DSPT Staff Training Requirements: What Counts as Evidence

Standard 3 of the DSPT — staff training — is the evidence item that catches more small providers out than any other. It's also the one most often described wrongly. You will read that the "95% of staff must complete training" rule is gone — that is true for NHS trusts and ICBs, and not for you.

This guide explains exactly what training evidence you need for DSPT version 9 (2026-27), what's changed, and how to handle the practical challenges that care homes, pharmacies, and GP practices face — high turnover, agency staff, mixed IT literacy, and limited training budgets.

What changed in 2023: the rules for Category one, not the 95% threshold for you

It is widely repeated that the 95% rule was scrapped in 2023. For your organisation it was not. NHS England's own version 9 (2026-27) evidence-item workbook, like version 8 before it, still carries evidence item 3.2.1 — “Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?” — and marks it “Required to meet standard (mandatory)” for both Category 3 (care homes, pharmacies, dentists, opticians) and Category 4 (GP practices).

What changed in 2023 was the Category one regime. The training source was never fixed: NHS England's guidance says the earlier rule was to train at least 95% of staff using the national Data Security Awareness Level 1 e-learning "or a local equivalent". And NHS England's announcement of the 2023 change says in terms who it applies to — “NHS Trusts, ALBs, CSUs, Key IT Suppliers, Independent sector OES organisations and ICBs that are all classed as Category one organisations”. If you are a care home or a GP practice, you are not Category one, and the 95% threshold is still a mandatory item you can fail on.

For Category one organisations the replacement is broader: they must demonstrate that all staff have an "appropriate understanding of information governance and cyber security" through training methods proportionate to their size and the roles people hold. NHS England's guidance breaks that into three parts: a training needs analysis, delivery of training and awareness activities, and evaluation.

For a Category 3 organisation the evidence items cover two things:

Training Needs Analysis (TNA) — item 3.1.1, a formal assessment of what different roles need to know, completed in the last twelve months
Delivery — item 3.2.1, at least 95% of staff trained in the last twelve months

Evaluation is not a Category 3 or 4 evidence item, but it is worth doing — see below.

The Training Needs Analysis (TNA)

The TNA is the requirement most small providers haven't heard of, although it is not new: item 3.1.1 was already mandatory for Category 3 in NHS England's 2022-23 (version 5) workbook. It's a document — it doesn't need to be long — that sets out:

Which roles exist in your organisation (registered manager, senior carer, care assistant, administrator, domestic staff, agency/bank staff)
What each role needs to know about data security, based on the data they access and the systems they use
What training will be provided to each role and how often

A registered nurse who accesses clinical records, NHSmail, and electronic MAR charts needs different training from a domestic staff member who never touches a computer. The TNA makes this distinction explicit.

The critical part: For Category 3, NHS England's tooltip for item 3.1.1 says the TNA "should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation" — for a care home, usually the registered manager or nominated individual. Item 3.1.1 is a Category 3 item: GP practices in Category 4 are not asked for it, though a TNA approved by the senior partner or practice manager still helps. The DSPT looks for evidence that the training approach has been reviewed or approved, not just that training happened.

What a small provider TNA looks like

You don't need a 20-page document. A 1-2 page table works:

Role	Data access	Systems used	Training required	Frequency
Registered manager	Full resident data, staffing, financial	Care planning, NHSmail, DSPT portal	Full data security + DSPT awareness	Annual
Senior carer	Resident care plans, MAR charts	Care planning software	Data security awareness, confidentiality	Annual
Care assistant	Resident care plans (read)	Care planning software (limited)	Data security basics, incident reporting	Annual
Admin/receptionist	Resident demographics, billing	Office systems, email	Data security awareness, email security	Annual
Domestic/catering	No data access	None	Confidentiality awareness only	Annual
Agency/bank staff	As per assigned role	As per assigned role	Data security awareness training (they count towards the 95%)	Each assignment

Add a signature block at the bottom: "Approved by [name], [role], [date]." That's your endorsed TNA.

Training delivery: what counts as evidence

The DSPT does not prescribe a single training format. You can use:

Formal e-learning — the free NHS e-Learning for Healthcare data security module generates certificates automatically. This is the easiest option for most staff. See Data Security Awareness Level 1 explained.
Face-to-face sessions — group training sessions with attendance records and topic summaries
Supervised group e-learning — for staff who struggle with independent online learning, run the e-learning module on a projector with a group and record individual attendance
Induction training — data security awareness as part of new starter induction, with signed acknowledgement
Informal awareness — newsletters, team meeting briefings, poster campaigns (supplementary — not a replacement for formal training)

What evidence to keep:

Individual training certificates or completion confirmations with dates and names
Attendance registers for face-to-face sessions (date, topic, attendees, facilitator)
Signed policy acknowledgements from induction
A training log or spreadsheet tracking completion by staff member

The training log is your primary evidence document. It should show: staff name, role, training type completed, date completed, and next due date. Update it in real time — don't try to reconstruct it in May.

Handling the hard cases

High staff turnover

A care home with 30 staff and 30% annual turnover has roughly 10 starters and leavers per year. Each new starter needs training before the DSPT deadline, and each leaver needs removing from your records.

Approach: Build data security training into your induction process so it happens in the first week, not three months later. Keep your training log as a live document — update it on the day someone starts or leaves.

Agency and bank staff

Agency staff handling resident data count towards the 95% for item 3.2.1. NHS England's e-learning FAQ says the figure covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation", so agency workers need training, not just a policy signature. Two ways to cover it:

Request certificates from the agency — ask your agency for proof that each worker has completed data security training in the last twelve months. Some agencies include this in their mandatory training; many don't.
Include them in your own training — add agency workers to your group sessions, or send them the e-learning.

On top of training, asking every agency worker to read and sign your data security policy on their first shift is good practice. Keep the signed forms on file.

Staff who can't do online training

Not every member of staff is comfortable with e-learning. For care homes, this often includes older care assistants, domestic staff, and night shift workers.

Approach: Run supervised group sessions. Display the NHS e-Learning for Healthcare module on a projector or large screen. Work through it together. Record individual attendance with signatures. This satisfies the DSPT requirement and is often more effective than leaving people to struggle through it alone.

Part-time and zero-hours staff

Part-time staff and zero-hours workers still need training. The easiest approach is to include them in your next scheduled group session. If timing is difficult, the NHS e-learning module can be completed on any device with internet access — send the link and set a deadline.

Training evaluation: worth doing

NHS England's training guidance says "You will need to evaluate the effectiveness of your approach", but that guidance is written for Category one organisations. The version 9 evidence items for Category 3 and 4 do not include a separate evaluation item. A short evaluation is still worth doing: it shows your training is working and gives you something to point to when you review your Training Needs Analysis.

For small providers, this doesn't need to be sophisticated:

Post-training quiz — 5-10 questions after completing the e-learning module. The NHS e-Learning for Healthcare module includes a built-in assessment.
Spot checks — during team meetings, ask a quick data security question: "What would you do if you found a USB drive in the car park?" Document the question and responses.
Incident tracking — if data security incidents decrease after training, that's evidence the training worked. If you've had zero incidents, note that in your evaluation.

Write a short evaluation statement: "Training evaluation for 2026-27: 28/30 staff completed the NHS e-learning module with pass scores. Two new starters completed during induction. Zero data security incidents reported since training. Evaluation: training objectives met." Date it, sign it, keep it on file.

Timeline for getting training evidence ready

When	Action	Time needed
January	Send e-learning links to all staff, start tracking	1 hour
February	First chase — follow up with non-completions	30 mins
March	Group session for staff who haven't completed online	2 hours
April	Second chase — agency staff certificates	30 mins
May	Final push — complete the training log, write the (optional) evaluation	1-2 hours
June	Upload evidence to DSPT portal	30 mins

Starting in January gives you 6 months — enough time to reach everyone without it consuming every spare hour.

Evidence checklist for Standard 3

Before submitting your DSPT, verify you have:

TNA reviewed or approved in the last twelve months by the person with overall responsibility for data security (Category 3, item 3.1.1)
Training certificates or completion records for every staff member
Training log showing names, roles, dates, and training types
Agency/bank staff training certificates or completion records (NHS England's e-learning FAQ counts locums and temporary staff in the 95%)
Optional: a short training evaluation statement (good practice, not a Category 3 or 4 evidence item)
Evidence that training is included in induction process

For a complete list of evidence items across all 10 standards, use the evidence checklist generator — select your category and get the full breakdown.

Next steps

Generate your full evidence checklist to see what's needed beyond training
Read the DSPT guide for care homes for care-home-specific training context
Read the complete DSPT guide for an overview of all 10 standards
Check the deadline calculator to plan your training timeline
Take the readiness quiz to identify other gaps in your submission
See what the record itself has to show in our DSPT staff training records guide

This guide reflects DSPT version 9 (2026-27), the current toolkit, and the training requirements published by NHS England. The official training guidance provides the definitive requirements. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.