS trusts, not for a practice manager juggling EMIS, GP Connect, and a Caldicott Guardian who is also a part-time partner.

This guide covers the DSPT specifically for GP practices — why you're Category 4, what evidence you need for DSPT version 9 (2026-27), how to coordinate with your clinical system supplier, and how to hit the annual 30 June deadline.

Your DSPT category: why GP practices are Category 4

General practice is Category 4 in the DSPT. This is its own category — separate from Category 3, which covers dentists, opticians, pharmacies, social care providers, and small IT suppliers.

You register at dsptoolkit.nhs.uk with your ODS code, but the code does not decide your category. At first login you choose your organisation's sector in the Organisation Profile, and NHS England states that "the organisation type determines which Category of toolkit is to be completed" — record general practice and the toolkit presents the Category 4 evidence items. You can "change your answers at any time", so if a predecessor recorded the wrong sector, correct it before you start rather than working through the wrong question set.

What Category 4 means in practice:

• You complete a self-assessment against the 10 National Data Guardian (NDG) standards — the same underlying standards every category works to.
• Most evidence items are worded exactly as they are for Category 3: in NHS England's version 9 workbook, 43 of the 47 items Category 4 shares with Category 3 have identical wording. The four that differ (1.3.6, 4.1.1, 4.5.3 and 7.3.4) are reworded, and the 4.5.3 tooltip speaks to practices directly: "Exceptions for practice-commissioned digital services may be decided by the practice management."
• No independent audit is required (that applies to Categories 1 and 2 — NHS trusts and large IT suppliers).
• You work toward Standards Met by 30 June — the deadline NHS England sets every year.

For the 2026-27 (version 9) toolkit, NHS England's version 9 workbook keeps the same 29 mandatory Category 4 items as version 8 and adds four optional ones (1.3.15, 7.1.7, 10.2.6 and 10.2.7). If you submitted last year, the shape of your task will feel familiar.

Don't assume the Category 3 numbers apply to you. A lot of online guidance quotes around 42 mandatory evidence items for Category 3 (care homes, pharmacies). NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks actually mark 45 items mandatory for Category 3 — and 29 for Category 4. Category 4 has its own pre-determined set. Always work from the Category 4 evidence list the toolkit shows you, not a number from a care-home guide. Download the official workbook from the version 9 announcement and filter it to Category 4 to see your exact list.

What changed at DSPT v8 and v9 (and why it matters for GP practices)

Version 8 (2025/26) did not restructure the toolkit for GP practices. NHS England's v8 workbook marks all 36 assertions as unchanged from version 7, and its release notes describe the Category 3 and 4 change as "evidence item minor amendments to update wording". NHS England's v8 announcement says it "is aligned to CAF version 3.4", but that alignment is at framework level: only Category 1 organisations, such as NHS Trusts and ICBs, see a CAF-aligned view.

For a practice manager, what actually changed is:

• Seven items were added to the GP list in v8: 7.1.1, 7.1.5, 7.1.6, 8.1.4, 8.2.1, 8.3.8 and 8.4.3. Only 7.1.1, the digital asset register, is mandatory: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" For a practice, that means a list of every device and the software on it, reviewed at least once a year.
• One mandatory item was dropped in v8: 4.3.3, which asked whether staff had been notified that their system use could be monitored.
• Version 9 (2026-27) added four optional items (1.3.15, 7.1.7, 10.2.6 and 10.2.7) and kept the same 29 mandatory items.

The administrator agreement (4.3.1) was already mandatory for GP practices in version 7 and still is. If you want the full change log, see our DSPT v8 changes explained guide, and if "CAF" is unfamiliar, our Cyber Assessment Framework explained guide covers what the framework is and where it fits.

GP-practice-specific challenges

General practice faces DSPT challenges that care homes and pharmacies don't:

Clinical system dependency (EMIS / TPP SystmOne). The bulk of your patient data lives in your clinical system. Much of your DSPT technical evidence — access controls, audit logging, encryption, role-based access — depends on what EMIS or SystmOne provides and how it's configured. You can't answer many assertions without your supplier's standing assurance documentation.

Multiple data flows. A practice handles data across the clinical system, NHSmail, GP Connect, the Summary Care Record, online consultation tools, the NHS App, document management, and often a separate appointment or telephony system. Each is a data touchpoint that needs documented access control.

Caldicott Guardian and IG lead roles. Practices are expected to have a Caldicott Guardian (a senior person, preferably a health or social care professional, responsible for protecting the confidentiality of people's information) and an Information Governance lead. The DSPT asks you to evidence that these roles exist and are active — minutes, role descriptions, and named individuals.

PCN and federation complexity. If you share staff, premises, or systems across a Primary Care Network, data flows between practices need documenting. Shared roles (a PCN-wide IG lead, for example) still need to map cleanly to each practice's own submission.

High patient and data volume with a small admin team. A practice with 8,000 patients may run with a handful of administrative staff. Compliance work competes with appointment management, prescriptions, recalls, and inbound clinical correspondence.

What evidence GP practices typically need

The exact items come from your Category 4 list, but most practices will need to gather evidence across these themes. This is a practical orientation, not a substitute for the official spreadsheet.

Governance and accountability

• A named Caldicott Guardian and IG lead (and SIRO where applicable), with evidence the roles are active.
• An information governance policy and a data protection / privacy notice that staff and patients can access.
• Evidence your practice is registered with the ICO as a data controller (a requirement under the Data Protection Act 2018 / UK GDPR).

Staff training and awareness

• Annual data security training completion records for all staff — clinical, administrative, and including locums, GP registrars, and bank staff. The standard route is the e-Learning for Healthcare Data Security Awareness training.
• Evidence that new starters complete training as part of induction.

Access control and technical security

• Role-based access in EMIS/SystmOne — staff see only what their role requires, with smartcard-based access where used.
• A system administrator account register — every admin-level account across the clinical system, NHSmail admin, and network/router management.
• Multi-factor authentication for remote access to systems holding patient data.
• A digital asset register — every device, its operating system version, and key software, with confirmation that nothing runs an unsupported OS.

Supplier assurance

• Standing DSPT assurance from your clinical system supplier (EMIS and TPP both publish DSPT status you can reference) and from your IT support provider.
• A list of your data processors and confirmation that contracts include data protection terms.

Incident response and continuity

• An incident response process — who to contact (your IT provider, and your ICB / NHS England), how to report a personal data breach to the ICO within 72 hours where required, and isolation steps for a suspected cyber attack.
• A business continuity plan covering a clinical-system outage: how you'd run safely if EMIS/SystmOne or NHSmail were unavailable. Item 7.1.2 asks whether the plan is "regularly reviewed and tested".

A realistic timeline for GP practices

You don't need to do this in one sitting. A workable approach for a practice:

1. Register / log in and pull your Category 4 list — confirm the toolkit recognises you as a GP practice and download the version 9 workbook, filtered to Category 4.
2. Request supplier assurance early — EMIS/SystmOne and your IT provider's DSPT documentation can take time to obtain. Start here.
3. Gather the people-and-policy evidence — Caldicott Guardian, IG lead, training records, policies. This is the bulk of the work and doesn't depend on anyone else.
4. Confirm the technical evidence — access controls, asset register, administrator agreements, MFA — with your IT provider.
5. Review against each assertion and submit — aim for Standards Met by the 30 June deadline. NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention GP practices, so do not plan around it.

Spreading this across the spring rather than scrambling in June is the difference between a calm submission and a stressful one. Our DSPT deadline action plan breaks the work into a week-by-week schedule.

Next steps

• Read the complete DSPT guide for the full overview across all categories.
• Check your current position with the DSPT readiness quiz — 10 questions to identify gaps before you open the toolkit.
• Use the evidence checklist generator to plan what to gather.
• See exactly how long you have with the deadline calculator.

This guide reflects DSPT version 9 (2026-27) requirements for Category 4 (GP practice) organisations and was last reviewed on 7 October 2026. Category 4 evidence items may be updated — always verify against the official Category 4 spreadsheets on the DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• DSPT 2025-26 (version 8) — assertions and evidence items — dsptoolkit.nhs.uk
• DSPT organisation types and categories — dsptoolkit.nhs.uk
• Cyber Assessment Framework — NCSC