DSPT for Pharmacies: A Community Pharmacy Compliance Guide

As a superintendent pharmacist or pharmacy owner, you are covered by the terms of service for NHS pharmacists in Schedule 4 to the National Health Service (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013, which require an information governance programme that includes "submission of an annual self assessment of compliance (to an approved level)". NHS England's DSPT guidance says completion is "a contractual requirement specified in the NHS England Standard Conditions contract" and DHSC policy for anyone processing NHS patient information. NHS England adds that completion "is also necessary for organisations which use national systems such as NHSmail and the e-referral service". But most DSPT guidance is written for care homes or NHS trusts, not community pharmacies.

This guide covers the DSPT specifically for community pharmacies — what category you fall under, what evidence you need, how to work with your PMR supplier, and how multi-site operators can use batch submissions.

Your DSPT category

Community pharmacies are Category 3 in the DSPT. This means:

• You complete a core self-assessment against the 10 National Data Guardian standards
• No independent audit required
• A pre-determined set of mandatory evidence items to complete — 45 for Category 3 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks; confirm your own count in the toolkit
• You should plan to reach "Standards Met" by the 30 June deadline, which falls every year (NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention pharmacies)

You register at dsptoolkit.nhs.uk using your pharmacy's ODS code, but the code does not set your category. You choose your sector in the Organisation Profile at first login, and NHS England states that "the organisation type determines which Category of toolkit is to be completed" — so a predecessor's wrong sector choice quietly gives you the wrong question set. You can change the answer at any time; check it before you start.

Pharmacy-specific challenges

Community pharmacies face DSPT challenges that differ from care homes and GP practices:

PMR system dependency. Your Patient Medication Record system holds the bulk of your patient data. Much of your DSPT evidence — access controls, data encryption, audit trails — depends on what your PMR system provides. You can't answer many technical questions without your supplier's input.

Multiple data touchpoints. A typical community pharmacy handles data across several systems: PMR, NHSmail, NHS Spine, the Electronic Prescription Service (EPS), summary care records, and potentially a delivery management system. Each one needs documented access controls.

Small teams with high volume. A community pharmacy may have 3-8 staff handling hundreds of prescriptions daily. There's limited time for compliance administration between dispensing, clinical checks, and patient consultations.

Extended hours and locums. Pharmacies operating 12-hour days across 6-7 days rely on locum pharmacists and relief staff. Each locum needs data security awareness and access credentials — but they may work at your pharmacy for a single day.

Controlled drugs and clinical records. Pharmacies handle controlled drug registers, clinical interventions, and Medicines Use Reviews alongside routine dispensing data. The data sensitivity profile is different from a care home.

Evidence requirements for pharmacies

Here's what Category 3 pharmacies typically need for each of the 10 NDG standards under DSPT version 9 (2026-27). Verify against the official portal for your specific assertion list.

Standard 1: Personal confidential data

What you need:

• An information asset register and record of processing activities (item 1.1.2): the systems holding patient data (PMR, NHSmail, EPS, delivery logs), what they hold and who you share it with
• Data protection and cyber security policies that are up to date (item 1.3.1): NHS England's tooltip says policies "should be updated every three years as a minimum"; an annual review is good practice
• The named person or people with overall responsibility for data security and protection, such as the superintendent pharmacist or pharmacy manager (item 1.1.5)

Pharmacy tip: Who can access each system is Standard 4 evidence, covered below. Keep the register focused on what data you hold, where, and who you share it with.

Standard 2: Staff responsibilities

What you need:

• An induction process that covers data security and protection, and cyber security, with completion records (item 2.1.1)
• Employment contracts and volunteer agreements with a data security clause (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality."

Pharmacy tip: Add a data security section to your induction checklist, including for locums, and keep the signed copies. Asking staff to read and sign the data security policy is good practice too.

Standard 3: Training

What you need:

• Training completion records for all staff, including locums
• Training Needs Analysis endorsed by the superintendent pharmacist
• Optional: a short note on whether the training worked (good practice; not a Category 3 evidence item)

Pharmacy tip: The free NHS e-Learning for Healthcare module works well for permanent staff. Locums count towards the 95%: NHS England's e-learning FAQ says item 3.2.1 covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation". Ask locums or their agencies for a current training certificate, and have them sign your data security policy on arrival as good practice.

Standard 4: Managing data access

What you need:

• Access control records for all systems
• Joiner/leaver/mover process for system access
• Evidence of regular access reviews

Pharmacy tip: When a dispenser or pre-reg leaves, remove their PMR access the same day. Screenshot the disabled account as evidence. For locums, decide whether they get temporary individual accounts or supervised access under another user's login — individual accounts are stronger evidence but more administrative work.

Standard 5: Process reviews

What you need:

• A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none
• Optional: an annual review of your data processes, which NHS England's tooltip calls good practice

Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies).

Pharmacy tip: Review all data-related policies together in January — data security, acceptable use, retention, breach notification. Date-stamp each policy when reviewed. One session covering all policies takes 1-2 hours and generates evidence for the full year.

Standard 6: Responding to incidents

What you need:

• Incident reporting procedure
• Staff awareness of how to report data incidents
• Incident log (even if empty)

Pharmacy tip: Common pharmacy data incidents include: misdirected prescription bags (wrong patient), NHSmail sent to wrong address, delivery driver accessing patient names, and lost prescriptions. Your procedure should cover what to do in each case and when to report to the ICO.

Standard 7: Continuity planning

What you need:

• Business continuity plan covering IT failure and cyber attack
• Evidence that the plan is regularly reviewed and tested (item 7.1.2), including a test in the last twelve months (item 7.2.1 asks how you test it and what the outcome was)

Pharmacy tip: Your BCP should answer: if the PMR goes down, can you dispense manually using emergency supply procedures? If NHSmail fails, how do you communicate with GPs? If EPS is unavailable, can you process paper prescriptions? If you suffer ransomware, who do you call? (Your IT provider, and Action Fraud on 0300 123 2040.) A 2-3 page document covering these scenarios is sufficient.

Standard 8: Unsupported systems

What you need:

• IT asset register with OS versions
• Confirmation that no unsupported operating systems are in use

Pharmacy tip: Check the computers running your PMR. Older pharmacies sometimes have Windows 7 or Windows 8 machines that haven't been replaced. These are unsupported: replace them, or record why you are keeping them, the risks and what you are doing to reduce them (items 8.1.4 and 8.2.1). Your PMR supplier may have minimum OS requirements — check with them.

Standard 9: IT protection

What you need:

• Encryption on laptops, tablets and removable devices (item 9.5.2), router and network-device passwords changed from the originals (item 9.1.1), and firewall confirmation (item 9.6.1, not mandatory)
• Related controls the toolkit numbers under other standards: antivirus (Standard 6, item 6.2.1), patching (Standard 8, item 8.3.5) and multi-factor authentication (MFA) for remote access (Standard 4, item 4.5.3)

Pharmacy tip: If your pharmacy has a managed IT provider, ask them for an assurance letter covering all technical controls. If you manage IT yourself, document what's in place: Windows Defender (built-in antivirus), Windows Update (automatic patching), BitLocker (disk encryption), and your router's firewall settings.

Standard 10: Accountable suppliers

What you need:

• Data processing agreements with IT and software suppliers
• Supplier assurance statements

Pharmacy tip: Your key suppliers are your PMR provider, your managed IT company (if any), and any delivery management software. Email each one requesting: (a) their DSPT completion status, and (b) a copy of your data processing agreement.

Working with your PMR supplier

Your PMR supplier is critical for DSPT completion. Several technical questions — about encryption, access controls, audit logging, and data backup — can only be answered with information from your PMR system.

Community Pharmacy England notes that some PMR suppliers have built DSPT integration into their systems. The toolkit's "PMR feature" allows supplier-provided information to be bulk-inserted into your submission, saving significant time.

Before you start the DSPT:

1. Contact your PMR supplier and ask what DSPT support they offer
2. Ask specifically whether they can auto-populate any DSPT responses
3. Request a data processing agreement and a supplier assurance statement
4. Ask for confirmation of encryption, backup, and access control features

Getting this information in February or March avoids a panicked email exchange in June.

Multi-site operators: batch submissions

If you operate three or more pharmacies, you can use the DSPT's batch submission functionality. Instead of completing individual assessments for each branch, you submit a single HQ-level assessment covering common policies and controls, with branch-specific evidence where needed.

Community Pharmacy England provides batch submission guidance including how to set up your HQ-branch structure and ensure all branches are correctly linked via their ODS codes.

Important: Even with batch submission, you need to verify that each branch's ODS code is correctly linked to your organisation in the DSPT portal. Incorrect linkages mean missed submissions.

Timeline for pharmacies

When	Action	Time needed
January	Contact PMR supplier for DSPT support, start staff training	1-2 hours
February	Policy review — update all data security policies	2-3 hours
March	Create IT asset register, request supplier assurance	1-2 hours
April	Complete access control records, chase training completions	2-3 hours
May	Upload evidence to portal, identify gaps	2-3 hours
June	Final review and publish submission	1-2 hours

Total: approximately 10-15 hours over 6 months.

Next steps

• Use the evidence checklist generator for a complete Category 3 checklist
• Read the staff training requirements guide for detailed training evidence guidance
• Take the readiness quiz to identify where your pharmacy has gaps
• Check the deadline calculator for your timeline
• Read the complete DSPT guide for an overview of the current requirements
• Follow the step-by-step completion guide when you're ready to start
• Get your PMR and wholesaler paperwork in order with the DSPT supplier assurance guide

This guide reflects DSPT version 9 (2026-27), the current toolkit, for Category 3 organisations. Always verify current requirements on the official DSPT portal. Community Pharmacy England provides pharmacy-specific guidance. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT guidance for community pharmacies — Community Pharmacy England
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare
• National Data Guardian data security standards — GOV.UK