DSPT Staff Training Records: Meeting Standard 3 in v9

Standard 3 of the DSPT — Staff Training — changed in 2023/24, but only for Category one organisations, which lost the 95% figure and gained an "appropriate understanding" test. For Category 3 providers (care homes, pharmacies, dentists, opticians) and Category 4 (GP practices) — this site's audience — nothing was lost: the 95% completion threshold is unchanged in DSPT version 9 (2026-27), as it was in version 8. Category 3 providers also need a documented Training Needs Analysis on top of it, an item that was already mandatory in the 2022-23 workbook. That's two things to evidence, not one.

Understanding exactly what changed, and for whom, is essential for satisfying Standard 3 in version 9.

What changed in 2023/24 — and for whom

Before 2023/24, the training rule for every category was the one NHS England's guidance quotes below: at least 95% of staff trained using the national module "or a local equivalent". Many providers used the NHS e-Learning for Healthcare (e-LfH) module because it produces a ready-made completion report.

The DSPT training guidance page announces a real change:

"Until July 2023, the DSPT required that you train at least 95% of your staff using the national Data Security Awareness Level 1 e-learning or a local equivalent. This has changed for 2023/24."

But the same page scopes that change: "These changes apply to NHS Trusts, ALBs, CSUs, Key IT Suppliers, Independent sector OES organisations and ICBs that are all classed as Category one organisations for the DSP Toolkit." Care homes, pharmacies and dentists are Category 3. GP practices are Category 4. Neither is Category one — so this change does not apply to them.

For Category 3 and 4, NHS England's version 9 (2026-27) evidence-item workbook settles it, as the version 8 workbook did: item 3.2.1 — "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" — is marked "Required to meet standard (mandatory)" for both categories. The 95% figure was never withdrawn for this site's audience.

What Category 3 also needs is item 3.1.1: a documented Training Needs Analysis, reviewed or approved in the last 12 months by whoever holds overall responsibility for data security in your organisation. So Standard 3 for care homes, pharmacies, and dentists asks for two things, not one:

1. A Training Needs Analysis (TNA) — reviewed or approved by the person with overall responsibility for data security — identifying what training each staff group needs
2. 95% of staff, directors, trustees and volunteers completing that training within the last 12 months, evidenced by a completion report

The e-learning module from NHS e-LfH is still valid, still free, and still widely used — and it remains the simplest way to produce the completion report the 95% figure needs. It has never been the only acceptable training source — NHS England's pre-2023 rule already allowed "a local equivalent" — and whichever training you use, the 95% completion figure is still required. For more on which training course counts, see our guide to the national module.

The Training Needs Analysis

A TNA for data security doesn't need to be elaborate. For a small provider, a one-page document grouping your staff into 2-4 roles, describing the data security training appropriate for each, is sufficient.

Example structure for a 20-person care home:

Role group	Examples	Data access	Training required
Care workers	Senior carers, carers	Care planning software, resident records	Data Security Awareness Level 1 (annual), plus mobile device policy briefing
Administrative staff	Office manager, receptionist	Care planning software, NHSmail, financial records	Data Security Awareness Level 1 (annual), plus information sharing protocol
Managers	Registered manager, deputy manager	Full system access, admin rights	Data Security Awareness Level 1 (annual), plus incident reporting procedure, plus DPA overview
Agency and bank workers	Temporary carers	Care planning software (limited access)	Data Security Awareness Level 1 (annual) before first shift with patient access

For Category 3, NHS England's tooltip for item 3.1.1 says the TNA "should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation". In a small provider that is usually the registered manager. Sign and date it. It forms the documented basis for your training programme.

Delivery: what counts and what records you need

NHS e-Learning for Healthcare (e-LfH) module. Still the most common approach. The Data Security Awareness Level 1 module at portal.e-lfh.org.uk is free, is split into four modules of around 20 minutes each plus a welcome module, according to NHS England's e-learning FAQ, and covers the core IG and cyber security topics. To use this as evidence, you need a completion report from the e-LfH platform showing names, dates, and pass/fail status. Individual completion certificates printed per-person also work.

Commercial e-learning platforms. Platforms like iHASCO, Skills for Care, or Birdie (for care providers) offer data security awareness modules. If you use one of these, your completion report serves as evidence. The module should cover information governance, data security, cyber security basics, and incident reporting.

In-house training. A face-to-face or online training session delivered internally counts — but the records need to show content, attendance, and evaluation. "We covered data security in our staff meeting" without a note of what was covered, who attended, and whether understanding was assessed is weak evidence.

Blended approach. Many providers use the e-LfH module for the core content and supplement with team briefings, induction sessions, or incident-specific awareness updates. This is valid — record each element separately.

Evaluation: optional, but worth doing

Evaluation isn't a separately-listed evidence item — but it strengthens both the TNA and your completion figure. A TNA that's never checked for effectiveness, or a 95% completion figure with no evidence training actually worked, is weaker than it needs to be. For small providers, this doesn't mean formal assessments. It means:

• A brief survey or verbal check. Did staff understand the key messages? Were there any questions that suggested misunderstanding?
• Pass rates from e-learning. The e-LfH module includes a quiz. A completion report with pass rates is evaluation evidence.
• An attendance check. If you run a training session, confirming all required staff attended and asking a few checking questions at the end counts.
• Incident log correlation. If staff are reporting data security incidents (Standard 6), that's evidence that training on incident recognition and reporting is working.

Your evaluation doesn't need to be formal. A dated note recording "Training delivered to all 18 staff, all passed the e-LfH module, no questions raised about the policy acknowledgement section" is sufficient.

Annual completion tracking

The DSPT requires training records that demonstrate all current staff have completed training within the last 12 months. Common tracking approaches:

• Spreadsheet. Name, role, training date, module/session name, pass/fail (if applicable). Update when new staff join and when annual refreshers are due.
• e-LfH admin dashboard. If your whole team uses the e-LfH portal, your organisation admin can run completion reports directly from the platform.
• Commercial platform dashboard. Most commercial e-learning providers offer admin dashboards with completion tracking.

The key is that you can produce a report showing every current staff member's training status. Leavers don't need to appear; joiners who haven't yet completed training should be flagged.

Common gaps before submission

TNA not documented. Item 3.1.1 explicitly needs a TNA. If you've been running training against the 95% model without a TNA, write one now — even retrospectively confirming your current training approach meets role-based needs.

Completion report from more than 12 months ago. Training records need to show completion within the current 12-month assessment period. NHS England's tooltip for 3.2.1 says "it is the last twelve months prior to the date of publication", so training completed in November 2025 no longer counts for a version 9 assessment published after November 2026. Chase renewals.

Agency and bank staff not tracked. Workers who cover infrequently are the most common gap. Establish a check at onboarding: training must be complete before first access to patient systems.

Records show training was assigned but not completed. A training platform record showing a module was assigned and opened but not completed isn't a completion record. Chase outstanding completions.

No record of checking that training worked. This is not a separate Category 3 or 4 evidence item, but a brief note showing you checked understanding (for example, quiz pass rates) supports your Training Needs Analysis.

Use the DSPT evidence checklist generator to track Standard 3 items alongside your full submission. For the complete list of evidence requirements across all 10 standards, see our DSPT evidence requirements guide.

This guide reflects DSPT version 9 (2026-27), the current toolkit, and the training change guidance published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT staff training change guidance — NHS England
• DSPT version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 — NHS England
• DSPT v8 (2025-26) evidence-item requirements workbook — NHS England (sheet "25-26 requirements", row 34, evidence ref 3.2.1 — settles the Category 3/4 mandatory status of the 95% figure)
• Data security awareness e-learning — NHS e-Learning for Healthcare
• National Data Guardian data security standards — GOV.UK