Understanding the NHS Data Security and Protection Toolkit
You've been told your organisation needs to complete the NHS Data Security and Protection Toolkit. But what is it, exactly? And what happens when you log in for the first time?
This guide explains the toolkit itself — what it is as a system, who's behind it, how it's structured, and what you'll actually see on screen. For a detailed walkthrough of what evidence to gather and how to prepare your submission, see our complete DSPT guide.
What the toolkit is
The Data Security and Protection Toolkit (DSPT) is a web-based self-assessment hosted at dsptoolkit.nhs.uk. It's run by NHS England and measures how well your organisation protects the personal data it handles — specifically patient data connected to NHS systems.
It replaced the old Information Governance Toolkit (IGT) in 2018. If you remember the IGT, the DSPT covers similar ground but is structured around the 10 National Data Guardian (NDG) data security standards rather than the old IG requirements.
The toolkit isn't an audit or a certification — at least not for small providers. It's a self-assessment. You answer questions, upload evidence that your security practices work, and publish your results. Your submission status is then visible to commissioners, ICBs, and other NHS organisations you share data with.
Who runs it
The DSPT was originally managed by NHS Digital. In February 2023, NHS Digital merged into NHS England, which now maintains the toolkit. You may still see references to "NHS Digital" in older guidance documents — they point to the same organisation.
The NHS England Digital services page provides an overview, but the toolkit itself lives at dsptoolkit.nhs.uk.
Who needs to complete it
Any organisation that accesses NHS patient data or connects to NHS systems:
- Care homes — residential, nursing, and domiciliary care providers receiving NHS-funded residents or accessing NHSmail
- Community pharmacies — all pharmacies dispensing NHS prescriptions
- GP practices — all practices connected to NHS Spine
- Dental practices and opticians — if accessing NHS patient data
- IT suppliers — companies providing software or services to NHS organisations
The simple test: do you access NHS patient data, NHSmail, or NHS Spine services? If yes, you need to complete the DSPT annually.
How the toolkit categorises you
When you register on the portal using your Organisation Data Service (ODS) code, the toolkit assigns you to one of four categories:
| Category | Typical organisations | What's required |
|---|---|---|
| 1 | Large NHS trusts, ALBs | Full CAF assessment + independent audit |
| 2 | IT suppliers, larger NHS bodies | Extended assessment + independent audit |
| 3 | Care homes, pharmacies, dentists, opticians | Core assessment — no audit required |
| 4 | GP practices | Tailored GP-specific assessment |
Most readers of this guide are Category 3 or Category 4. The key difference: Category 3 has a general set of assertions covering all 10 NDG standards, while Category 4 includes GP-specific items around clinical system access and NHS Spine usage.
Neither Category 3 nor Category 4 requires an independent audit. You self-assess, upload evidence, and publish.
What you see when you log in
When you first log in to the portal, you'll see a dashboard showing:
- Your category and the specific assertions that apply to your organisation
- Progress tracker — which evidence items you've completed, started, or not yet addressed
- Evidence upload areas — where you attach documents, screenshots, or confirmation statements for each item
- Publication status — whether your submission is draft, published, or overdue
The assessment is divided into the 10 NDG standards: personal confidential data, staff responsibilities, training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection, and accountable suppliers.
Each standard contains specific assertions — statements about what your organisation should be doing. Each assertion requires one or more evidence items to prove you're actually doing it. For Category 3, the mandatory evidence items across all 10 standards are commonly cited as around 42 — though NHS England states that "the number of mandatory questions are determined by your organisation type", so work from the list your own toolkit shows you.
The current version: DSPT v8 (2025/26)
DSPT v8 opened for submissions on 18 September 2025. This version is fully aligned with the NCSC Cyber Assessment Framework (CAF), which is a significant structural change from earlier versions. If the CAF is unfamiliar, our Cyber Assessment Framework explained guide covers what it is and why a national cyber security framework now shapes the DSPT for small providers.
Three things to know about v8:
Evidence doesn't carry forward from v7. You'll need to re-upload or re-confirm evidence items. Even if your policies haven't changed, you need to confirm them in the new structure.
The format has changed. v8 uses Outcomes, Assertions, and Evidence items rather than the old question format. The workload for Category 3 is broadly similar to previous years, but the layout is different — expect to spend time finding where things are.
Evidence must be outcome-based. "We have a data security policy" isn't sufficient. You need to show the policy exists AND that staff have read and acknowledged it. The shift is from "do you have this?" to "does this actually work?"
The official v8 announcement has downloadable spreadsheets showing the exact assertions and evidence items for each category.
Three compliance levels
Your published submission is assessed at one of three levels:
- Approaching Standards — a much smaller subset than the mandatory set, and a fallback rather than a tier below it: the v8 workbook flags only four items as “Approaching standards mandatory”. Publishing here obliges an improvement plan and reads to a commissioner as not yet compliant.
- Standards Met — you have completed the evidence items marked mandatory for your organisation type. NHS England: “complete a ‘Standards Met’ assessment by responding to all the questions within the assessment which are indicated as being MANDATORY” (45 items for Category 3 in the v8 2025/26 workbook). This is the normal target, not the stretch one.
- Standards Met — you've completed all assertions, including non-mandatory ones, with full evidence.
- Standards Exceeded — for most organisations, you've gone beyond Standards Met and hold Cyber Essentials Plus recorded in your Organisation Profile. NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and independent providers designated as OES reach it a different way, by meeting the achievement levels forecast for the following year.
Corrected on 2026-09-02: this section previously stated there are two compliance levels. There are three, per Digital Care Hub's published guidance, re-verified independently against digitalcarehub.co.uk/dspt/check-dspt-status/.
If this is your first time with v8, aim for "Approaching Standards" by the 30 June deadline. You can work toward "Standards Met" afterward — the toolkit stays open for updates throughout the year.
What happens if you miss the deadline
The submission deadline is 30 June every year — NHS England's guidance is explicit that "you must however ensure that your organisation has published at least one assessment by the deadline of 30 June every year". It is a standing annual date, not a one-off. Missing it has operational consequences — non-compliant organisations can lose access to NHSmail, NHS Spine, the Electronic Prescription Service, and data sharing agreements with ICBs.
For a pharmacy, losing EPS access halts NHS dispensing. For a care home, it disrupts medication management and hospital discharge communications.
If you're at risk of missing the deadline, contact NHS England before 30 June to discuss your options. Check the DSPT help pages for current support routes available to your organisation category.
Next steps
- Register or log in at dsptoolkit.nhs.uk — confirm your category
- Check your readiness — take the DSPT readiness quiz to see where you stand
- Get your evidence list — use the evidence checklist generator to see exactly what you need for your category
- Plan your timeline — the deadline calculator shows how many working days remain
- Start the process — follow our step-by-step DSPT completion guide
This guide is based on DSPT v8 (2025/26) requirements. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.