Understanding the NHS Data Security and Protection Toolkit
You've been told your organisation needs to complete the NHS Data Security and Protection Toolkit. But what is it, exactly? And what happens when you log in for the first time?
This guide explains the toolkit itself — what it is as a system, who's behind it, how it's structured, and what you'll actually see on screen. For a detailed walkthrough of what evidence to gather and how to prepare your submission, see our complete DSPT guide.
What the toolkit is
The Data Security and Protection Toolkit (DSPT) is a web-based self-assessment hosted at dsptoolkit.nhs.uk. It's run by NHS England and measures how well your organisation protects the personal data it handles — specifically patient data connected to NHS systems.
It replaced the old Information Governance Toolkit (IGT) in 2018. If you remember the IGT, the DSPT covers similar ground but is structured around the 10 National Data Guardian (NDG) data security standards rather than the old IG requirements. For a fuller account of what changed when the IG Toolkit became the DSPT, including what you file now that you did not file then, see our dedicated guide.
The toolkit isn't an audit or a certification — at least not for small providers. It's a self-assessment. You answer questions, upload evidence that your security practices work, and publish your results. Your submission status is then visible to commissioners, ICBs, and other NHS organisations you share data with.
Who runs it
The DSPT was originally managed by NHS Digital. In February 2023, NHS Digital merged into NHS England, which now maintains the toolkit. You may still see references to "NHS Digital" in older guidance documents — they point to the same organisation.
The NHS England Digital services page provides an overview, but the toolkit itself lives at dsptoolkit.nhs.uk.
Who needs to complete it
Any organisation that accesses NHS patient data or connects to NHS systems:
- Care homes — residential, nursing, and domiciliary care providers receiving NHS-funded residents or accessing NHSmail
- Community pharmacies — all pharmacies dispensing NHS prescriptions
- GP practices — all practices connected to NHS Spine
- Dental practices and opticians — if accessing NHS patient data
- IT suppliers — companies providing software or services to NHS organisations
The simple test: do you access NHS patient data, NHSmail, or NHS Spine services? If yes, you need to complete the DSPT annually.
How the toolkit categorises you
There are four categories. Your category is not assigned from your Organisation Data Service (ODS) code: when you first log in you choose your organisation's sector in the Organisation Profile, and NHS England says "The organisation type determines which Category of toolkit is to be completed."
| Category | Typical organisations | What's required |
|---|---|---|
| 1 | NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and OES independent providers | CAF-aligned assessment + independent audit |
| 2 | Large suppliers (50+ staff, £10m+ turnover) | Extended assessment + independent audit |
| 3 | Care homes, pharmacies, dentists, opticians | Core assessment — no audit required |
| 4 | GP practices | Core assessment — a smaller mandatory set |
Most readers of this guide are Category 3 or Category 4. The key difference is size: in NHS England's version 9 workbook Category 4 has 49 evidence items, 29 of them mandatory, against Category 3's 80 and 45. All but two Category 4 items (6.3.5 on repeat incidents and 8.3.1 on software updates) are also Category 3 items.
Neither Category 3 nor Category 4 requires an independent audit. You self-assess, upload evidence, and publish.
What you see when you log in
When you first log in to the portal, you'll see a dashboard showing:
- Your category and the specific assertions that apply to your organisation
- Progress tracker — which evidence items you've completed, started, or not yet addressed
- Evidence upload areas — where you attach documents, screenshots, or confirmation statements for each item
- Publication status — whether your submission is draft, published, or overdue
The assessment is divided into the 10 NDG standards: personal confidential data, staff responsibilities, training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection, and accountable suppliers.
Each standard contains specific assertions — statements about what your organisation should be doing. Each assertion requires one or more evidence items to prove you're actually doing it. For Category 3, NHS England's v8 2025/26 and v9 2026-27 workbooks both mark 45 evidence items as mandatory across the 10 standards (29 for Category 4, GP practices) — and NHS England states that "the number of mandatory questions are determined by your organisation type", so work from the list your own toolkit shows you.
The current version: DSPT v9 (2026-27)
NHS England's release notes record that "The 2026-27 (version 9) DSPT has been released" on 1 September 2026. Its outcomes, assertions and evidence items were published on 2 October 2026, and its deadline is 30 June 2027. NHS England says "DSPT Version 9 is aligned to CAF version 4.0", but for Category 3 and 4 organisations the NCSC Cyber Assessment Framework (CAF) sits in the background: only Category 1 organisations, such as NHS Trusts and ICBs, see a CAF-aligned view. If the CAF is unfamiliar, our Cyber Assessment Framework explained guide covers what it is and where it fits for small providers.
Three things to know about v9:
The mandatory items have not changed. NHS England's version 9 workbook marks the same 45 items mandatory for Category 3, and the same 29 for Category 4, as version 8 (2025/26).
Four optional items are new. 1.3.15 (devices taken outside the UK), 7.1.7 (testing your business continuity plan), 10.2.6 (non-IT suppliers' access) and 10.2.7 (processing outside the UK). None is mandatory.
The structure is the same. The 36 assertions under the ten standards are unchanged from version 8, which in turn kept them unchanged from version 7. Where an item asks about a policy or process, the strongest evidence shows both the document and that it is in use — for example, staff acknowledgements of your data security policy.
The version 9 announcement links to the downloadable workbook showing the exact assertions and evidence items for each category.
Three compliance levels
For Category 3 and 4 organisations, your published submission is assessed at one of three levels (NHS England also uses a "Standards Not Met" status, which larger organisation types can publish with an improvement plan):
- Approaching Standards — a much smaller subset than the mandatory set, and a fallback rather than a tier below it: NHS England’s version 9 workbook flags 26 items as “Approaching standards mandatory”, the same set as version 8. NHS England’s guidance says “Social Care organisations are eligible to complete a one-off ‘Approaching Standards’ assessment” — it does not name pharmacies, dentists or GP practices. Publishing here obliges an improvement plan and reads to a commissioner as not yet compliant.
- Standards Met — you have completed the evidence items marked mandatory for your organisation type. NHS England: “complete a ‘Standards Met’ assessment by responding to all the questions within the assessment which are indicated as being MANDATORY” (45 items for Category 3 in the version 9 (2026-27) workbook, as in version 8). This is the normal target, not the stretch one.
- Standards Exceeded — for most organisations, you've gone beyond Standards Met and hold Cyber Essentials Plus recorded in your Organisation Profile. NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and independent providers designated as OES reach it a different way, by meeting the achievement levels forecast for the following year.
Plan for "Standards Met" by the 30 June deadline. If you are a social care provider and cannot finish the mandatory set in time, you are eligible for a one-off "Approaching Standards" assessment — publish there with an action plan rather than miss the deadline, then work toward "Standards Met"; the toolkit stays open for updates throughout the year.
What happens if you miss the deadline
The submission deadline is 30 June every year — NHS England's guidance is explicit that "you must however ensure that your organisation has published at least one assessment by the deadline of 30 June every year". It is a standing annual date, not a one-off. Missing it puts access to national systems at risk: NHS England says completion "is also necessary for organisations which use national systems such as NHSmail and the e-referral service", and NHS England Digital's HSCN connection guidance says a DSPT assessment is required to access national applications such as the NHS e-Referral Service, the Personal Demographics Service and the Secondary Uses Service.
For a care home, losing NHSmail would disrupt communication with GPs and hospitals.
If you're at risk of missing the deadline, contact NHS England before 30 June to discuss your options. Check the DSPT help pages for current support routes available to your organisation category.
Next steps
- Register or log in at dsptoolkit.nhs.uk — confirm your category
- Check your readiness — take the DSPT readiness quiz to see where you stand
- Get your evidence list — use the evidence checklist generator to see exactly what you need for your category
- Plan your timeline — the deadline calculator shows how many working days remain
- Start the process — follow our step-by-step DSPT completion guide
This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.
Sources
- DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
- DSPT system changes and release notes — NHS England
- Organisation types — NHS England
- DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
- Data Security and Protection Toolkit — NHS England
- Data Security and Protection Toolkit service page — NHS England Digital
- DSPT 2025-26 version 8 — NHS England
- National Data Guardian data security standards — GOV.UK
- Cyber Assessment Framework — NCSC