Two things are true at once. Cyber Essentials does not replace the DSPT, and the formal audit exemption does not reach Category 3 or 4 organisations. Two smaller benefits do reach them — Cyber Essentials Plus exempts a handful of evidence items, and it is what turns a Standards Met submission into Standards Exceeded — and both are covered below. But the work of getting certified overlaps substantially with the technical half of the DSPT, so if you are going to do it anyway, it makes several evidence items easier.

What each one is

The DSPT is the NHS assurance mechanism. It covers information governance and cyber security together, structured around the ten National Data Guardian standards, and it is what NHS England requires of organisations holding NHS patient data.

Cyber Essentials is, per the NCSC, "the minimum standard of cyber security recommended by the Government for organisations of all sizes." It is a certification against five technical controls, with no information governance component. It is administered by IASME — "the NCSC's official Cyber Essentials Delivery Partner", which "manages our network of 400+ cyber security organisations across the UK".

Two levels exist. The NCSC describes the base scheme as "a combination of self-assessment and independent audit", priced "according to the size of your organisation, starting at £320 +VAT". Cyber Essentials Plus is "the same protections, but with more rigorous, independent technical testing", priced "according to the size and complexity of your network".

The audit exemption, and why it probably is not yours

There is a genuine DSPT exemption tied to certification, and it is worth understanding precisely because it gets quoted loosely.

NHS England's 2024-25 audit guidance states: "Evidence items which are covered by an exemption for CE+ and/or ISO27001 will not require further auditing, once it is confirmed that the scope of the certification covers all the health and care data being processed."

Read what it actually removes: further auditing. It narrows what an independent auditor has to test. That is valuable to organisations whose audit covers evidence items. For 2026-27 that means IT Suppliers, who are audited against a list of 12 assertions; NHS England's 2026-27 audit notice audits NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics organisations on CAF outcomes instead.

Care homes, domiciliary care agencies, community pharmacies, dental practices, opticians and GP practices are not in those groups and have no DSPT audit. There is nothing for the audit exemption to reduce. Our guide on who actually needs a DSPT audit covers the scope in full.

The item exemption that does reach Category 3 and 4

Separately from audit, NHS England's FAQ says: "Where organisations do hold Cyber Essentials PLUS they do not have to respond to some toolkit questions, as these will be exempt, but Cyber Essentials PLUS certification is not mandatory."

NHS England's version 9 workbook has an "Exempt for Cyber Essentials PLUS" column. For Category 3 it marks six items: 4.2.4 (removing leavers' access), 6.2.1 (antivirus), 9.1.1 (changing default passwords on network kit), 9.2.1 and 9.2.3 (penetration testing) and 9.6.1 (firewalls). The first three are mandatory. For Category 4 it marks four: 4.2.4, 6.2.1, 9.1.1 and 9.2.1.

The exemption works through your Organisation Profile. NHS England's overview says: "If your organisation has a Cyber Essentials PLUS certification covering all of your health and care data processing, you can record this in the Organisation Profile". Six items out of 80 is a modest saving, not a shortcut.

The benefit that does reach Category 3 and 4: Standards Exceeded

The audit exemption is not the only thing Cyber Essentials Plus does inside the DSPT, and this is the part most often left out.

NHS England's overview states: "For all other organisations, if an organisation achieves 'Standards Met' and also has a current Cyber Essentials PLUS certification recorded in its Organisation Profile, then it's status will be displayed as 'Standards Exceeded'." The same guidance explains how: "If your organisation has a Cyber Essentials PLUS certification covering all of your health and care data processing, you can record this in the Organisation Profile."

Digital Care Hub puts it the same way for adult social care: "Standards Exceeded indicates that you have gone beyond required standards and have Cyber Essentials Plus in place."

So for a Category 3 or 4 provider, CE Plus is the route — and, on NHS England's wording, the only route — to the highest published DSPT status. Note the conditions: it has to be Plus, not base Cyber Essentials; you have to already be at Standards Met; the scope has to cover all your health and care data processing; and you have to actually record it in your Organisation Profile, since nothing picks it up automatically.

Whether that is worth the money is a commercial question rather than a compliance one. Your published status is visible to commissioners, CQC inspectors and families — see our guide to checking a DSPT status — so the value depends on how much that visibility is worth to you.

Note also the condition attached: the certification scope has to cover all the health and care data being processed. A certificate scoped to one office or one system does not carry across an estate.

Where the five controls do overlap

Certification is not useless to a Category 3 provider — it is just not a shortcut. Here is the honest map:

That covers four of the ten standards — 4, 6, 8 and 9 — and only partially. It touches none of Standards 1, 2, 3, 5, 7 or 10 — personal confidential data, staff responsibilities, training, process reviews, continuity planning or supplier assurance. Standard 6 is the narrowest of the four: malware protection is direct evidence for assertion 6.2, but the rest of Standard 6 (which NHS England Digital's assessment guides summarise as "Cyber-attacks against services must be identified and resisted, and CareCERT security advice responded to") is incident detection and response work that certification does not touch. For a small provider the untouched standards are the bulk of the work, as our evidence requirements guide sets out.

The genuinely useful side effect is the preparation. Working through the Cyber Essentials question set forces you to establish what devices you have, what state they are in, who has administrator access and whether everything is patched — which is most of the Standard 8 unsupported-systems inventory and much of the access control register. If you were going to build those anyway, doing them once for both is efficient.

When it is worth the money

Worth it:

• A commissioner or NHS customer has made it a contract condition. This is the most common genuine reason, and it is a contractual question rather than a DSPT one.
• You supply digital goods or services to the NHS. If you are in the IT Supplier population you may be in audit scope, and then the exemption is real money.
• Your technical position is genuinely weak and you want an external forcing function. Certification imposes a deadline and an assessor. Some organisations need that more than they need another document.
• You already hold it. Then use it. Reference the certificate in your Standard 6 and Standard 9 evidence, keep the scope statement with it, and — if it is Cyber Essentials Plus and you are at Standards Met — record it in your Organisation Profile so your published status shows Standards Exceeded.
• You are at Standards Met and want Standards Exceeded. CE Plus is what NHS England requires for that status. Base Cyber Essentials will not do it.

Probably not worth it, if the only reason is the DSPT:

• You are Category 3 or 4 with no contractual requirement, you are not chasing Standards Exceeded, and the money would otherwise go on the things the DSPT actually asks about — training coverage, checking your IT suppliers' certifications, replacing an end-of-support machine.
• Your DSPT gaps are in the information governance half, which is the usual case. Certification will not move any of them.

Before spending anything, find out where your gaps actually are. Our readiness quiz covers seven of the ten standards and shows you which of those you are short on; if the answer is Standards 3, 7 and 10, Cyber Essentials is not the purchase to make. The evidence checklist generator lists every mandatory evidence item for your category.

If you do certify

1. Get the scope right. The DSPT exemption wording turns on covering all health and care data, and a narrow scope is the standard way certification stops being useful.
2. Keep the certificate and the scope statement together. The certificate alone does not tell a reader what it covered.
3. Reference it in your DSPT evidence rather than assuming it is visible. Nobody cross-references certifications for you.
4. Diary the renewal. An expired certificate in a DSPT evidence folder is worse than none, because it looks like a control you think you have.

For the full picture of what the DSPT asks of a small provider, see our complete DSPT guide, and for where CAF fits alongside all this, our DSPT CAF alignment guide.

This guide is based on the NCSC's published Cyber Essentials guidance, NHS England's published DSPT audit guidance and its version 9 (2026-27) workbook, checked on 5 November 2026. Certification pricing is set by IASME and its certification bodies and can change — confirm current costs before budgeting. Always verify current DSPT requirements on the official DSPT portal. This is not legal, compliance or procurement advice.

Sources

• Cyber Essentials overview — NCSC
• DSPT Independent Assurance and Audit — NHS England
• DSPT Audit 26-27: Areas of Mandatory Audit (1 October 2026) — NHS England
• DSPT frequently asked questions (Cyber Essentials PLUS exemption) — NHS England
• DSPT organisation types and categories — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 ("Exempt for Cyber Essentials PLUS" column) — NHS England
• DSPT overview — NHS England
• Check a DSPT status — Digital Care Hub
• DSPT assessment guides (the ten standards) — NHS England

NHS England publishes Standard 8 in two wordings, and it is worth knowing both before you judge how hard the bar is.

Its guide-8 chapter page (last edited 8 October 2025) states it as: "No unsupported operating systems, software or internet browsers are used within the IT estate." Its assessment-guides index page (last edited 8 April 2026, so the newer of the two) states the same standard as: "No unsupported operating systems, software or internet browsers should be used within the IT estate."

One reads as a flat statement of the required end state; the other as an expectation. We are not going to pick whichever suits the argument — NHS England has published both, and you should know that if someone quotes one at you. Either way the target is none, and what you are actually assessed on is the assertions below.

What people miss is the layer underneath. NHS England's own assessment guide for Standard 8 says there is "a clear recognition that not all unsupported systems can be upgraded, and that financial and other constraints should drive intelligent discussion around priorities" — "it's about demonstrating that analysis has been done and informed decisions were made."

That is what you are assessed on. The assertion you actually answer is: "Unsupported software and hardware is categorised and documented, and data security risks are identified and managed."

So both things are true at once, and you need to hold both. The standard's target is none. The evidence you submit is that you know what you have, have recorded it, and are managing the risk of anything you have not removed yet. A documented, risk-assessed, isolated machine with a replacement date is a defensible position against a target you have not met. An undocumented one is not — even if it is the only one in the building.

That distinction is the whole of this guide, and it matters more now than it did two years ago.

What changed on 14 October 2025

Microsoft's own guidance describes the position for anyone who kept running Windows 10: organisations that "elect to continue using Windows 10 after support ends on October 14, 2025, will have the option of enrolling their PCs into a paid ESU subscription."

From that date, Microsoft states it no longer provides:

• Technical support
• Feature updates or new features
• "Quality updates (including security and reliability fixes)"

That third one is what makes this a DSPT matter rather than an IT preference. A machine that stops receiving security fixes is, in Standard 8 terms, unsupported software — and if it is on your network holding or reaching patient data, it belongs in your documentation.

Extended Security Updates: a bridge, not a fix

The paid programme buys time. Microsoft's terms for organisations are specific:

• Enrolled commercial or educational PCs "can receive security updates for a maximum of three years after end of support for Windows 10"
• Pricing starts at "$61 USD per device for Year One" through volume licensing, and "The price doubles every consecutive year, for a maximum of three years"
• "Year One starts in November 2025"
• It must be bought whole years at a time: "Customers can't buy partial periods… If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative"
• Devices must be on Windows 10 version 22H2 to be eligible
• ESU excludes new features, "customer-requested nonsecurity updates" and design changes — and "No, technical support isn't included in the ESU program"

For the DSPT this is genuinely useful nuance. A device on ESU is still receiving critical and important security updates, which is a meaningfully different risk position from one receiving nothing. Record that difference. But note the shape of the deal: doubling annual cost, cumulative purchase, hard three-year ceiling. It is a runway, and it is priced to make you use it for migration rather than for delay.

What else in a small provider is quietly unsupported

Windows is the obvious one. In practice the items that surprise people are the others:

• The old PC in the office nobody logs into but which still runs the rota software. Usually the worst offender, because nobody owns it.
• A care planning or practice management system on a version the supplier no longer patches. Ask the supplier directly, in writing, and keep the reply for your Standard 8 record. Standard 10 is a separate check: item 10.2.1 asks for the supplier's cyber security certification, which our supplier assurance guide covers.
• The router or firewall the broadband provider installed years ago. Consumer-grade network hardware has short support lives and is rarely on anyone's inventory.
• A networked printer or multifunction device with a scan-to-email function. These hold documents and credentials and are almost never patched.
• Phones and tablets past their vendor's update window. Particularly relevant to domiciliary care, where devices leave the building — see our domiciliary care guide.
• A server or NAS holding backups. The thing you would rely on in an incident is worth knowing the support status of.

The document Standard 8 actually wants

Half a page is enough for most small providers. The failure mode is having nothing, not having something short.

For every device and system, record:

The compensating-controls row is the one that turns a liability into a managed risk. An unsupported machine that has been taken off the internet, given no email client, restricted to one function and one account, and has a replacement date is a different proposition from the same machine sitting on the main network with a shared login.

Standard 8 connects to your risk register in practice: the risk you document here should appear on it with an owner and a review date, and may be one of the top three risks you give for item 1.3.6. Our risk assessment guide covers that side, and the evidence requirements guide places Standard 8 among the other nine.

A sequence that works

1. Walk the building and list everything. Every PC, laptop, tablet, phone, server, NAS, router, firewall, printer. Include the ones nobody uses — those are the risk.
2. Establish support status for each. Vendor pages for hardware; a written question to your software suppliers. Keep the replies.
3. Mark what touches patient data. Not everything does, and the ones that do not are a lower priority.
4. Write the compensating controls you already have, then the ones you should add.
5. Set replacement dates and put them in a budget. This is the item that cannot be fixed in the last fortnight before a deadline, which is why it belongs in autumn planning — see our guide to the 2026/27 cycle.
6. Date the document and set a review date. An undated inventory is an assertion nobody can check, including you.

Use the evidence checklist generator to see the mandatory Standard 8 items alongside every other mandatory item for your category, and the readiness quiz for a quick readiness estimate across seven of the ten standards, Standard 8 among them.

This guide is based on NHS England's published statement of Standard 8 and its Standard 8 assessment guide, the DSPT Standard 8 assertion wording and Microsoft's published Windows 10 Extended Security Updates guidance, checked on 5 November 2026; check the sources for anything announced since. ESU pricing is quoted by Microsoft in US dollars through volume licensing; confirm current pricing and terms with Microsoft or your licensing reseller. Always verify current requirements on the official DSPT portal. This is not legal, compliance or IT procurement advice.

Sources

• DSPT assessment guide 8: Unsupported systems — NHS England (last edited 8 October 2025)
• DSPT assessment guides index — NHS England (last edited 8 April 2026; states Standard 8 as "should be used")
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (assertion 8.2) — NHS England
• Extended Security Updates (ESU) program for Windows 10 — Microsoft
• DSPT overview — NHS England
• Device security guidance — NCSC

NHS England's release notes record that "The 2026-27 (version 9) DSPT has been released" on 1 September 2026. The spreadsheets listing every outcome, assertion and evidence item followed on 2 October 2026, with the statement: "The deadline for the Data Security and Protection Toolkit is 30th June 2027."

What stayed the same

This is the part most summaries skip, and it is the part that saves you time.

The mandatory list for Category 3. We compared NHS England's version 8 (2025-26) and version 9 (2026-27) workbooks for Category 3 line by line. Both mark the same 45 evidence items as "Required to meet standard (mandatory)", with the same reference numbers. Nothing was added to the mandatory set and nothing was removed. (The one exception is local authorities: version 9 puts them in a new Category 3b, with one extra mandatory item, 9.4.7.) GP practices (Category 4) are in the same position: the same 29 mandatory items in both years.

The view you see. Version 9 is aligned to the Cyber Assessment Framework at framework level — NHS England states "DSPT Version 9 is aligned to CAF version 4.0" — but that does not change your screen. The organisation-types guidance for 2026-27 still says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", and lists dentists, opticians, pharmacies and social care against the Category 3 evidence items. If you have read that the DSPT is "going CAF" for small providers, it has not happened in this version. Our guide to what CAF alignment means for Category 3 covers the background.

The 95% training question. Item 3.2.1 still asks: "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" It is still marked mandatory for Category 3. If you need a course for that, see Data Security Awareness Level 1.

The Approaching Standards subset. The same 26 items are flagged "Approaching standards mandatory" in both workbooks. Note what NHS England says about who can use that route: "Social Care organisations are eligible to complete a one-off 'Approaching Standards' assessment". It is a one-off, and the guidance names social care organisations as eligible; it does not mention pharmacies, dentists, opticians or GP practices. If you are one of those, plan for Standards Met.

What is new: four questions

Version 9's change log lists four new Category 3 evidence items. None is marked mandatory, but each will appear in your toolkit, and each is easier to answer if you have thought about it before April.

What was reworded

The change log lists a long set of Category 3 items with "updated evidence item and tooltips". The ones most likely to catch you out are those where last year's free-text answer no longer matches the question:

• 1.1.2 now reads: "Does your organisation maintain an up to date information asset register (IAR) and a record of processing activities (ROPA) and review this regularly?" Both documents are named, and the tooltip expects management review within the last twelve months.
• 10.2.1 was updated twice — once in the main release and again in the version 1.1 spreadsheet, which NHS England says "includes updated 10.2.1 requirement for category 3 and 4 organisations". It now asks: "Does your organisation assure that your IT system suppliers have robust cyber security arrangements?" The tooltip asks you to check that each IT system supplier and your IT support company holds a cyber security certification: Cyber Essentials (you can confirm a certificate on the IASME website), ISO 27001, or a DSPT status of Standards Met or better. Record what you checked; if a supplier has none, record what you do instead. Our supplier assurance guide covers each of those checks, including the IASME certificate search.
• 5.1.1, 6.1.3, 6.2.1, 7.1.2, 7.3.1 and 7.3.2 — breach review, informing affected people, antivirus, business continuity, backups and emergency contacts — all carry new wording or tooltips. Read the question before pasting last year's answer.

Two other changes to be aware of. NHS England's release notes record that on 1 September 2026 it changed the term "IT supplier" to "supplier" throughout the DSPT, and that on 9 October it "Renamed the 'Supplier' sector to 'IT Supplier'" — so the sector label is "IT Supplier" again. And the change log records a "New category for CQC market oversight organisations 3.a and Local Authorities 3.b". If you are a single care home this does not apply to you, but large care groups should check whether they are in CQC's Market Oversight scheme, which is what Category 3a covers.

The webinars for your category

NHS England's 2026-7 programme for "Dentists, GPs, Local Authorities, Opticians, Others (including Hospice and Charities), Pharmacies and University (including Researchers)" runs monthly on Tuesdays, 12.30-13.15. The remaining sessions, as listed on NHS England's webinar page on 5 November 2026:

Social care is supported separately: "Our partners at Better Security, BetterCare are running national webinars and delivering support through 28 local organisations across the country." Joining details are on the DSPT webinar page.

A plan for the next nine months

1. Now — download your version 9 spreadsheet from the version 9 announcement and mark the four new items and the reworded ones above.
2. October to December — the slow items. Supplier assurance under the new 10.2.1 wording, and any device or software replacement. Our supplier assurance guide covers what to ask suppliers for.
3. January to March — the document set. Re-review and re-date policies, bring the IAR and ROPA up to date for 1.1.2, and run and record your continuity exercise for 7.1.7.
4. April onwards — answer and publish. If the first three are done, the toolkit itself is the short part.

If you published last year, start from what changed since — new staff, suppliers, systems or premises. Our DSPT readiness check walks the ten standards, and the evidence checklist generator lists every mandatory evidence item for your category.

This guide is based on NHS England's DSPT version 9 announcement (2 October 2026), the version 9 Category 2, 3 and 4 workbook (v1.1), the version 8 workbook it was compared against, the system release notes (1 September 2026) and the 2026-27 organisation-types guidance, as verified on 7 October 2026. The supplier-label change, the webinar dates, the 10.2.1 tooltip and the Category 3a and 3b items were re-checked on 5 November 2026. The question set can be revised during the year — check the DSPT news page before relying on an item reference. This is not legal or compliance advice.

Sources

• Outcomes, Assertions and Evidence items for the DSPT 2026-27 version 9 (2 October 2026) — NHS England
• DSPT system changes and release notes — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT organisation types 2026-27 — NHS England
• DSPT overview and introductory guidance — NHS England
• DSPT webinars for 2026-7 — NHS England

NHS England's DSPT training guidance says: "Until July 2023, the DSPT required that you train at least 95% of your staff using the national Data Security Awareness Level 1 e-learning or a local equivalent. This has changed for 2023/24." Note the "or a local equivalent": the national module was never the only accepted course. And the change applies to "Category one organisations".

For Category one organisations, what replaced the 95% figure in 2023 was an outcome, not a course. NHS England's training guidance quotes the assertion: "Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness." The same words are assertion 3.1, one of Standard 3's four assertions, in the version 9 workbook for Categories 2, 3 and 4; in 2026-27 Category one organisations see a CAF-aligned view instead.

For Category 3 and Category 4 the question has never been “did 95% complete the national module?” Any appropriate training counts, as it did before 2023, and the 95% figure itself still stands. The v8 (2025-26) workbook marks evidence item 3.2.1 as “Required to meet standard (mandatory)” for both, and the v9 (2026-27) workbook published on 2 October 2026 keeps it mandatory for both. The guidance page quoted above scopes its change to “Category one organisations”. So a Category 3 organisation needs both: a documented decision about what your staff need (the Training Needs Analysis, item 3.1.1) and the 95% completion figure. The national module is one good way to get there, often the easiest. For adult social care, the 3.2.1 tooltip also names a free Digital Care Hub course (see below).

This guide covers what the course actually is, how to get staff onto it, and when something else is the better call. For what your training records need to show, see our DSPT staff training records guide, which covers the Training Needs Analysis in detail.

A note on conflicting guidance

You will find the 95% rule stated on one NHS England page and a different approach on another, and it is worth knowing how they fit before you act on either.

The DSPT's e-learning FAQ page still answers a question about evidence item 3.2.1 like this: "To meet evidence item 3.2.1, 95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation have completed their annual Data Security Awareness Training (including passing a mandatory test)."

The DSPT's training guidance page says that requirement changed from 2023/24, but only for Category one organisations. For Category 3 and 4, the 95% figure is still evidence item 3.2.1, so the FAQ's 95% still applies to you.

The "mandatory test" is a different matter. It comes from the original National Data Guardian standard, which the FAQ still quotes: "pass a mandatory test, provided through the revised information governance toolkit". Item 3.2.1's own wording asks only whether at least 95% of staff completed training. But NHS England's FAQ still reads the test into it: "To meet evidence item 3.2.1, 95% of all staff … have completed their annual Data Security Awareness Training (including passing a mandatory test)", and it requires local training to reach "the 80% pass mark". The national module builds this in: each module "concludes with an assessment", with an 80% pass mark. If you train locally, include a test and keep the scores.

The practical rule: work from the assertion text in your own toolkit, for your own category and the current version. That is the wording you are actually asserting against. Guidance pages, including this one, are a map rather than the territory.

What the course is

The full name is "e-Learning – data security awareness – level one", delivered by NHS e-Learning for Healthcare.

That last row is the one most small providers underuse. If you keep a mandatory training matrix for CQC or contractual purposes, this course sits in the information governance row of it. One completion, two purposes.

The content covers the ground the National Data Guardian standards care about: why data security matters in health and care and what the NDG standards are; how the law applies in the health and care sector; protecting information in practice; and breaches and incidents.

Getting staff onto it

Three access routes, and the right one depends on your size.

Self-registration — for a handful of people, or for testing it yourself first. Staff register at portal.e-lfh.org.uk/Register — the address NHS England's own FAQ links to, and a live registration form when checked on 5 November 2026 — then "sign in and search for data security to access the course." Use that address directly: www.e-lfh.org.uk/register/ redirects to the e-LfH hub home page rather than to the form.

Organisation registration — for a whole staff group. NHS England's route is an online form, after which "a member of the e-LfH support team will be in touch to discuss your requirements." Worth doing if you have more than a dozen staff, because it changes what you can report on. This is the link that is currently broken: the online-form address on NHS England's FAQ page does not load (it now redirects to a Jisc survey address that refuses access, checked 5 November 2026). If it has not been fixed by the time you read this, contact the e-LfH support team directly through support.e-lfh.org.uk — live chat or a support ticket — and ask for bulk enrolment.

Electronic Staff Record — "If your organisation is registered with ESR with access to e-learning, please contact your local team." If you have never used ESR, this route won't apply to you.

The practical difference matters at evidence time. Individual self-registration means each person holds their own certificate and you are chasing 30 PDFs by email in May. Organisation registration means you can pull a completion report. If you do nothing else with this post, move from the first to the second.

When the module is the right choice — and when it is not

Use it when: most of your staff have similar access to patient data, they are comfortable enough with a computer to work through four modules of around 20 minutes each plus a welcome module, and you want a defensible, free, nationally recognised baseline with certificates attached.

Do something else, or something more, when:

• You are an adult social care provider and want a sector-specific course. NHS England's Category 3 tooltip for 3.2.1 says Digital Care Hub's free Data Security and Protection eLearning "meets this requirement for staff working in adult social care". Digital Care Hub runs two courses: "One course is aimed at all staff within adult social care services, and the other is aimed at staff who lead on data protection." Its course page says both were revised on 13 October 2026.
• Your staff can't realistically do e-learning. Care assistants without regular computer access, staff for whom English is a second language, staff working nights on paper systems. A supervised group session covering the same material, with an attendance record and individual acknowledgements, can work — the assertion asks for appropriate understanding, "with an effective range of approaches taken to training and awareness." But NHS England's e-learning FAQ sets conditions for local training: it "will be reported to and signed off by the local organisation's SIRO or Caldicott Guardian and all staff completing the training will have to achieve the 80% pass mark." So record the session against your Training Needs Analysis and give each person an individual check. e-LfH offers "a separate assessment module" so a learner can "only complete the assessment without the need to complete all other modules", which is one way to do that.
• Some roles carry much higher risk. A registered manager with administrator access to the care planning system needs more than the same e-learning module a kitchen assistant gets. That difference is exactly what the Training Needs Analysis exists to record.
• You have role-specific risks the national module doesn't touch. Domiciliary care workers accessing records on mobile devices in people's homes. Pharmacy staff handling prescriptions at a counter within earshot of a queue. Reception staff taking appointment details in a waiting room. The generic course does not cover these; a fifteen-minute team briefing that does, documented, is worth more to the assessment than a second e-learning module.
• Agency and bank staff dominate your roster. They count towards the 95%: NHS England's FAQ includes "staff contracted to work in the organisation". So you need dated evidence that they have been trained, whoever provided the training. Build the request into your booking process rather than the June scramble.

Before you allocate the training

Two things to do first, in this order:

1. Write the Training Needs Analysis, then buy or assign training against it. Doing it the other way round — assign the module, then write a TNA that describes what you already did — is the most common way this evidence item ends up thin. For Category 3, NHS England's tooltip for item 3.1.1 says the TNA "should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation and a copy should be uploaded or the location of the plan recorded."
2. Check what your staff already hold. People arrive with certificates from previous employers, and a certificate inside the last 12 months is a certificate. Ask at induction; you will save some of them well over an hour and yourself a chase.

Then track completions somewhere you can pull them from in June rather than reconstruct. Our evidence checklist generator lists the mandatory Standard 3 items alongside every other mandatory evidence item for your category. The readiness quiz gives a quick readiness estimate across seven of the ten standards, training included, so you can see whether training is your weak spot or something else is.

For the wider requirement rather than the course, including the Training Needs Analysis, who counts towards the 95% and the records to keep, see our DSPT staff training guide.

This guide is based on NHS England's published DSPT training guidance and e-learning FAQ, the version 9 (2026-27) evidence item workbook, Digital Care Hub's eLearning page and the NHS e-Learning for Healthcare course listing, as checked on 5 November 2026. Where NHS England's pages differ, the assertion wording in the current toolkit governs. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Staff training, awareness and culture — DSPT guidance, NHS England
• e-Learning – data security awareness FAQ — NHS England
• Data Security Awareness Level 1 — NHS e-Learning for Healthcare
• e-LfH self-registration — NHS e-Learning for Healthcare
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (assertion 3.1; items 3.1.1 and 3.2.1) — NHS England
• Free data security and protection eLearning for adult social care — Digital Care Hub

For 2026-27, NHS England's audit notice is headed "DSPT Audit 26-27 Areas of Mandatory Audit NHS Trusts, ICBs, ALBs, CSUs, OES, Genomics and IT Suppliers". Its 2024-25 audit guidance set out the contractual basis for independent providers and suppliers: "It is mandated via the NHS Standard Contract and the DSPT requirement that the following organisations annually complete a DSPT audit/independent assessment following this guidance: — Independent Providers who have been designated Operators of Essential Service. — IT Suppliers".

The same 2024-25 guidance covered the large NHS bodies separately — "NHS Trusts (Acute, Foundation, Ambulance and Mental Health), Integrated Care Boards, Commissioning Support Units and DHSC Arm's Length Bodies".

Neither list includes care homes, domiciliary care agencies, community pharmacies, dental practices, opticians or GP practices.

Why you may have been told otherwise

Four things generate the confusion, and they are worth separating because the right response differs:

"Audit" is used loosely. Plenty of guidance — including ours — talks about auditing your own evidence before you submit. That is a self-check, not an independent audit. Our DSPT readiness check is that kind of exercise.

Your IT supplier may genuinely be in scope. The Category 2 threshold is specific: a company "that meets all the criteria of 50+ staff, a turnover of £10m+ and supplies digital (either software and/or physical) goods and services to the NHS and/or care" completes the IT Supplier assessment — and IT Suppliers are one of the two mandated-audit groups. If your care planning or PMR supplier mentions their DSPT audit, they are talking about their own obligation, not yours. That is useful to you as Standard 10 evidence, which our supplier assurance guide covers.

A commissioner has asked for "assurance". Usually they want your published status. It is public — searchable on the DSPT portal by organisation name or ODS code — so you can point them at it directly.

Somebody has read trust-facing guidance. Most published material about DSPT audits is written for organisations on the CAF-aligned assessment. Our DSPT CAF alignment guide covers who is actually on that and who is not.

What an audit involves, for those who do need one

Worth knowing, if only so you can see how far it is from what a small provider does.

For CAF-aligned organisations, NHS England describes the scope: "There is a total of 47 outcomes in the CAF-aligned DSPT, which will all be assessed over a multi-year period. Each year, a selection of outcomes from across the five objectives will be tested by independent assessment providers." That page dates from 2024-25 and has not been updated for the outcome count: NHS England's 2026-27 (version 9) CAF-aligned workbook lists 49 outcomes. NHS England has since said its CAF-aligned updates "are now complete, and all audit guidance webpages are live" on the NHS England Digital audit guides. If you need a CAF-aligned audit, use those rather than the 2024-25 page. For IT Suppliers, NHS England's 1 October 2026 notice said audit guidance "will be shared shortly".

The selection is part mandated, part chosen, and the split is set fresh each year. NHS England's original framing was that it would "mandate a common core set outcomes to be assessed for all organisations that undertake the CAF-aligned DSPT, while a further four outcomes will be selected by individual organisations", board-approved, reflecting "areas of concern that warrant additional assurance".

For the current cycle, NHS England's "DSPT Audit 26-27 Areas of Mandatory Audit NHS Trusts, ICBs, ALBs, CSUs, OES, Genomics and IT Suppliers (01 October 2026)" sets out two populations, and the numbers differ from that earlier framing:

• NHS Trusts, ICBs, ALBs, CSUs, OES providers and Genomics organisations — "there are 11 mandated outcomes to be audited (listed below) with organisations selecting 1 outcome of their choice." The eleven are A1b Roles and responsibilities, A3a Asset management, B2c Privileged user management, B2d Identity and access management, B3a Understanding data, B4c Secure management, B6a Culture, B6b Training, C1e Personnel skills for monitoring and detection, D1c Testing and exercising, and E4a Managing records.
• IT Suppliers — not CAF outcomes at all, but a list of 12 assertions: 1.1, 2.2, 3.1, 3.2, 4.1, 6.2, 7.1, 8.1, 8.2, 9.2, 9.6 and 10.2.

The 2025-26 notice (15 October 2025) was different: 9 mandated outcomes plus 3 chosen for NHS Trusts, ICBs, ALBs and CSUs, 8 plus 4 for OES and Genomics organisations, and a different list of 12 assertions for IT Suppliers, of which only 9.6 carries over. The mandated set is republished annually — check the current year's notice rather than reusing last year's list.

For an audit that covers evidence items (for 2026-27, IT Suppliers), certification can reduce that scope. NHS England's 2024-25 audit guidance says: "Evidence items which are covered by an exemption for CE+ and/or ISO27001 will not require further auditing, once it is confirmed that the scope of the certification covers all the health and care data being processed." Note where the weight sits in that sentence — the certificate has to cover all the health and care data, not some of it.

What Category 3 and 4 organisations face instead

No auditor, but not no scrutiny. Three things stand in for it:

Your published status is public. Anyone can look up your published level. Digital Care Hub is direct about who does: "Commissioners, CQC inspectors, families and people using care services can also check the DSPT status of a care service."

If you used Approaching Standards, you have a plan to deliver. The one-off Approaching Standards assessment is for social care providers, and only once. Other organisation types reach Approaching Standards only through an approved improvement plan, which NHS England publishes for trusts, ICBs, local authorities and other larger bodies — not pharmacies, dentists, opticians or GP practices. Publishing at that level means uploading an action plan for the questions still to answer, and you cannot republish at Approaching Standards the following year, so the plan is your route to Standards Met. Pharmacies, dentists, opticians and GP practices have no Approaching Standards route at all.

Your assertions are yours. The DSPT is a self-assessment. Nobody validates your evidence before publication — which sounds lighter than an audit until the year an incident makes someone read back what you asserted.

The practical implication: the discipline that would survive an audit is worth having anyway. Dated policy reviews, a training completion report you can pull any week, an access register that matches reality, supplier assurance on file. Our evidence requirements guide sets out what that looks like standard by standard.

If someone asks you for an audit report

1. Ask what they actually need. "Your DSPT audit" almost always means "confirmation you have published, and at what level".
2. Send them the public record. Point them at the portal's organisation search with your ODS code. It is faster and more credible than an emailed screenshot.
3. If you are a social care provider that published at Approaching Standards, offer the action plan too. It answers the follow-up question before it is asked.
4. If they insist on an independent report, ask which requirement they are relying on. For a Category 3 or 4 provider, no DSPT requirement produces one. It may be a term in their own contract with you, which is a legitimate thing for them to want — but it is a commercial ask, not a DSPT obligation, and it should be priced and scoped as such.
5. Do not commission an audit to close the conversation. It is a significant cost against a requirement that does not exist for you.

For a quick first read on where you stand, the readiness quiz covers seven of the ten standards and is a faster first move than any of this, and the evidence checklist generator lists every mandatory evidence item for your category.

This guide is based on NHS England's DSPT Audit 26-27 mandatory-audit notice (1 October 2026), its independent assurance and audit guidance, its 2026-27 CAF-aligned audit guidance notice, and its organisation-types guidance, as at 5 November 2026. Audit arrangements are revised annually — confirm the current position on the official DSPT portal before acting on a commissioner request. This is not legal or compliance advice.

Sources

• DSPT Audit 26-27: Areas of Mandatory Audit (1 October 2026) — NHS England
• DSPT Audit 25-26: Areas of Mandatory Audit (15 October 2025) — NHS England
• DSPT Independent Assurance and Audit 2024-25 (12 May 2024) — NHS England
• CAF-aligned DSPT audit guidance updates (2026-27) — NHS England
• CAF-aligned DSPT audit guides — NHS England Digital
• Publish or republish and share your DSPT (Approaching Standards action plan) — Digital Care Hub
• Version 9 (2026-27) CAF-aligned outcomes and indicators of good practice (spreadsheet) — NHS England
• DSPT organisation types and categories — NHS England
• DSPT overview and deadline — NHS England
• Check DSPT status — Digital Care Hub

NHS England's guidance on organisation types is unambiguous about who sees the CAF-aligned assessment: "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements." Category 1 is NHS trusts, integrated care boards, commissioning support units, arm's length bodies, Genomics organisations and a small designated group of independent providers. Category 3 and Category 4 — which is where care homes, domiciliary care, pharmacies, dentists, opticians, local authorities, universities, charities and GP practices sit — are not on it. Version 9 (2026-27) did bring two exceptions inside Category 3. Large care providers in CQC's Market Oversight scheme (a new Category 3a) are asked to "Submit a Cyber Assessment Framework Assessment" (item 9.4.6, not yet mandatory, with NHS England asking them to "prepare to complete a CAF assessment as a mandatory part of the DSPT in the future"). Local authorities (Category 3b) must "Submit your current progress in completing the Cyber Assessment Framework for Local Government" (item 9.4.7, mandatory). Neither applies to a small provider.

That does not mean nothing changes. It means what changes for you is different from what changed for a trust, and the published plan carries an explicit caveat.

What CAF is, briefly

The Cyber Assessment Framework is the NCSC's framework, which the NCSC describes as "the UK's approach to assessing and improving cyber resilience". It is now at version 4.0, the version DSPT version 9 aligns to. The NCSC says it "is used across sectors currently regulated under NIS and wider CNI, government and other sectors where maintaining operational resilience is essential."

It works differently from the DSPT you know. Instead of assertions with evidence items attached, CAF is built around contributing outcomes, each assessed as Not Achieved, Partially Achieved or Achieved, using indicators of good practice to guide the judgement. NHS England describes those indicators as "examples of procedures and processes which help inform your organisation's decision about whether it has achieved a contributing outcome."

The shift is from "did you upload the document?" to "can you justify that you achieved the outcome?" NHS England is explicit that this is deliberate: the CAF-aligned DSPT "places a bigger emphasis on good decision-making guided by expert judgment at the local level."

The health and care overlay

NHS England did not adopt the NCSC framework unchanged. In its own words: "NHS England (NHSE) and DHSC have enhanced NCSC's existing cyber framework with a health and care CAF overlay which covers data protection, confidentiality, and other information governance disciplines such as clinical coding."

The most visible piece of that overlay is a fifth objective. Asked why objective E exists, NHS England answers: "As part of the Health and Care overlay, objective E was added to ensure appropriate outcomes were included to cover 'Using and sharing information appropriately'."

That matters conceptually even for organisations not on CAF, because it signals the direction: cyber security and information governance are being treated as one discipline rather than two. NHS England puts it directly — "cyber security and IG are being treated as two sides of the same discipline… preventing gaps and minimising unnecessary duplication between disciplines."

Who moved, and when

The audit references in that table apply to the organisations being audited. NHS England's 2026-27 notice mandates an audit for NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics organisations, the same group that sees the CAF-aligned view, plus IT suppliers. Category 3 and 4 organisations are not on it. If a commissioner or supplier has told you otherwise, our guide to who actually needs a DSPT audit sets out NHS England's mandated list.

For the "other" organisations in the table's last row, which almost certainly includes you, NHS England's CAF-aligned DSPT FAQ for 2024-25 answered the question head-on: "A checklist approach mapped to CAF will be developed and implemented Summer 2026, however this is still subject to review."

Two things to take from that sentence, and both matter.

It is a checklist mapped to CAF, not CAF itself. Nobody is proposing that a 25-bed care home works through all 49 outcomes of the CAF-aligned DSPT (the count in NHS England's 2026-27 workbook), weighs the indicators of good practice under each, and justifies every judgement to an auditor. The plan as stated was a checklist that maps to the framework — closer in shape to what you complete now.

"Still subject to review" did real work. That FAQ is the 2024-25 edition, and summer 2026 has passed without the change. Version 9 of the toolkit (2026-27), released on 1 September 2026, keeps the evidence-item format for care homes, pharmacies, dentists, opticians and GP practices (the two Category 3 exceptions above apart), and the 2026-27 organisation-types guidance still says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements". That is the position to plan against. If the checklist approach lands, it will be announced on the DSPT news page.

So what do you actually file?

For Category 3 and Category 4 organisations, the assessment remains what it has been: assertions with evidence items, structured around the ten National Data Guardian standards, categorised by organisation type. NHS England's own framing is that "each category has a pre-determined set of evidence items, with some mandatory and some non-mandatory".

Each version is aligned to the framework — NHS England stated that "DSPT Version 8 is aligned to CAF version 3.4", and for the current 2026-27 toolkit that "DSPT Version 9 is aligned to CAF version 4.0" — but alignment at framework level is not the same as being assessed against it. Our guide to the 2026-27 (version 9) DSPT covers what changed in the questions you answer this year (DSPT v8 changes explained covers the year before), and the evidence requirements guide works through the current items standard by standard.

If you want the framework itself explained rather than its effect on your filing, our Cyber Assessment Framework guide covers the structure.

What to do with this now

Not much, honestly — and that is the useful answer. Three things are worth doing:

1. Do not restructure your evidence for CAF. A checklist mapped to CAF, if it arrives, will draw on the same underlying artefacts you already keep: policies with review dates, training records, an access register, supplier assurance, a continuity plan. Nothing about a possible future format makes those less useful.
2. Watch the outcome-shaped language. One transferable idea from CAF is worth adopting early: the question is moving from "do you have a document" to "can you justify the outcome". A policy nobody follows will look thinner under that lens. Where you have a document holding a gap open, close the gap rather than improving the document.
3. Check the news page, not the rumour. Changes of this size are announced on the DSPT news page. Commissioners and suppliers pass on half-remembered versions of trust-facing changes; the news page is the source.

In the meantime, the evidence checklist generator lists every mandatory evidence item for your category in the current version, and the readiness quiz gives a quick readiness estimate across seven of the ten standards as they stand today.

This guide is based on NHS England's published DSPT guidance, its CAF-aligned DSPT FAQ (2024-25 edition), its 2026-27 audit notice and the NCSC Cyber Assessment Framework collection, as checked on 5 November 2026. The timing of any move for Category 3 and 4 organisations is explicitly subject to review by NHS England — confirm the current position on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2025-26 version 8 announcement — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Version 9 (2026-27) CAF-aligned outcomes and indicators of good practice for NHS Trusts, ICBs, ALBs, CSUs and OES (spreadsheet) — NHS England
• DSPT release notes — NHS England
• DSPT organisation types and categories — NHS England
• Frequently Asked Questions – CAF aligned DSPT 2024–2025 (PDF) — NHS England
• Changes to the DSPT for large NHS organisations and OES/Genomics providers — NHS England
• DSPT Audit 26-27: Areas of Mandatory Audit (1 October 2026) — NHS England
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (Category 3a and 3b items 9.4.6, 9.4.7) — NHS England
• DSPT news — NHS England
• Cyber Assessment Framework — NCSC

"Has my organisation published, and at what level?" — there is an official answer. The DSPT portal has an organisation search that shows any organisation's published status, searchable by name or ODS code. It is public.

"Is my evidence actually good enough to publish?" — there is no official tool for this, because the DSPT is a self-assessment. Nobody checks your evidence before you publish; you assert it. What you can do is run a structured pass over your own position first, which is what the second half of this guide covers.

Checking your published status

Use the organisation search on dsptoolkit.nhs.uk. Digital Care Hub's guidance describes what it returns: it "will show you if your organisation has published, and at what level (eg Approaching Standards, Standards Met or Standards Exceeded)", and it "will also show you if your organisation is registered to use the DSPT but has not yet published."

Three things worth knowing before you search:

It is public. In Digital Care Hub's words: "It is public information. Commissioners, CQC inspectors, families and people using care services can also check the DSPT status of a care service." Your status is not a private conversation between you and NHS England.

Search by ODS code if you can. The name on the register may not be the one you trade under, so a name search can miss. If you do not know your ODS code, Digital Care Hub explains how to find it.

Registered-but-not-published is its own state. If a predecessor set the organisation up and never filed, the search shows that. This can happen when a new manager inherits the task and assumes nothing exists.

The three levels, and what they actually signal

A care provider, pharmacy, dental practice, optician or GP practice will normally see Standards Met and Standards Exceeded; social care providers can also publish the one-off Approaching Standards assessment. NHS England also uses a "Standards Not Met" status. Its improvement-plan instructions cover the large organisations named in the table, plus key IT suppliers and local authorities (local authorities are Category 3). Those that have not met the expected levels "should publish a Standards Not Met assessment and submit an improvement plan", and an approved plan moves their status to Approaching Standards.

For adult social care, the mechanics of the first two are set out plainly: "If you have only completed the 26 mandatory questions for Approaching Standards you will be asked to complete and upload an action plan on how you will complete the remaining questions."

One caveat on question counts: Digital Care Hub's own page gives both "all 45 questions" and "the 42 questions for Standards Met" in adjacent paragraphs, and the total varies by organisation type in any case. Take the count from your own toolkit rather than from any guide, including this one. The 26-question threshold for Approaching Standards is the figure to plan around.

The readiness check to run before you publish

No tool can validate your evidence for you, so here is the pass to run yourself. Work through the ten National Data Guardian standards and give each one an honest colour. It is one check per standard, so it finds the empty areas quickly; it is not the full list of mandatory items (more on that below). The test for green is not "we have a document" — it is "if a commissioner asked me to produce the evidence for this tomorrow, could I, within the hour, and is it dated within the last twelve months?"

1. Personal confidential data. Is your ICO registration current (item 1.1.1 asks for the registration number) and your privacy notice up to date (item 1.1.3)? Is there an up-to-date information asset register and record of processing (item 1.1.2), and a data security policy customised to your organisation and up to date (NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum")? Our guide on how to write a DSPT data security policy covers what it needs to contain.

2. Staff responsibilities. Does your induction cover data security and protection, and cyber security (item 2.1.1), and do employment contracts and volunteer agreements include data security clauses (item 2.2.1)?

3. Training. Have at least 95% of your staff, directors, trustees and volunteers completed data security training in the twelve months before you publish (item 3.2.1), and can you produce the completion records? NHS England's tooltip is specific about the window: "it is the last twelve months prior to the date of publication". This is an easy item to fail the hour test on. See DSPT staff training records.

4. Managing data access. Is there an up-to-date record of staff and their roles (item 4.1.1), a reliable way to remove or change people's access when they leave or change role (item 4.2.4), and a signed accountability agreement from every IT system administrator (item 4.3.1)? Is multi-factor authentication switched on for every account that can be reached from the internet and, for Category 3, every administrator account, with any exceptions approved by senior management (item 4.5.3)? For Category 3, item 4.5.4 also asks how you make sure people use good password practice. DSPT access controls has a worked register.

5. Process reviews. If you had a data or cyber security breach or near miss in the last year, did you review the process that allowed it (item 5.1.1)? If you had none, the answer is "Not applicable". Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies), and our DSPT risk assessment guide covers the risk question, item 1.3.6.

6. Responding to incidents. Is there a written procedure and a log — even an empty one? DSPT incident response.

7. Continuity planning. Is there a plan covering IT failure, cyber attack and data loss, with evidence it has been reviewed and tested (item 7.1.2)? For Category 3, item 7.2.1 asks for a test in the last twelve months; a tabletop walk-through can be that test. Are your backups working and tested (items 7.3.1 and 7.3.4 for Category 3; item 7.3.4 for GP practices), and is your emergency contact list kept somewhere separate from your computers (item 7.3.2)? DSPT business continuity.

8. Unsupported systems. Is every IT system and piece of software you use still supported by its manufacturer, or, where it is not, are the risks understood and managed (item 8.1.4)? This one has moved from theoretical to live for a lot of small providers. Our DSPT unsupported systems guide covers what to do about it.

9. IT protection. Device encryption (item 9.5.2) and network-device passwords changed from the originals (item 9.1.1), plus firewalls (item 9.6.1, an optional Category 3 item) — can you evidence them, or does your IT provider need to? Antivirus (item 6.2.1) and patching (items 8.3.5 and 8.3.1) sit under Standards 6 and 8, but your IT provider can usually confirm those too.

10. Accountable suppliers. Do you have a list of the suppliers that handle personal information (item 10.1.2)? For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better) and record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence. DSPT supplier assurance.

Count your greens. Ten greens means no standard is empty — it does not mean you are at Standards Met. NHS England's overview says that "Once all the mandatory evidence items have been completed, and all assertions confirmed, you will be able to publish your assessment". The mandatory list is longer than ten checks: NHS England's version 9 workbook marks 45 evidence items mandatory for Category 3 and 29 for GP practices (Category 4). Items such as national data opt-out compliance (1.2.4), your records retention timetable (1.4.1) and, for Category 3, advising staff that public Wi-Fi is unsafe for work (6.3.2) are on that list but not in this pass. So once you have ten greens, work through every item your own toolkit marks mandatory: finishing those is Standards Met.

Adult social care providers have one more option. If you have completed the 26 questions flagged for Approaching Standards but still have genuine gaps among the rest, the one-off Approaching Standards assessment, with an honest action plan, is the route designed for that position. Pharmacies, dentists, opticians and GP practices do not have that route in NHS England's guidance: for them, gaps mean more work before publishing at Standards Met. If the gap list is long and you are weighing up outside help, our guide on whether to bring in a DSPT consultant compares the two routes.

Our readiness quiz gives a quick readiness estimate across seven of the ten standards (1, 3, 4, 6, 7, 8 and 10), and the evidence checklist generator lists every mandatory evidence item for your category.

Three checks people skip

Check the status of your suppliers, not just your own. The organisation search works on any organisation, so you can use it for item 10.2.1 to look up each IT system supplier's DSPT status. If one has never published, check whether it holds Cyber Essentials or ISO 27001 instead. If it holds none of these, record what you do to check that it takes data protection and cyber security seriously.

Check what your organisation published last year, before you start this year. Last year's answers are your starting point. If you published at Approaching Standards, your action plan also covers the questions that were left open.

Check the profile details, not just the answers. Publishing asks you to confirm the organisation profile is accurate. An out-of-date registered address or contact on a published record is a small thing that looks careless to anyone who looks it up.

Then plan the run-in

Once you know where you stand, the deadline calculator shows how many working days remain to 30 June and suggests milestones. For the full walk-through of the submission itself, see how to complete the DSPT.

This guide is based on NHS England's published DSPT guidance, its version 9 (2026-27) evidence-item workbook and Digital Care Hub's Better Security, Better Care guidance as at November 2026. Question counts and level thresholds vary by organisation type — confirm yours in the toolkit itself. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT overview and deadline — NHS England
• Version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 — NHS England
• Improvement plans: instructions for 2025-26 — NHS England
• Check DSPT status — Digital Care Hub
• Publishing your DSPT for the first time — Digital Care Hub
• How to find an ODS code — Digital Care Hub

Self-assessment, and published in your organisation's name. That means nobody can take the submission off your hands entirely. A consultant can do the gathering, the drafting and the gap analysis — genuinely useful work — but the assertions are still yours, and the underlying facts have to be true whoever types them in.

This guide sets out what outside help actually buys you, the funded support most small providers do not know exists, and a straight test for whether paying is the right call for your organisation.

What a consultant can genuinely do for you

The useful things, in rough order of how much time they save:

• Tell you what "good" looks like. The single biggest time cost for a first-time filer is not writing the policy, it is not knowing whether the policy you have is enough. Someone who has seen many submissions can usually answer that quickly.
• Draft the documents. A data security policy, an incident procedure, a business continuity plan and a risk register are all standard artefacts. Adapting a good template with someone who knows the assessment is usually much quicker than drafting from scratch.
• Run the gap analysis. Walking your current position against the current evidence items and producing a list.
• Chase the technical evidence. Getting supplier certification details and administrator account lists out of an outsourced IT provider is often faster with a third party asking.
• Absorb the annual version churn. The toolkit has been through nine versions. Someone tracking it professionally starts from the current one.

What a consultant cannot do for you

• Make the underlying facts true. If eleven of your forty staff have not completed data security training, no amount of consultancy changes that. The work is the training, not the paperwork.
• Carry the consequence. The submission publishes in your name. If a commissioner queries a control you asserted was in place, the conversation is with you.
• Build the habit. The DSPT is annual, and the providers who find it easiest are the ones whose evidence is a by-product of how they already run — dated policy reviews, a joiner-leaver checklist, a training completion report they can pull any week. Buying the submission each year does not build that; it rents around it.
• Answer for the year in between. Most of the assertions describe an ongoing state, not a June activity.

The support most small providers never check

Before pricing anything, check what your sector already funds for you.

Adult social care providers in England have Better Security, Better Care, described by its operators as "the national and local support programme to help adult social care providers to store and share information safely… focuses on helping care providers to complete the Data Security and Protection Toolkit". The Department of Health and Social Care has confirmed £21 million of funding for it over three and a half years to March 2029, including new "voluntary data and cyber health checks, delivered via local care associations".

What is actually on offer:

• A helpline on 0808 196 4848, 9am to 5pm Monday to Friday
• Regular national webinars on using the DSPT for the first time, and on reviewing and republishing an existing submission
• Guidance to help you complete the DSPT, including step-by-step materials
• Template policies and resources you can adapt for your organisation
• Local workshops, webinars and one-to-one sessions through a Local Support Partner

Scope matters: the programme states it is for "all adult social care providers, including services like day services which are not registered with CQC" — care homes, residential homes, domiciliary care and day services. It does not name community pharmacies, dental practices, opticians or GP practices among that eligibility, so treat it as being for adult social care unless your own provider type is explicitly listed.

Community pharmacies should start with Community Pharmacy England's DSPT guidance, which is written against the pharmacy question set. Its latest full guidance is for the 2026 completion (30 June 2026 deadline, version 8), so check the page for an update before relying on it for the 30 June 2027 deadline.

GP practices should ask their ICB or commissioning support unit what IG support is included in existing arrangements before going to market — see our DSPT for GP practices guide for the Category 4 specifics.

The price problem

Almost no consultancy publishes a figure on its own website.

When the DSPT consultancies ranking for DSPT consultancy searches, and those cited in Google's AI overview for them, were checked on 5 November 2026, not one listed a fee for DSPT work. Every route is a contact form or a phone number, and several present DSPT as a single line on a broader certification menu offered to organisations of any size — which tells you the DSPT work is not necessarily specialised to a 30-bed care home.

Two practical consequences:

1. You cannot comparison-shop without a round of calls. Budget the time.
2. Scope varies far more than price does. "DSPT support" can mean a short document review or a done-with-you submission with supplier chasing. Ask what is included in writing before comparing anything.

When you do ask, the questions worth putting in the email:

• What exactly do you produce, and what remains ours to do?
• Do we get the source documents in an editable format we can reuse next year?
• Is this a one-off or does it renew annually, and at what price?
• Have you completed submissions for our organisation type and category specifically?
• Who is answerable if a commissioner queries something you drafted?

An honest test

Work through these. More "yes" answers on the left means DIY is realistic.

The most common honest answer for a small provider is neither column: the work is doable, but the gathering is what defeats it. If that is the position, the fix is usually a structure to work through — not a consultant. Our DSPT evidence checklist generator lists every mandatory evidence item for your category, and the readiness quiz gives a quick readiness estimate across seven of the ten standards before you decide whether to pay anyone.

If you do pay, stay in the room

Whatever you decide, three things protect you:

1. Read every assertion before it is submitted. You are the one asserting it.
2. Keep the source documents. Editable, in your own storage, not only in the consultant's system. Next year starts from them.
3. Note what changed. A one-page record of what was done, by whom, and what was still outstanding turns next year's submission from a restart into an update.

For the full picture of what you are being asked to evidence, see our DSPT evidence requirements guide and the complete DSPT guide.

This guide is based on NHS England's published DSPT guidance and the published scope of the Better Security, Better Care programme as checked on 5 November 2026. It is not an endorsement or criticism of any individual provider of consultancy services. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England Digital
• DSPT overview and deadline — NHS England
• Better Security, Better Care — Digital Care Hub
• Better Security, Better Care national support — Digital Care Hub
• £21m confirmed for care provider data and cyber security support — Digital Care Hub
• Data Security and Protection Toolkit — Community Pharmacy England

So the annual return you are being chased for is the Data Security and Protection Toolkit — the DSPT. Same broad purpose, different name, different structure, and a heavier weighting toward cyber security than the toolkit you remember. The deadline is 30 June each year. Your organisation completes it as a self-assessment and publishes the result; nobody files it on your behalf.

This guide covers what actually changed, what carries over from your old IG Toolkit work, and why searching the old name gives you two contradictory answers.

Why "IG Toolkit" still returns confusing results

Search the old name and you will get a mix of NHS trust information governance pages, vendor explainers, and — this is the one that trips people up — the Welsh Information Governance Toolkit, which is a genuinely separate and genuinely current instrument.

Digital Health and Care Wales runs its own toolkit for Welsh organisations, separate from the DSPT and on a different deadline. DHCW's guidance page states: "The 2026/2027 Welsh Information Governance Toolkit is now available for completion. Organisations have until the 31st of March 2027 to submit their form."

DHCW describes it as "a self-assessment tool enabling organisations to measure their level of compliance against national Information Governance standards and legislation", consisting of "simple to follow assessments, comprising of a range of rudimental questions requiring tick box answers, one-line statements and the facility to upload or link to documents as evidence". Queries go to welshigtoolkit@wales.nhs.uk.

One thing we are deliberately not stating: how the Welsh toolkit relates to NHS Spine access. DHCW's page does not address it, and we are not going to infer it — ask DHCW directly if that is your question.

The short version:

• England — you complete the DSPT at dsptoolkit.nhs.uk. Everything on this site is written for you.
• Wales — you are likely in scope for the Welsh IG Toolkit instead, and its 2026/2027 deadline is 31 March 2027, not 30 June. Confirm your position with Digital Health and Care Wales, not with us.

That single fork explains most of the contradictory advice you will find. Two nations, two live toolkits, one legacy name.

What the DSPT actually is

NHS England defines it as "an online self-assessment tool that enables organisations to measure and publish their performance against the National Data Guardian's ten data security standards."

Three words in that sentence do a lot of work:

Self-assessment. You answer the questions and upload the evidence. There is no inspector who comes and checks. That is not the same as saying nobody looks — commissioners, ICBs and, for CQC-registered providers, inspectors can all see your published status.

Publish. Your submission status is visible. This is why "we'll sort it in July" is a poor plan: the gap is public.

Ten data security standards. These are the National Data Guardian standards, and they are the skeleton the whole assessment hangs off. Our complete DSPT guide walks through all ten.

On scope, NHS England is broad: "All organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly." If you hold NHS patient data or log in to an NHS system, you are almost certainly in.

What changed between the two toolkits

The 2018 change was more than a rebrand. Two shifts matter for a small provider:

1. Cyber security moved to the centre. The old toolkit was weighted toward information governance in the paper-records sense — confidentiality, Caldicott, records management. The DSPT keeps all of that but adds a substantial technical layer: who has administrator accounts, whether your software is still supported, whether staff use unique logins, what your suppliers do with your data.

2. The structure is categorised. NHS England now assigns every organisation to one of four categories: "There are four Categories: 1, 2, 3 and 4. Each category has a pre-determined set of evidence items, with some mandatory and some non-mandatory for an organisation and determines the language used in asking the evidence item."

For most readers of this guide that means Category 3 — the portal lists social care providers (including care homes, residential homes and domiciliary care), community pharmacies, dentists, opticians, local authorities and smaller IT suppliers under Category 3 — or Category 4, which is general practice.

What carries over from your old IG Toolkit work

More than you would think, and less than you would hope.

Reusable: the underlying documents. Your data protection policy, your staff confidentiality agreements, your supplier contracts, your incident procedure, your business continuity plan. These are all still the right kinds of artefact.

Not reusable: the answers. Nine versions have shipped since 2018 and the assertions have been restructured more than once. An answer written against the IG Toolkit question set does not map onto a current DSPT evidence item, and a policy last reviewed in 2018 will fail on currency alone regardless of content.

The practical approach for a returning filer:

1. Pull out every document you used last time and check its review date against the item it answers. NHS England's tooltip for 1.3.1 says policies "should be updated every three years as a minimum"; registers (1.1.2, 7.1.1), the training needs analysis (3.1.1), training completion (3.2.1) and the continuity-plan test (7.2.1) are judged on the last twelve months.
2. Work through the current evidence list rather than your memory of the old one. Our evidence checklist generator lists every mandatory evidence item for your category.
3. Expect the technical questions to be the gap. Administrator account registers, supported-software checks and supplier certification checks are the items that most often have no predecessor document at all.
4. Budget the time for gathering rather than writing. For most small providers the writing is quick; finding the training completion report from the agency that supplied three staff in March is what takes the time.

Where the DSPT sits alongside everything else you file

A recurring source of confusion is whether the DSPT replaces or duplicates other assurance work. It does neither, mostly:

Your first steps back

If you are picking this up again after a gap, do these four things in order:

1. Log in and check your category — do not assume it is right. Go to dsptoolkit.nhs.uk. Your ODS code identifies your organisation at registration, but your category follows from the sector you select, not from the code: NHS England states "you will be asked to choose the most appropriate sector for your organisation... The answers you give here will tailor the questions you need to respond to in your assessment", and "you can change your answers at any time". Since "the organisation type determines which Category of toolkit is to be completed", a predecessor's wrong sector choice will quietly give you the wrong question set — so check it before you start, and change it if it is wrong. Our DSPT toolkit prep guide covers what to gather before that first login.
2. Check what your organisation last published. If a previous manager submitted, the status is there and tells you where the gaps were left.
3. Date-check your document set. Review dates first, content second.
4. Work out your runway. The deadline calculator shows the working days left to the next 30 June deadline and suggests milestones.

The name changed in 2018 but the underlying job did not: prove that the people who handle patient data in your organisation are doing it properly, and show your working. For the step-by-step version, see our guide on how to complete the DSPT.

This guide is based on NHS England's published DSPT guidance and its version 9 (2026-27) workbook as at November 2026 and reflects the position for organisations in England. Always verify current requirements on the official DSPT portal. Welsh organisations should verify their position with Digital Health and Care Wales. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England Digital
• DSPT overview and deadline — NHS England
• DSPT organisation types and categories — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (review periods for 1.1.2, 1.3.1, 3.1.1, 3.2.1, 7.1.1, 7.2.1) — NHS England
• Welsh Information Governance Toolkit — Digital Health and Care Wales

What to collect for Standard 3

NHS England's version 9 evidence-item workbook marks three Standard 3 items as mandatory for Category 3:

1. A Training Needs Analysis (item 3.1.1). A short document setting out what data security training each staff group needs, reviewed or approved in the last 12 months by whoever holds overall responsibility for data security in your organisation. This is the Standard 3 item where you upload a document, or record where it is kept.
2. Training completion records (item 3.2.1). A completion report or tracker showing that at least 95% of staff, directors, trustees and volunteers completed data security and protection, and cyber security, training in the twelve months before you publish. In the toolkit this is a yes/no question, so the records stay in your own files.
3. Training for whoever leads on data security (item 3.4.1). Another yes/no question: "Have the people with responsibility for data security and protection received training suitable for their role?" Keep a record of the training they completed.

Item 3.3.1, details of any specialist data security and protection training, is not mandatory for Category 3.

For GP practices (Category 4), item 3.2.1 is the only Standard 3 item in the version 9 workbook. Its tooltip still says your "training needs analysis should identify the level of training or awareness raising that people need", so a short TNA remains a sensible way to decide who needs what, even though there is no separate item to upload it to.

Four questions, answered

Do you upload training records, or just answer yes?

You answer item 3.2.1 yes or no. The version 9 workbook lists its input type as "Yes/No", so there is nothing to upload for it. The completion report or tracker stays in your own files as the evidence behind your answer, so only answer yes when those records show at least 95%.

Item 3.1.1 works differently. Its input type is "Document", and the Category 3 tooltip says "a copy should be uploaded or the location of the plan recorded".

Do staff names need to be included? Neither item's wording in the workbook asks for names. Your own completion record will still need one line per person, with name, role and training date, because that is how you count the 95% and check that each date falls inside the twelve months. The 3.1.1 tooltip doesn't prescribe a layout for the TNA: the example table below groups staff by role, while Digital Care Hub's template has a column for each named staff member.

Who counts towards the 95%?

The question in item 3.2.1 is the same for Category 3 and Category 4: "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" The tooltip sets the scope by access to data, not by job title: "All people in your organisation with access to personal data must complete appropriate data security and protection, and cyber security, training every year", and "the target is 95% of people with access to personal data".

NHS England's e-learning FAQ spells out who that includes for 3.2.1: "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation". So the count includes agency and bank workers, locums and students as well as permanent staff, directors, trustees and volunteers: anyone with access to personal data.

Because it is a percentage, small teams have little slack. 95% of 18 people is 17.1, so all 18 need to be trained; any team of fewer than 20 needs everyone. A team of 40 can have two people outstanding, because 38 of 40 is exactly 95%.

Where does the TNA template come from?

NHS England's Category 3 tooltip for item 3.1.1 points to one: "An example training needs analysis is available to download from Digital Care Hub." Digital Care Hub's Training Needs Analysis Template page describes it as "a template Training Needs Analysis form which you can download and adapt for your organisation". It is a Word document that lists areas of training, such as password good practice and safe use of personal mobile phones, against the types of staff who need each one, with a second section for staff with responsibility for data security and protection. Digital Care Hub serves adult social care, but the tooltip that links to the template applies to every Category 3 organisation, so a pharmacy, dental practice or optician can adapt it too. The example structure below is another starting point.

What does "the last twelve months prior to the date of publication" mean?

The 3.2.1 tooltip says: "For clarity, it is the last twelve months prior to the date of publication." The window ends on the day you publish your assessment and runs back twelve months, so it moves with your publication date.

Worked example. A care home with 20 people who have access to personal data plans to publish its version 9 assessment on 15 June 2027. Training counts if it was completed between mid-June 2026 and 15 June 2027. Someone last trained in November 2025, or in May 2026, falls outside that window and needs a refresher first. At least 19 of the 20 need a completion date inside it, because 95% of 20 is 19. Had the same home published on 15 March 2027 instead, the May 2026 training would still have counted. So check training dates against the day you plan to publish, not the day you start the assessment.

The Training Needs Analysis

A TNA for data security doesn't need to be elaborate. For a small provider, a one-page document grouping your staff into 2-4 roles, describing the data security training appropriate for each, is sufficient.

Example structure for a 20-person care home:

For Category 3, NHS England's tooltip for item 3.1.1 says the TNA "should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation". In a small provider that is usually the registered manager. Sign and date it. It forms the documented basis for your training programme.

Delivery: what counts and what records you need

Any appropriate training can count. The national e-learning module has never been the only acceptable source: NHS England's pre-2023 rule already allowed "a local equivalent". Whichever training you use, the 95% completion figure is still required. For more on which training course counts, see our guide to the national module.

Digital Care Hub eLearning (adult social care). NHS England's Category 3 tooltip for item 3.2.1 says Digital Care Hub "provides a free Data Security and Protection eLearning training course that meets this requirement for staff working in adult social care". The Digital Care Hub eLearning page has one course for all staff in adult social care services and one for staff who lead on data protection. Keep the completion records it produces as your evidence.

NHS e-Learning for Healthcare (e-LfH) module. The Data Security Awareness Level 1 module at portal.e-lfh.org.uk is free, is split into four modules of around 20 minutes each plus a welcome module, according to NHS England's e-learning FAQ, and covers the core IG and cyber security topics. To use this as evidence, you need a completion report from the e-LfH platform showing names, dates, and pass/fail status. Individual completion certificates printed per-person also work.

Commercial e-learning platforms. Commercial e-learning providers also offer data security awareness modules. If you use one of these, your completion report serves as evidence. The module should cover information governance, data security, cyber security basics, and incident reporting.

In-house training. A face-to-face or online training session delivered internally can count, but the records need to show what was covered and who attended. Item 3.2.1 itself asks only whether training was completed. NHS England's e-learning FAQ goes further for training that replaces the national module: it should cover the same learning objectives, be "reported to and signed off by the local organisation's SIRO or Caldicott Guardian", and "all staff completing the training will have to achieve the 80% pass mark". So record each person's result from a short individual check alongside the attendance list. "We covered data security in our staff meeting" without a note of what was covered and who attended is weak evidence.

Supervised group sessions for staff who can't do e-learning alone. Not everyone is comfortable with e-learning; in care homes this often includes staff without regular computer access, staff for whom English is a second language, and night staff working on paper systems. You can run the e-LfH module on a projector or large screen, work through it together and record individual attendance with signatures. As with in-house training, item 3.2.1 asks only whether training was completed, but NHS England's e-learning FAQ describes 3.2.1 training as "including passing a mandatory test". So the safe course is for each person to take the test individually afterwards. e-LfH offers "a separate assessment module" that a learner can take "without the need to complete all other modules", which suits exactly this case. A learner who takes only the assessment gets a pass or fail in their e-LfH activity report but no certificate, so record the result in your tracker or run an e-LfH admin report.

Blended approach. Many providers use the e-LfH module for the core content and supplement with team briefings, induction sessions, or incident-specific awareness updates. This is valid — record each element separately.

Evaluation: optional, but worth doing

Evaluation isn't a separately-listed evidence item — but it strengthens both the TNA and your completion figure. A TNA that's never checked for effectiveness, or a 95% completion figure with no evidence training actually worked, is weaker than it needs to be. This is separate from the individual test or check each person takes as part of their training (see "Delivery" above). Evaluating the programme as a whole doesn't need formal assessments. It means:

• A brief survey or verbal check. Did staff understand the key messages? Were there any questions that suggested misunderstanding?
• Pass rates from e-learning. The e-LfH module includes a quiz. A completion report with pass rates is evaluation evidence.
• An attendance check. If you run a training session, confirm that all required staff attended.
• Incident log correlation. If staff are reporting data security incidents (Standard 6), that's evidence that training on incident recognition and reporting is working.

Your evaluation doesn't need to be formal. A dated note recording "Training delivered to all 18 staff, all passed the e-LfH module, no questions raised about the policy acknowledgement section" is sufficient.

Annual completion tracking

Item 3.2.1 needs records showing that at least 95% of staff, directors, trustees and volunteers have completed training in the twelve months before you publish. NHS England's tooltip explains the 95%: "due to illness, maternity/paternity leave, attrition or other reasons it might not be possible for 100% of people to receive training every year". Common tracking approaches:

• Spreadsheet. Name, role, training date, module/session name, pass/fail (if applicable), and the date the refresher is due. Update when new staff join and when annual refreshers are due.
• e-LfH admin dashboard. If your whole team uses the e-LfH portal, your organisation admin can run completion reports directly from the platform.
• Commercial platform dashboard. Most commercial e-learning providers offer admin dashboards with completion tracking.

The key is that you can produce a report showing every current staff member's training status. Leavers don't need to appear; joiners who haven't yet completed training should be flagged.

Turnover, agency staff and part-timers

High turnover. Every starter adds a person to the count. Build data security training into induction, in the first week rather than months later, and update your tracker on the day someone starts or leaves.

Agency and bank staff. They count towards the 95% (see "Who counts towards the 95%?" above), so you need dated evidence that each one has been trained, whoever provided the training. There are two ways to get it: ask the agency for proof that each worker has completed data security training in the last twelve months, or include agency workers in your own group sessions or send them the e-learning. Asking each agency worker to read and sign your data security policy on their first shift is good practice on top of training, not a substitute for it.

Part-time and zero-hours staff. If they have access to personal data, they count too. Include them in your next group session, or send them the e-learning link with a deadline.

A training timeline for a June publication

If you plan to publish in June, this spreads the work across the months before it. Every completion date still has to fall inside the twelve months before the day you publish.

Common gaps before submission

TNA not documented. For Category 3, item 3.1.1 explicitly needs a TNA. If you've been running training against the 95% model without a TNA, write one now — even retrospectively confirming your current training approach meets role-based needs.

Completion report from more than 12 months ago. Training needs to fall within the twelve months before you publish, not the twelve months before you started the assessment (see the worked example above). Chase renewals.

Agency and bank staff not tracked. Workers who cover infrequently are easy to miss. Establish a check at onboarding: training must be complete before first access to patient systems.

Records show training was assigned but not completed. A training platform record showing a module was assigned and opened but not completed isn't a completion record. Chase outstanding completions.

No record of checking that training worked. This is not a separate Category 3 or 4 evidence item, but a brief note showing you checked understanding (for example, quiz pass rates) supports your Training Needs Analysis.

The DSPT evidence checklist generator lists every mandatory evidence item for your category, so you can tick off the Standard 3 items alongside the rest. For the complete list of evidence requirements across all 10 standards, see our DSPT evidence requirements guide.

What changed in 2023/24 — and for whom

If you have read that the DSPT dropped the 95% training figure, that change was real but limited to Category one. The DSPT training guidance page says: "Until July 2023, the DSPT required that you train at least 95% of your staff using the national Data Security Awareness Level 1 e-learning or a local equivalent. This has changed for 2023/24." The same page scopes that change: "These changes apply to NHS Trusts, ALBs, CSUs, Key IT Suppliers, Independent sector OES organisations and ICBs that are all classed as Category one organisations for the DSP Toolkit." For those organisations, the 95% figure gave way to an "appropriate understanding" test built on a Training Needs Analysis.

Care homes, pharmacies, dentists and opticians are Category 3, and GP practices are Category 4, so the change did not apply to them. In the version 9 (2026-27) workbook, as in version 8, item 3.2.1 is marked "Required to meet standard (mandatory)" for both categories, and the TNA item 3.1.1 was already mandatory for Category 3 in the 2022-23 (version 5) workbook.

This guide reflects DSPT version 9 (2026-27), the current toolkit, and the training change guidance published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT staff training change guidance — NHS England
• e-Learning data security awareness FAQ — NHS England (who counts towards the 95% for item 3.2.1)
• DSPT version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 — NHS England
• DSPT v8 (2025-26) evidence-item requirements workbook — NHS England (sheet "25-26 requirements", row 34, evidence ref 3.2.1 — settles the Category 3/4 mandatory status of the 95% figure)
• Data security awareness e-learning — NHS e-Learning for Healthcare
• Data Security and Protection eLearning — Digital Care Hub
• Training Needs Analysis Template — Digital Care Hub
• National Data Guardian data security standards — GOV.UK

Standard 5 (Process Reviews) is about something narrower. Its mandatory item, 5.1.1, asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" That is covered below.

For small providers, the hardest part of a risk register isn't the assessment methodology — it's getting started. Many providers have good data security practices but have never sat down to document what risks those practices are managing.

What a useful risk register contains

Item 1.3.6 asks for your top three risks and your plan for each. A register that covers a few more gives you that answer and a record to keep up to date. It should show:

1. You have a risk register — documented risks specific to your organisation
2. Risks are scored — some form of likelihood × impact assessment, even if informal
3. Risks are owned — a named person responsible for each risk
4. Controls are recorded — what you've done to reduce each risk to an acceptable level
5. The register is reviewed — a recent review date shows it's a live document, not a one-time exercise

You don't need a formal risk management framework. A spreadsheet with those columns, reviewed regularly, with risks that are clearly specific to your organisation, is enough.

How to structure your risk register

A practical risk register format for a small provider:

Likelihood and impact can be scored 1-5 or Low/Medium/High — the scale matters less than applying it consistently. A risk score of likelihood × impact gives you a relative priority ranking.

Risk owner is the named person responsible for monitoring and managing that risk. In a small organisation, this is usually the practice manager, registered manager, or data protection lead for most risks.

Controls in place describes what you're already doing to reduce the risk. This is where your existing good practices get documented: encrypted devices, staff training, access controls, supplier DPAs.

Residual risk is the level of risk that remains after controls. Some risks can be reduced to near-zero (a fully encrypted, remote-wipe-capable device fleet reduces the risk from a lost device significantly). Others remain medium even with controls (phishing is a persistent risk regardless of training).

Risks to include for a small healthcare provider

These are realistic starting points — adapt them to your specific systems and setting:

Staff credentials shared or compromised. Likelihood: medium. Impact: high. Controls: unique accounts per staff member, no shared passwords policy, password manager or IT provider-managed credentials.

Mobile device lost or stolen with patient data. Likelihood: medium (particularly relevant for domiciliary care, dental/optician site visits). Impact: medium-high. Controls: full-disk encryption, MDM with remote wipe capability, no local storage of patient data where avoidable.

Phishing email resulting in account compromise. Likelihood: medium. Impact: high. Controls: staff phishing awareness training, MFA on all email accounts, email filtering.

Care or practice management system unavailable (ransomware or outage). Likelihood: low-medium. Impact: high. Controls: cloud-hosted systems reduce local ransomware risk, business continuity plan with manual procedures, daily backups.

Leaver retaining system access. Likelihood: low (with good process). Impact: medium-high. Controls: documented leaver procedure, access register with removal confirmation, access review at least quarterly.

Out-of-date software with unpatched vulnerabilities. Likelihood: low-medium. Impact: high. Controls: automated update policies, IT provider responsible for patching schedule, unsupported system register. If any system is past its manufacturer's support, item 8.1.4 asks whether "the risks are understood and managed" — see our guide to documenting unsupported systems risk.

Supplier processing patient data without a DPA. Likelihood: low (if Standard 10 is in place). Impact: high. Controls: supplier register with DPA status tracked, annual DPA review.

Verbal disclosure of patient information. Likelihood: medium. Impact: medium. Controls: staff training on confidentiality, consulting room / private conversation spaces, visitor management.

Aim for around 6-10 risks. A register with 6 specific, realistic risks is better evidence than one with 20 generic risks copied from a template.

Conducting the annual review

The annual risk review should be a deliberate activity — not just updating a date. For a small provider, a short review session with the practice manager or registered manager is proportionate. The review should ask:

• Are all the risks on this register still relevant?
• Has anything changed that creates a new risk? (New systems, new staff structure, new service types)
• Have any controls improved or deteriorated since the last review?
• Did any incidents occur in the last year that the risk register should have predicted? If so, does the register need updating?
• Are risk owners still in post?

Record the review: date, participants, whether risks were updated, and the next review date.

Where Standard 5 fits

Standard 5's mandatory item, 5.1.1 (Category 3 and 4), asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" NHS England's tooltip adds that "It is good practice to review processes annually even if a breach or near miss has not taken place", and that if there were no breaches or near misses in the last 12 months you tick and write "Not applicable". Your annual risk review is a natural place to record that review.

Connecting your risk register to other evidence

The risk register doesn't exist in isolation. It should connect to your other Standard evidence:

• Standards 1 and 2 — risks relating to staff behaviour (credential sharing, misdirected emails) should be addressed by your data security policy (Standard 1, item 1.3.1) and covered at induction (Standard 2, item 2.1.1)
• Standard 3 (training) — training records should cover the risks you've identified as training-mitigable (phishing, confidentiality)
• Standard 4 (access controls) — access register and leaver procedure directly mitigate access-related risks
• Standard 6 (incident response) — your incident procedure is the response to risks that materialise
• Standard 7 (continuity) — your BCP addresses the system-unavailability risks
• Standard 10 (suppliers) — your supplier register with DPAs addresses the third-party processing risk

If a risk on your register has no control listed — and that control is also absent from your other evidence — that's a substantive gap. If every risk on the register points to a documented control in another standard, that's coherent, well-integrated evidence.

Common gaps before submission

No risk register at all. This is the most straightforward gap to close: set aside a session to identify and document your top 6-10 risks. A spreadsheet created today is better than nothing.

Template risks not adapted. Generic risks from a download that don't reference your actual systems, staff structure, or services. Personalise each risk to your setting.

No named risk owner. "The organisation" is not a risk owner. Name a person.

Controls listed but not evidenced elsewhere. If your control is "staff training" but you don't have Standard 3 training records, the risk register control isn't backed by evidence.

Last reviewed date more than 12 months ago. Update it now, even if the risks haven't changed — record the review and confirm the risks remain accurate.

The DSPT evidence checklist generator lists every mandatory evidence item for your category, including 5.1.1. Item 1.3.6 is not mandatory, so it is not on that list. For the full NDG standards framework, see our evidence requirements guide.

This guide reflects the DSPT version 9 (2026-27) workbook (v1.1), which keeps version 8's mandatory items for Category 3 and 4, and was last reviewed on 5 November 2026. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT overview and introductory guidance — NHS England
• National Data Guardian data security standards — GOV.UK
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (items 1.3.6, 5.1.1, 8.1.4) — NHS England

For a small care home, pharmacy, or dental practice, the business continuity plan doesn't need to be a 50-page ITIL-compliant document. It needs to answer the question: "If our systems went down at 9am on a Monday, what would we do?" If your staff could answer that question and you have a written record of the procedure, you have the foundation of Standard 7 compliance.

What the DSPT requires

Standard 7 is more than the plan itself. In NHS England's version 9 (2026-27) workbook, six Standard 7 items are mandatory for Category 3 (care homes, domiciliary care, pharmacies, dentists and opticians) and four for Category 4 (GP practices):

Version 9 also added one optional item for both categories, 7.1.7: "Has your organisation tested or exercised its business continuity plan for a data or cyber incident within the last 12 months?"

In practice, that means:

1. A written business continuity plan that covers data and cyber security (7.1.2). NHS England's tooltip gives examples: what you would do if "you had a power cut; the phone line/internet went down; you were hacked; a computer broke down; the office became unavailable (for example through fire)."
2. Evidence that the plan is regularly reviewed (7.1.2).
3. Evidence that the plan has been tested, with a record of the test and any findings (7.1.2; for Category 3, 7.2.1 within the last twelve months).
4. Working backups, and a record of how you have tested them (Category 3: 7.3.1 and 7.3.4; Category 4: 7.3.4, whose tooltip also asks how you have tested them).
5. An emergency contact list kept off your computer (7.3.2).
6. An up-to-date digital asset register, reviewed at least once in the last twelve months (7.1.1).

The plan needs to cover the scenarios most relevant to your setting — not every possible disruption, but the ones that could plausibly happen and affect your ability to care for patients or clients safely.

Identifying your critical systems

Before writing the plan, identify which systems you rely on for safe, continuous care:

For care homes:

• Digital care planning software (your digital social care record)
• Medication management system (if electronic)
• NHSmail (for GP communications)
• Building security and door access systems

For GP practices:

• Your GP clinical system
• NHSmail
• Appointment booking and telephone system
• Repeat prescribing workflow

For dental practices:

• Practice management software
• NHSmail or shared NHS appointment booking access
• NHSBSA Compass for NHS claim submission

For pharmacies:

• Dispensing (PMR) system
• NHSmail
• NHS Spine access for Electronic Prescription Service
• Online repeat prescription ordering platform (if used)

For each system, record: what it's used for, what data it holds, and what you would do if it was unavailable for 4 hours / 24 hours / 72 hours.

What a small-provider BCP needs to cover

A proportionate business continuity plan for a small provider should address:

System recovery procedures. For each critical system: who do you call? What's the vendor emergency support number? How long is the expected recovery time? Is there a manual backup procedure while the system is down?

Manual backup procedures. This is the core of a healthcare BCP: what paper-based or manual procedures exist when systems are unavailable?

• Care homes: paper care records, paper MAR charts, paper visit rotas
• GP practices: paper appointment books, paper prescription pads, paper lab request forms
• Dental practices: paper appointment lists and treatment notes to key in later. FP17 claims are electronic-only, so if your practice system is down, use the NHSBSA Compass online form
• Pharmacies: paper dispensing records, paper intervention logs

Your BCP should state explicitly where these paper resources are kept and who is responsible for switching to manual procedures.

Incident command. Who is in charge during a system failure? Who makes the call to go manual? Who communicates with staff, patients, and external partners? In a small organisation, this is usually the registered manager, practice manager, or owner — but it needs to be named.

Communications. How do you notify patients or clients of service disruption? How do you communicate with referring organisations (GP referrals to pharmacy, home care agency notifying community nurses) if your usual communication channel (NHSmail, care system messaging) is unavailable?

Data recovery and backups. For systems where you hold the data (a local server rather than cloud-hosted software), what backup schedule exists? Where are backups stored? How long would restoration take? Item 7.3.1 asks you to "Briefly explain how your organisation's back up systems work and how you have tested them", and for Category 3 the 7.3.4 tooltip says backups should be "tested at least annually to make sure data and information can be restored". For cloud-hosted software, ask your supplier how they back up your data and how a restore would work.

Emergency contacts. Item 7.3.2 asks for an emergency contact list kept "somewhere separate from your computer or IT system, such as having a hardcopy". NHS England's tooltip says the contacts "should include your IT support company, IT systems suppliers, ICB/local authority commissioner(s), NCSC reporting line, and your Data Security and Protection Lead."

Ransomware response. Ransomware can lock several systems at once, including backups that are left connected, so your BCP should cover the first response: isolate affected systems, do not pay, and contact your IT provider immediately. For immediate help with a cyber security incident, call the Data Security Centre on 0300 303 5222. Report a notifiable personal data breach to the ICO (now formally the Information Commission) through the DSPT incident reporting tool within 72 hours of becoming aware of it; the tool also notifies NHS England and, for more serious incidents, the Department of Health and Social Care. Under UK GDPR a breach is notifiable unless it is unlikely to result in a risk to people's rights and freedoms. Our DSPT incident response guide covers the reporting steps.

Testing the plan

Item 7.1.2 asks whether the plan is "regularly reviewed and tested", and for Category 3, item 7.2.1 asks how you test it, adding "This should be in the last twelve months." For small providers, a tabletop exercise is the proportionate approach, and NHS England's tooltip for the new item 7.1.7 says so directly: "A test does not need to be a full simulation." Its example is a team talking through what they would do if their clinical system or NHSmail was unavailable, which "counts as an exercise".

A tabletop exercise involves key staff walking through a scenario together and working out what they would actually do. The point is to test whether the plan is realistic — whether the procedures are documented, accessible, and understood — not to simulate a live disaster.

How to run a tabletop exercise:

1. Choose a scenario: "Our care management system is unavailable from 8am. It's now 11am and the vendor says recovery will take at least 12 hours."
2. Gather key staff: registered manager, deputy manager, possibly a senior care worker.
3. Walk through the scenario: What do we do? Who phones who? Where are the paper records? What do we tell families?
4. Record what you discussed, what you found (gaps, things that worked, things that didn't), and what actions you're taking.

NHS England's 7.1.7 tooltip asks you to "Record the date, who participated, what was discussed, and any actions or learning that followed." A one-page exercise record covering those points shows the plan exists, was tested, and is being improved.

Reviewing the plan

Item 7.1.2 asks that the plan is "regularly reviewed"; it does not set a frequency. Putting an annual review date in the document header is a sensible rhythm. The review should check:

• Are all named contacts still in role?
• Have any critical systems changed? New software, new cloud platform?
• Have vendor support numbers changed?
• Are paper backup resources still stocked and accessible?
• Has anything changed in care delivery (new services, new client cohorts) that changes your continuity needs?

Update the review date and add a review note. File the previous version so you have an audit trail.

Common gaps before submission

No plan exists at all. Start with a single page covering your most critical system. You can expand it, but having something specific and reviewed is more valuable than having nothing.

Plan exists but hasn't been reviewed. Update the review date and confirm the plan is still accurate.

No test record. Run a short tabletop exercise and document it. This is often faster than writing the plan if you already have informal procedures.

Plan doesn't address ransomware. Make sure the plan covers the first response steps set out under "Ransomware response" above.

Backups never restored. A backup you have never restored from is an assumption, not evidence. Ask your IT provider to run a test restore and note the date (7.3.4).

Emergency contacts only on the computer. If the contact list lives in the system that has failed, nobody can find it. Print it and keep it with the plan (7.3.2).

Manual backup procedures aren't documented. The plan says "go manual" but doesn't say what that means, where the paper records are, or who decides. This is the gap that turns a two-hour incident into a 12-hour one.

Use the DSPT evidence checklist generator to see your Standard 7 items alongside every other mandatory evidence item for your category. For Standard 7 in the context of domiciliary care — where BCP has additional field-worker dimensions — see our

domiciliary care guide.

This guide reflects the DSPT version 9 (2026-27) workbook (v1.1), whose mandatory Standard 7 items are the same as version 8's, and was last reviewed on 5 November 2026. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT overview and introductory guidance — NHS England
• National Data Guardian data security standards — GOV.UK
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (Standard 7 items 7.1.1–7.3.4) — NHS England
• DSPT incident reporting — NHS England
• UK GDPR Article 33: Notification of a personal data breach — legislation.gov.uk
• Mandating of electronic FP17 transmissions, 14 November 2018 — NHS Business Services Authority

This standard is often where providers make their first contact with concepts from UK GDPR — controller vs processor, lawful basis, and the Article 28 requirements for written processing contracts. You don't need a legal background for this, but UK GDPR does require the written contracts.

Data controllers and data processors

Before looking at what evidence you need, it helps to understand the UK GDPR roles:

You are a data controller. You decide what patient or client data you collect, why you collect it, and how long you keep it. You're responsible for that data's security.

Your suppliers are (mostly) data processors. When a supplier — your practice management software vendor, your IT provider, your cloud storage service — processes patient data in order to provide their service to you, they are processing it on your behalf. Under UK GDPR, that relationship must be governed by a written contract.

This written contract is the data processing agreement. It must cover the terms listed in Article 28(3) UK GDPR, including that the processor only processes data on the controller's documented instructions, takes the security measures Article 32 requires, helps the controller respond to data subject rights requests, and deletes or returns the data when the service ends.

Many established NHS software providers have standard DPA terms available. If your supplier's DPA terms are embedded in their standard service agreement, that counts.

Building your supplier register

Start with a list of all third parties who handle patient, client, or staff personal data. For a typical small Category 3 provider:

Near-certain processors:

• Practice management or care management software (your care records or practice system supplier)
• Managed IT provider (if you use one)
• Email service (NHSmail, Microsoft 365, Google Workspace)
• Cloud backup or storage service (OneDrive, Google Drive, Dropbox, etc.)
• Payroll service (if they handle staff personal data on your behalf)

Possibly processors (depending on how you use them):

• Telephone answering or call management services (if call recordings include patient-identifiable data)
• Online appointment booking platforms
• Patient communication services (SMS appointment reminders, etc.)
• Referral management platforms

For each supplier, record:

• Supplier name
• What personal data they process
• Data processing agreement in place (yes/no; date; where stored)
• For IT suppliers, the cyber security certification you checked (Cyber Essentials / ISO 27001 / DSPT status / Assured Solutions List) or, if none, the other checks you made
• Date you last checked it
• Named account manager or compliance contact

NHSmail is a national service, but list it on your supplier register like any other, and use the NHSmail support pages for how the service handles data.

Getting DPAs in place

For major NHS-integrated software, DPA terms are usually part of the standard service agreement or available on request. If you don't have a DPA with a key supplier:

1. Check your original contract for data processing or GDPR-related clauses.
2. Contact the supplier and ask for their standard DPA or data processing addendum. Most will have a pre-prepared document.
3. If the supplier is unwilling to provide DPA terms, that's a significant concern — it may indicate they aren't compliant with UK GDPR obligations. Escalate to the supplier's compliance team.

For large cloud platforms:

• Microsoft 365 / OneDrive: Microsoft publishes its data protection terms with its product licensing terms; find the current document on Microsoft's trust and compliance pages, or ask your reseller.
• Google Workspace: Google's Cloud Data Processing Addendum (CDPA), previously called the Data Processing Amendment, is in the Google Admin console under Account > Account settings > Legal and compliance. You only need to opt in if your agreement does not already include it.

What the version 9 toolkit asks under Standard 10

NHS England's v1.1 of the version 9 (2026-27) workbook "includes updated 10.2.1 requirement for category 3 and 4 organisations". The Standard 10 items for Category 3 and 4 are:

• 10.1.2 (mandatory): "Does your organisation have a list of its suppliers that handle personal information, the products and services they deliver, and their contact details?"
• 10.2.1 (mandatory): "Does your organisation assure that your IT system suppliers have robust cyber security arrangements?"
• 10.2.2 (not mandatory): "Contracts with all third parties that handle personal information are compliant with ICO guidance."
• 10.2.6 (new in version 9, not mandatory): whether non-IT suppliers working on your premises, such as cleaning or facilities staff, contractors, HR or other back-office staff, or organisations renting space, are kept from inappropriate access to information.
• 10.2.7 (new in version 9, not mandatory): if you or your suppliers process identifiable patient or service user information outside the UK, whether you have risk-assessed it and put governance in place.
• 10.3.1 (Category 3 only, not mandatory): a list of data security incidents with current suppliers that handle personal information.

Checking your IT suppliers' security (item 10.2.1)

NHS England's guidance for 10.2.1 says to check that any supplier of IT systems, and your IT support company, has a cyber security certification. In the order NHS England lists them:

Cyber Essentials, ideally Cyber Essentials Plus. If a supplier says it is certified, confirm it has an in-date certificate on the IASME certificate search.

ISO 27001. The guidance notes "There isn't a public register of ISO 27001 certified companies", so ask the supplier for a copy of the certificate issued by its certification body and check it is in date.

DSPT Standards Met, ideally Standards Exceeded. You can check a supplier's DSPT status at dsptoolkit.nhs.uk/OrganisationSearch. Note the supplier name, their DSPT status, and the assessment year.

The Assured Solutions List. If your digital social care record supplier is on it, the guidance says it has "been assured by NHS England to meet cyber security requirements".

If a supplier has no certification, the guidance says to "briefly outline" what you do to make sure they are "adequately prioritising data protection and cyber security". That is where a SOC 2 report, a completed security questionnaire or a signed statement from the supplier's technical lead fits. None of these is on NHS England's list of certifications, so describe what you checked. The guidance also suggests checking for recognised cyber security training and including cyber security requirements in your contracts.

In your 10.2.1 answer, NHS England asks you to "Briefly explain what cyber security certification your suppliers have and what checks you have undertaken to assure this." Your supplier register should record that for each IT supplier, with the date you checked.

If you are unsure whether to bring in outside help to gather this evidence, see DSPT consultant or do it yourself.

Annual review

Standard 10 evidence needs to be current. Before each DSPT cycle:

• Check that DPAs are still in place — not expired or superseded by a new service agreement that doesn't include processing terms.
• Re-check each IT supplier's certification: the IASME certificate search for Cyber Essentials, the expiry date on the ISO 27001 certificate, or the supplier's DSPT status.
• Refresh your notes on the checks you made for suppliers without a certification.
• Check for new suppliers added since your last review.
• Check for suppliers you no longer use — confirm data has been deleted or returned per the DPA terms.

A dated review note in your supplier register, even just "Reviewed [date]: certifications re-checked for [IT supplier list]; supplier list updated; DPAs current", provides clear evidence that you actively manage this standard rather than treating it as a one-time setup task.

Common evidence gaps

No record of the 10.2.1 check. The item asks what certification each IT supplier has and what checks you made. A supplier list with nothing in that column leaves the question unanswered.

Large cloud platforms assumed to be fine. A household name is not a record. For 10.2.1, record which certification you checked for each platform and where, as for any other IT supplier, and keep its published data processing terms with your contracts.

No DPA with a major software supplier (UK GDPR, not a mandatory DSPT item). UK GDPR requires one for every supplier that processes personal data for you. Check your contracts and request DPA terms from any supplier not covered.

No DPA with your IT provider (UK GDPR, not a mandatory DSPT item). If your IT provider has access to systems holding personal data — even just for maintenance and support — they are a data processor. You need a DPA with them.

To see the mandatory Standard 10 items alongside every other mandatory item for your category, use the DSPT evidence checklist generator.

This guide reflects DSPT version 9 (2026-27), the current toolkit: the Standard 10 item wording above is taken from NHS England's version 9 workbook (v1.1), which updated item 10.2.1. UK GDPR applies across the UK; the DSPT itself applies to organisations in England. This is not legal advice. For questions about your UK GDPR obligations, consult a qualified data protection practitioner.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (Standard 10 items) — NHS England
• DSPT organisation search — NHS England
• UK GDPR Article 28: processor — legislation.gov.uk
• Cloud Data Processing Addendum for Google Workspace — Google
• Controllers and processors: data processing contracts (Article 28) — ICO
• National Data Guardian data security standards — GOV.UK

Access control evidence is often incomplete not because organisations have bad practices, but because they've never documented what they're already doing. The work here is mostly documentation of existing processes.

What Standard 4 requires

In NHS England's version 9 (2026-27) workbook, Category 3 has five mandatory Standard 4 evidence items:

An up-to-date record of staff and their roles (4.1.1). The item asks: "Does your organisation have an up to date record of staff, and volunteers if you have them, and their roles?" NHS England's tooltip says the list should be kept up to date, "including any change of role, new starters and removal of leavers", and that it "might be linked to your existing payroll or rostering system".

A reliable way of removing or amending access (4.2.4). "Does your organisation have a reliable way of removing or amending people's access to IT systems when they leave or change roles?" The tooltip says this "could be by periodic audit", and that leavers who had access to personal data should have their access rights revoked "in line with your policies and procedures" — shared email addresses included.

A signed administrator accountability agreement (4.3.1). All administrators of your IT systems must sign an agreement holding them accountable to higher standards of confidentiality. For Category 3 it has been mandatory since the 2025/26 (version 8) cycle, after being optional in version 7, so providers who completed earlier versions can easily have missed it. For GP practices (Category 4) it was already mandatory.

Multi-factor authentication (4.5.3). For Category 3 the item reads: "Multi-factor authentication is used on all remotely accessible and privileged user accounts ... on all systems, with exceptions only as approved by your board or equivalent senior management." So for Category 3, administrator (privileged) accounts are in scope as well as remotely accessible ones. For GP practices (Category 4) it covers "all remotely accessible user accounts on all systems", with exceptions approved by "a relevant board or senior management". The Category 4 tooltip adds that exceptions for ICB-commissioned services "should be decided by the ICB board or senior management", while those for practice-commissioned services "may be decided by the practice management".

Good password practice (4.5.4). "How does your organisation make sure that staff, directors, trustees and volunteers use good password practice?" The tooltip expects each person to have their own passwords, and those passwords to be "'strong' i.e. hard to guess" — enforced by your systems where possible.

GP practices (Category 4) have the first four of these as mandatory items; 4.5.4 is a Category 3 item.

Good practice that makes 4.1.1 and 4.2.4 easy to evidence

None of the following is a separate evidence item. Together they are the simplest way to show the up-to-date record 4.1.1 asks for and the reliable process 4.2.4 asks about.

An access control policy. A written statement of how access is granted, reviewed, and removed. This can be a section of your data security policy rather than a standalone document. It should cover: who can authorise new access, what the minimum-access principle means in practice for your organisation, and what the leaver process involves.

An access register. A list of who has access to which systems and at what level. For a small care provider, this might be a spreadsheet with columns for: staff name, role, system, access level, date granted, date last reviewed, and date removed (if applicable). The register needs to be current — a register that includes people who left 18 months ago is worse evidence than no register.

A joiner process. Documentation of how new starters get system access: who requests it, who approves it, what level of access is appropriate for the role, and confirmation that access was set up correctly.

A leaver process. Documentation of how access is removed when staff leave: who is notified, what systems need to be updated, who confirms removal, and how quickly. The timeline matters — leavers with high-level access are a security risk for every day their credentials remain active.

The administrator agreement (4.3.1)

Evidence item 4.3.1 asks: "Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?" The question is not new: NHS England's version 7 (2024-25) workbook has it with the same wording. What changed is its status. NHS England's version 8 change log records "Evidence item made mandatory for category 3 - 4.3.1"; for GP practices (Category 4) it was already mandatory in version 7, and in version 9 (2026-27) it is mandatory for both. The people who administer your IT systems can access more information than other staff, so they need to be formally held to higher standards of confidentiality than others.

This requirement applies to IT system administrators in external companies that support your systems, not just internal staff. For a typical small Category 3 provider, the people in scope might include:

• Whoever administers your clinical or care management software
• Your NHSmail or email administrator
• Your IT support company or managed service provider (MSP)
• Anyone with administrator access to cloud storage or backup services holding personal data

How to meet it. The agreement can be part of a job description or built into a contract with your IT support company or systems supplier. Digital Care Hub (the care-sector support website that hosts the Better Security, Better Care programme) publishes a Privileged Access Agreement template that you can download and adapt. The evidence is the signed agreement (or the relevant clause in a contract or job description) for each administrator.

Keep access minimised too. While documenting who your administrators are, it's good practice to confirm that admin access exists only where genuinely needed. If your care management software has ten staff with admin access because it was easier to set everyone up that way, that's a weakness worth addressing. The ideal position is the minimum number of administrators needed to manage each system, all of whom have signed the accountability agreement and have MFA enabled.

If your IT provider holds administrator accounts, ask them to confirm in writing that their administrators are bound by an equivalent accountability agreement. That confirmation can serve as part of your evidence.

Managing joiners: a practical process

The weakness to design out is ad hoc access management — giving new starters access when they ask for it, without a documented process. The DSPT doesn't require a formal IT ticketing system. A simple documented workflow is sufficient.

A practical joiner process for a small provider:

1. Line manager or practice manager completes a brief access request form (or email): name, role, start date, systems needed, access level requested.
2. Access is provisioned and confirmed — ideally by IT if you use an MSP, or by the systems admin if not.
3. A record is added to the access register: name, systems, access level, date granted.
4. New starter confirms receipt of credentials and completes initial data security training before first access to patient/client data.

The form doesn't need to be elaborate. An email chain that shows these steps happened is sufficient evidence.

Managing leavers: what often goes wrong

Leavers who still have active system credentials are a common access control gap, and they are exactly what item 4.2.4 asks about. The failure mode is usually not malicious — it's administrative: someone leaves, the manager handles the handover, and nobody specifically tells the system admin to remove access.

A robust leaver process should trigger on notice, not on last day. When someone hands in their notice, that's the time to start planning access removal — including lining up who will take over their admin responsibilities if applicable.

On the last day (or as close to it as possible):

• Disable or delete accounts in all systems holding personal data
• Change any shared passwords the leaver knew
• Recover any employer-provided devices
• Update the access register with the deactivation date

Keep a record that access was removed and when. If you use an IT provider, ask them to confirm removal in writing and file that confirmation.

For the DSPT (item 4.2.4), good evidence is: your policy says leavers get access removed promptly, your access register shows current staff only (or shows leavers with a removal date), and your process documentation shows who is responsible for removal.

Reviewing access periodically

An access register isn't a one-time document. NHS England's tooltip for 4.2.4 names periodic audit as one way "to make sure that people's access rights are at the right level", and it is a good habit as roles change. For small providers, a quarterly or six-monthly review is proportionate:

• Is every person on the register still employed?
• Has anyone's role changed in a way that should change their access level?
• Are there any access levels that were granted temporarily and should now be removed?
• Are admin accounts still held only by people who need them?

A dated review note at the bottom of your access register spreadsheet is sufficient evidence of periodic review. "Reviewed by [name], [date] — no changes required" is a valid review record.

Common gaps before submission

Access register not current. Leavers still listed, or register not updated since it was created. Update before submission.

No signed administrator agreement. Mandatory for Category 3 since v8, so providers who set up their Standard 4 evidence before then may not have one. Get each IT administrator (internal and external) to sign an accountability agreement now, using the Digital Care Hub Privileged Access Agreement template or a clause in their contract or job description.

Joiner and leaver procedures not documented. If your process is informal, document it. A one-page description of who does what is sufficient.

MFA gaps. Item 4.5.3 is mandatory (its scope is set out above). Until MFA is switched on, or each gap is recorded as an approved exception, you will not be able to confirm 4.5.3. Contact your IT provider or system vendor about enabling MFA — for most platforms it's a settings-level change.

No password guidance (Category 3). Item 4.5.4 is mandatory for Category 3 (see above), and its tooltip says your organisation "should provide advice for setting and managing passwords". If staff have no written password advice, write a short one now.

The DSPT evidence checklist generator lists every mandatory evidence item for your category, including the Standard 4 items above, so you can tick them off alongside the rest of your submission. For the full evidence framework, see our DSPT evidence requirements guide.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• Version 9 (2026-27) evidence-item workbook, items 4.1.1 to 4.5.4 — NHS England
• Version 8 (2025-26) evidence-item workbook, item 4.3.1 and change control — NHS England
• Version 7 (2024-25) evidence-item workbook, item 4.3.1 — NHS England
• DSPT overview and introductory guidance — NHS England
• National Data Guardian data security standards — GOV.UK

Getting this right means knowing two routes: your own internal escalation, and the external report, which for health and care organisations goes to the ICO (now formally the Information Commission) through the DSPT's own incident reporting tool.

What counts as a data security incident

The DSPT defines a data security incident broadly. The following all qualify:

Loss or theft of devices. A phone, laptop, tablet, or USB drive containing patient or client data that goes missing — whether lost or stolen. Even if the device is encrypted and you're confident the data wasn't accessed, you should log the incident and document your assessment.

Misdirected communications. An email, letter, or fax sent to the wrong recipient where the content included personal data. This is one of the most common incident types for small providers — a GP receptionist or care home office sending an appointment letter to the wrong address, or a staff member replying-all when they intended a direct reply.

Unauthorised access. A staff member accessing patient or client records they have no legitimate reason to view. For care providers, this includes staff accessing records of patients who aren't under their care. For practices, it includes out-of-hours access to records that have no clinical justification.

Ransomware and malware. Any malware infection affecting systems that hold personal data, regardless of whether data exfiltration is confirmed. The uncertainty itself is an incident.

Verbal disclosure. Patient data discussed in a waiting room, corridor, or public setting where it could be overheard. Less common in DSPT incident logs but still qualifies.

System access by a former staff member. An ex-employee accessing your systems with credentials that should have been deactivated is a serious access control incident.

The two reporting routes

1. Internal incident procedure

Every incident should first go through your own internal process: the person who discovers or causes an incident reports it to your named data protection lead (or equivalent). Your procedure should specify how this report is made, what happens next, and what gets recorded. This is the foundation of Standard 6 compliance — without it, the external report can't happen on time.

2. Reporting to the ICO through the DSPT incident reporting tool

NHS England's overview guidance for the toolkit says: "It is the duty of all health and care organisations that process personal data to report any data breaches to the Information Commissioner's Office (ICO) via the DSPT within 72 hours of discovering an incident." That means notifiable breaches, with the clock running from when you become aware (both explained below). The DSPT includes a tool for reporting data security incidents "to the Information Commissioner's Office, the Department of Health and Social Care and NHS England". So the same report also tells NHS England and, for more serious incidents, the Department. NHS England's incident guide adds that the ICO has asked health and social care organisations to use this tool "in preference to the ICO provided reporting mechanism".

The tool also helps you decide whether a breach is reportable. You grade the likelihood and the severity of harm; where it is at least likely that some harm has occurred and the impact is at least minor, the incident is reportable and the details are emailed to the ICO automatically. Toolkit item 6.1.1 says the same thing in its guidance: if you are not sure whether to inform the ICO, "the toolkit's incident reporting tool and guide can help you to decide."

Under UK GDPR Article 33(1), you must notify "without undue delay and, where feasible, not later than 72 hours after having become aware of it". NHS England's guide says an organisation is aware when it has "a reasonable degree of certainty" that a security incident has led to personal data being compromised. It adds that "once a member of staff or the public has reported a breach this is the point that an organisation is aware." The clock does not wait for the data protection lead to hear about it or for an investigation to finish. This is why your internal procedure needs to mandate immediate escalation, and why staff training needs to cover "if you see something, you tell [name] immediately."

If the tool is unavailable, NHS England's guide says you can report through the ICO helpline instead, or report through the tool once it is available again and note the reasons for the delay in the form. For immediate advice on a cyber security incident such as ransomware, the toolkit's incident reporting page gives the Data Security Centre's number: 0300 303 5222.

What the toolkit asks under Standard 6

In version 9 (2026-27), the first three Standard 6 items are about breaches. Each is a yes/no question:

• 6.1.1 (mandatory for Category 3 and Category 4): "Does your organisation have a system in place to report data breaches?" Its guidance says the toolkit's incident reporting tool "should be used to report health and care incidents" to the ICO.
• 6.1.2 (mandatory for Category 3; not mandatory for Category 4): "If your organisation has had a data breach, were the management team notified, and did they approve the actions planned to minimise the risk of a recurrence?"
• 6.1.3 (mandatory for Category 3 and Category 4): "If your organisation has had a data breach, did you consider the risk to affected individuals and inform them where the risk was high?"

If you have had no breaches in the last 12 months, the guidance for 6.1.2 and 6.1.3 says to tick the item and write "Not applicable" in the comments box.

Telling the people affected. 6.1.3 reflects UK GDPR Article 34(1): when a breach "is likely to result in a high risk to the rights and freedoms of natural persons", you must tell the people affected "without undue delay". The item's guidance gives examples: information that "could allow criminals to commit identity fraud", or people "at risk of being targeted by people with malicious intent". Your procedure should include this step, and your log should record whether you told people and, if not, why you judged the risk not to be high.

What your incident log needs to contain

The DSPT requires evidence of an incident management process. Your incident log is the primary artefact. A useful incident log entry should include:

• Date incident occurred (if known)
• Date organisation became aware (this is when the 72-hour clock starts)
• Nature of the incident — what happened, what data was involved, how many individuals affected
• Severity assessment — your judgement on the risk to individuals affected
• Reporting decision — whether the incident was reported through the DSPT incident reporting tool and whether it was graded as reportable to the ICO; or if not reported, why not (i.e. why the risk to rights and freedoms was assessed as unlikely)
• People informed — whether the individuals affected were told, and if not, why the risk was not judged high
• Actions taken — how the incident was contained, what you changed to prevent recurrence, and the management team's approval of those actions
• Outcome — what happened after the report if made (ICO case reference number if applicable)

An entry might be three lines long or three paragraphs, depending on severity. The key is that the decision-making trail is visible.

An empty log is not automatically good evidence. An empty log for a mature provider might be legitimate. But an empty log with no record of how you log incidents, or how staff are trained to identify and report them, raises questions for anyone who reads it, such as a commissioner. If you had no incidents in a year, record that fact explicitly.

Risk assessment for incident classification

Not every personal data breach is legally notifiable to the ICO. Article 33(1) requires notification "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." So the default is to notify: you can decide not to only where you assess the risk as unlikely, and you should record why. In practice:

Likely notifiable:

• Medical data disclosed to an unintended recipient (high sensitivity personal data)
• Significant volume of records affected, even if low sensitivity
• Deliberate exfiltration (ransomware, malicious access)
• Breach involving vulnerable individuals (child records, mental health data)

May not be notifiable:

• Encrypted device lost with no evidence of access
• Minor misdirection error (one letter to wrong address, non-sensitive content, quickly resolved)
• System outage with no confirmed data loss

When in doubt, report. NHS England's incident guide says: "If there is any doubt that a breach is significant enough for notification it is always best to notify." The ICO accepts that you may not have the full picture within 72 hours: give it what you know, and add the details later without undue delay.

What good Standard 6 evidence shows

Category 3 and 4 submissions are self-assessed rather than audited, so this is about what your own evidence should show. Standard 6 rests mainly on your incident log and your procedure document. Check that they show:

1. You have a procedure — written, available, and current
2. Staff know about it — training records show incident reporting is covered
3. You've used it — the log shows the process was followed when incidents occurred, or shows a conscious decision that no notifiable incidents occurred
4. Your response was proportionate — reportable breaches went through the DSPT incident reporting tool; minor incidents were logged and assessed

A provider who has zero incidents logged over 12 months but can show that their training covers reporting, their procedure is accessible, and their data volumes are genuinely low is presenting strong evidence. A provider with an empty log and no indication they've thought about incidents is not.

Common gaps to fix before submission

No procedure document. Your incident management policy needs to be a named document, not just practice knowledge. It can be a page within your data security policy or a standalone annex.

Procedure doesn't cover the 72-hour window. Many older incident procedures say "report promptly" without specifying the legal deadline. Update it to reference 72 hours, name the reporting contact, and name the DSPT incident reporting tool as the route to the ICO.

Procedure doesn't cover telling the people affected. Add the 6.1.3 step: consider the risk to the individuals, and tell them without undue delay where it is high.

No log at all. Start one now, even if it's a spreadsheet. Log the date you created it and add any incidents you can recall from the past 12 months that you didn't record at the time. A retrospectively created log is weaker evidence than a current one, but it shows awareness.

Training doesn't cover reporting. If your data security awareness training (Standard 3) doesn't include a module or section on what counts as an incident and how to report it, staff training records don't support your Standard 6 evidence.

To see every mandatory evidence item for your category across the ten standards, use the DSPT evidence checklist generator or read the DSPT evidence requirements overview.

This guide reflects DSPT version 9 (2026-27), the current toolkit: the Standard 6 item wording above is taken from NHS England's version 9 workbook (v1.1). UK GDPR applies across the UK; the DSPT itself applies to organisations in England. For specific legal advice on breach notification or ICO reporting obligations, consult a qualified data protection practitioner. This is not legal advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT overview and introductory guidance (section 16: incident reporting) — NHS England
• DSPT incident reporting — NHS England
• Guide to the Notification of Data Security and Protection Incidents (PDF) — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (items 6.1.1–6.1.3) — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• UK GDPR Article 33: notification of a personal data breach — legislation.gov.uk
• UK GDPR Article 34: communication of a personal data breach to the data subject — legislation.gov.uk
• Personal data breach reporting — ICO
• National Data Guardian data security standards — GOV.UK

For Category 3, three more mandatory items look inside the policy:

• Item 1.3.7 asks whether your data protection policy describes how you keep personal data safe and secure (data protection by design and by default).
• Item 1.3.8 asks whether it describes how you identify and minimise risks to personal data when you introduce or change a process or start a new project (a Data Protection Impact Assessment).
• Item 1.3.11 applies if staff use their own devices for work. It asks whether you have a bring-your-own-device policy, and whether there is evidence of how it is enforced.

The sections below show where each fits.

Getting this right isn't about writing a lengthy document. It's about having a policy that's specific to your organisation, kept up to date (NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum"; we suggest reviewing it every year), and acknowledged by staff. The usual weak spot is not a badly written policy but one that hasn't been reviewed recently, or one that no one has been asked to read.

What the policy needs to cover

NHS England's tooltip for item 1.3.1 sets the minimum: "As a minimum your policy/policies should cover:" data protection and confidentiality — "how the organisation complies with UK GDPR and the Caldicott Principles, including data breach management, risk assessment, data subject rights, and data protection by design and default"; records management, defining "how records will be safeguarded from their creation to disposal, including accuracy, access, retention and disposal"; and cyber security, for example "password management, device and network security, backups, and technical security controls". "If relevant, remote working and bring your own device" should be covered too. You can have one policy or several, and the areas below can overlap and combine, but the content needs to be there.

Data handling expectations. How staff should handle patient or client data: on which systems, on which devices, what to do if they need to share data with a third party. The key principle is that personal data is used only for the purpose it was collected, shared only with authorised recipients, and kept no longer than needed.

Data subject rights and breach management. How you respond when someone asks for a copy of their data or asks you to correct it, and how a data breach is managed and reported. NHS England's minimum lists both under data protection and confidentiality.

Data protection by design and by default (item 1.3.7, Category 3). NHS England's tooltip asks the policy to describe how you identify and account for privacy and data protection issues "before commencing a new project or process" (by design), and how you collect, use and share "the minimum amount of data necessary for the purpose", make data available only to those who need it, keep it only as long as needed and tell people what you do with it (by default).

New projects and DPIAs (item 1.3.8, Category 3). The policy should describe how you systematically identify and minimise the data protection risks of a new project or plan that involves personal data — NHS England's examples include introducing a new care recording system, installing CCTV or using new remote care or monitoring technology. Its tooltip names this: "This type of risk assessment is called a Data Protection Impact Assessment (DPIA)." Say when you consider a DPIA and who signs it off.

Records management. How records are kept accurate and secure from creation to disposal: who can access them, how long you keep each type (item 1.4.1 asks for a timetable setting out how long you retain records), and how you dispose of them securely.

Access management. Who has access to which systems, how new access is authorised, and what happens when someone leaves. Your policy should state that access is role-appropriate, that leavers have access removed promptly, and that admin accounts are minimised and documented.

Device use. Whether staff can use personal devices for work purposes and, if so, under what conditions. If you allow BYOD, the policy needs to address encryption requirements and what happens if a personal device is lost or stolen, and for Category 3 item 1.3.11 also asks for evidence of how the policy is enforced. If you don't allow BYOD, the policy should state that clearly. NHS England's minimum also puts password management, network security and backups under cyber security, so say how each is handled, even if your IT provider does the work.

Incident reporting. How staff identify a data security incident (from a lost USB drive to an email sent to the wrong person) and who they report it to. The policy should name the reporting contact and include a brief description of what counts as a reportable incident.

Named responsibility. The name or role of the person or people with overall responsibility for data security and protection. Item 1.1.5 asks you to name them and say how the responsibility was formally assigned. This can be the registered manager, practice manager, or a named lead, and naming them in the policy helps staff know who to go to.

Training expectations. A statement that staff are expected to complete data security awareness training every year. The DSPT measures this at item 3.2.1: at least 95% of staff, directors, trustees and volunteers trained in the last twelve months.

What makes evidence strong vs weak

The DSPT doesn't require a perfect policy. It requires a policy that demonstrates your organisation is actively managing data security rather than ignoring it.

Strong evidence:

• A recent review date in the document header (within NHS England's three-year minimum; within the last year is better)
• Staff acknowledgement records — signature sheets, email confirmations, or a training completion record that includes the policy acknowledgement (good practice rather than a separate evidence item)
• Organisation-specific content — your actual systems, your named lead, your processes
• Consistent with other evidence items (your access register should reflect what the policy says about access management)

Weak evidence:

• A policy with no review date at all, or one not updated for more than three years
• A downloaded template with the placeholder organisation name still in it
• A policy that references systems or roles your organisation doesn't have
• No sign that staff have ever been asked to read it

What matters is whether you've genuinely engaged with the requirement or just ticked a box.

Reviewing and updating an existing policy

If your policy has not been updated for three years, update it before your next submission: NHS England's tooltip says policies "should be updated every three years as a minimum"; if it has not been looked at for a year, a review is good practice. Reviewing doesn't mean rewriting from scratch — it means:

1. Read it and check it's still accurate. Have your systems changed? Has your staffing structure changed? Is the named data lead still in that role? Update what's out of date.
2. Check it covers Standard 3's training requirement. For Category 3, the DSPT asks for a Training Needs Analysis (item 3.1.1, mandatory in version 9), and NHS England's tooltip says it "should identify the level of training or awareness raising required by your staff, directors, trustees and volunteers" — so your policy should reflect that staff training is TNA-driven and role-appropriate, not just "complete the e-learning module".
3. Update the review date. Change the date in the document header to today's date and record the review in your review schedule.
4. Re-circulate for acknowledgements. Even if the content barely changed, the annual review is a good opportunity to confirm that all current staff have seen the current version.

Collecting staff acknowledgements

Acknowledgements are not a separate DSPT evidence item, but they are good practice: a policy staff have never read does little, and the Standard 2 induction (item 2.1.1) is a natural place to collect them.

Ways to record it:

• Physical signature sheet — staff name, signature, date, policy version. Keep a copy in your HR file or data security folder.
• Email confirmation — ask staff to reply confirming they've read and understood the current policy. Keep the email chain.
• Training platform record — if you use an LMS or e-learning platform for data security training, include the policy acknowledgement as a step in the training module.
• A tick in your staff records spreadsheet — if you track training and acknowledgements in a spreadsheet, a column for "Policy acknowledged (date)" works, as long as you can show when it was completed.

What doesn't help: asserting that "staff are all aware of the policy" with nothing to show for it.

Keeping the policy current year to year

A data security policy only needs significant rewriting when your systems or processes change materially. For most small providers, the annual review involves:

• Updating the review date
• Checking named contacts are still current
• Checking any referenced system names are still accurate
• Adding a brief note if anything significant changed (new cloud storage platform, change in staff mix, new device policy)

The DSPT evidence checklist generator lists every mandatory evidence item for your category, so you can see how your policy (Standard 1) fits alongside the induction and contract items in Standard 2 and the training items in Standard 3. For a full breakdown of what the DSPT requires across all 10 standards, see our evidence requirements guide.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• Version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 (items 1.3.1, 1.3.7, 1.3.8, 1.3.11, 3.1.1) — NHS England
• National Data Guardian data security standards — GOV.UK

This guide covers what actually happens after you submit, the difference between maintaining your submission and starting over, and what to expect when the next version of the DSPT arrives.

What your submission status means now

For care providers, pharmacies, dental practices, opticians and GP practices the published statuses are Standards Met and Standards Exceeded, plus Approaching Standards for social care providers. NHS England also uses a "Standards Not Met" status. Its improvement-plan instructions cover Category 1 organisations (NHS trusts, ICBs, CSUs, ALBs, Genomics organisations and independent providers designated as OES), key IT suppliers and local authorities. Those that have not met the expected levels "should publish a Standards Not Met assessment and submit an improvement plan".

Most of this section is about Approaching Standards and Standards Met. Standards Exceeded sits above Standards Met. For most organisations it means Standards Met plus a current Cyber Essentials PLUS certificate recorded in the Organisation Profile; Category 1 organisations reach it instead by meeting the achievement levels forecast for the following year.

Approaching Standards is a fallback below the mandatory set — completing the mandatory assertions is Standards Met. Publishing at Approaching Standards means completing the 26 questions flagged for it and uploading an action plan: Digital Care Hub's publishing guide says you "will be asked to complete and upload an action plan on how you will complete the remaining questions". Your organisation's compliance status is shown as "Approaching Standards" on the public register at dsptoolkit.nhs.uk. NHS England's guidance names social care organisations as eligible for this one-off assessment; it does not mention pharmacies, dentists, opticians or GP practices, which should plan for Standards Met.

Standards Met means you completed the evidence items marked mandatory for your organisation type — NHS England describes it as "responding to all the questions within the assessment which are indicated as being MANDATORY". Digital Care Hub calls it "the level you really need to reach". If you hold an NHS contract or data sharing agreement, check what it says about your DSPT status.

If you submitted at Approaching Standards, you can continue working toward Standards Met by adding evidence to the portal. The deadline is when you publish your initial submission, not when you stop improving it.

Improving your submission after June

The portal remains open throughout the year. Common post-deadline improvements:

Filling gaps in non-mandatory items. You may have left some non-mandatory assertions incomplete to hit the deadline. Work through these systematically over July and August while the submission is fresh.

Updating evidence you have since improved. If you have rewritten a policy or brought a training log up to date since you published, replace the older version and check that the answer it supports still holds.

Updating the assessment notes. Where you wrote "in progress" or "we are working on this" against evidence items, replace those notes with confirmed evidence once it's complete.

Re-checking supplier certifications. For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better) and record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence. Re-check any certificate that will expire before your next submission.

Maintaining evidence between submissions

The DSPT is easier to keep current through the year than to rebuild every June. Three habits keep next year's submission small.

Keep training records current. Every new staff member, every joiner after June, needs data security awareness training. If you update your training log as people complete it rather than chasing everyone in April, the evidence is ready when you need it. The same applies to leaving dates: remove leavers from your active staff list at the point they leave, not when the DSPT opens.

Date-stamp policy reviews. NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum", so a policy with a visible, recent review date is acceptable evidence and a policy with no review date at all is not. Reviewing it every year is good practice: when you do, mark the review date in the document header and on your review schedule.

Ask your IT provider about changes. If your IT setup changes — new server, new cloud platform, new device management solution — ask your provider to confirm in writing how the change affects your data security. That lets you answer the next cycle's technical items accurately.

What to expect from the next cycle

NHS England typically releases a new version of the DSPT in late August or early September: versions 6 and 7 came out on 30 August 2023 and 30 August 2024. Version 8 was released on 1 September 2025, with its assertions and evidence items published on 18 September 2025, and its cycle ran to 30 June 2026. Version 9 (2026-27) followed the same pattern: it was released on 1 September 2026, NHS England published its outcomes, assertions and evidence items on 2 October 2026, and its deadline is 30 June 2027.

Each new version reflects updated guidance from NHS England and, where relevant, changes to the underlying Cyber Assessment Framework. For Category 3 and 4 organisations, the structure tends to be more stable than for larger organisations: NHS England's workbooks show the same 36 assertions in versions 7, 8 and 9, and version 9 kept the same mandatory items as version 8 while adding four optional ones. For the detail, see what changed in DSPT version 9.

With v9 open, your previous answers should still be there. Digital Care Hub's republishing guidance, linked from NHS England's DSPT overview, says "Your answers from your previous publication will be saved on your DSPT account". But each new toolkit year "the word COMPLETED will have disappeared from the final column", so you review each answer, update what has changed and mark it complete again. One caveat for version 9: NHS England's 1 September 2026 release notes record that it "Added the ability to clear previous answers and completion statuses when required for the new version". Several items were also reworded, so answers to reworded items may have been cleared. Check each one. Your underlying documents stay valid while they are current: a data security policy reviewed in May 2026 will still be inside NHS England's three-year minimum for a v9 submission, as long as you confirm it against any new requirements. Training counts if it was completed in the last twelve months before you publish: the 3.2.1 tooltip says "it is the last twelve months prior to the date of publication".

If you have not opened your v9 assessment yet, do it now — and set a diary reminder for late August next year, when NHS England typically releases the following version; the DSPT portal news page is where it is announced. Starting in September or October leaves time for the slow items — supplier checks, training completions, device replacements — before June.

Check your evidence stays live

One thing that's easy to forget after submission: some of your evidence has an expiry horizon. Training is the tight one: certificates for staff who completed training in June 2026 will be approaching 12 months old by June 2027, and 3.2.1 counts only the twelve months before you publish. Policies have more room — NHS England's minimum is an update every three years — but a policy reviewed in May 2026 is worth a quick annual review before your v9 submission.

A simple review schedule helps:

Using your submission for other purposes

A current DSPT submission is useful beyond the toolkit itself:

• CQC. CQC's well-led quality statement on governance, management and sustainability lists "Cyber security and data security and protection toolkit (DSPT)" among its subtopics. Digital Care Hub notes that CQC inspectors and commissioners can check your DSPT status: "Reaching Standards Met on the DSPT indicates a service is taking data security seriously."
• Your NHS contract. NHS England describes completion as "a contractual requirement specified in the NHS England Standard Conditions contract".
• NHS.net Connect. Digital Care Hub says "Approaching Standards also enables you to get NHS.net Connect (previously NHSmail)", the secure email system used to share confidential information with NHS and local authority colleagues.
• Staff onboarding. Your data security policy and training records are the foundation of good information governance for new starters — not just DSPT paperwork.

Next steps

• Take the DSPT readiness quiz for a quick readiness estimate across seven of the ten standards.
• Use the evidence checklist generator to list every mandatory evidence item for your category and tick off the ones that still need work.
• If you're a GP practice, pharmacy, or care home, our sector-specific guides cover the evidence requirements most relevant to your setting: GP practices, pharmacies, care homes.

This guide was written for DSPT v8 (2025/26) as published by NHS England and updated for the version 9 (2026-27) release: the v9 release date is from NHS England's release notes and the 30 June 2027 deadline from its version 9 announcement. Always check the official DSPT portal for current guidance. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• DSPT release notes — NHS England
• DSPT overview and introductory guidance — NHS England
• Improvement plans: instructions for 2025-26 — NHS England
• Republishing your DSPT — Digital Care Hub
• Publishing your DSPT for the first time — Digital Care Hub
• Check DSPT status — Digital Care Hub
• Well-led: governance, management and sustainability — CQC

Domiciliary care providers fall under Category 3 in the DSPT, the same category as residential care homes, pharmacies, and dental practices. The submission deadline is 30 June each year — the 2026-27 (version 9) deadline is 30 June 2027. Category 3 requires a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, though the exact count is set by your organisation type, so confirm it in your own toolkit — and no independent audit.

What makes domiciliary care different

Mobile devices holding patient data. Care workers in a residential home might access care planning software on a desktop or a tablet that never leaves the building. In domiciliary care, the device travels with the worker to every client visit. If a worker loses their phone or tablet, it may contain appointment schedules, care notes, or access credentials. Every device holding patient data needs to be encrypted — not just locked.

Data access in transit. Some domiciliary care workers use mobile apps to log care notes, medication administration, and visit times in real time. This data travels over the worker's mobile connection, through your care management software, and into your systems. The security of that transit depends partly on your software provider and partly on the connections workers use. NHS England's tooltip for item 6.3.2 says public or unsecured Wi-Fi "could be unsafe and lead to unauthorised access of personal data", so your policies should advise workers that using it for work is unsafe (see Standard 6 below).

Workforce structure. Many domiciliary care agencies use a mix of employed staff, bank workers, and sometimes self-employed carers. Each person accessing patient data needs to be covered by your training records and your access controls, and ideally by your policy acknowledgements. Bank workers who work infrequently are a common gap — they may not have completed your annual training refresher, or their access may not have been reviewed recently.

Multiple client locations. Unlike a care home where data relates to residents on site, a domiciliary care agency's records span dozens or hundreds of client addresses. Business continuity planning needs to account for what happens if your care management software is unavailable — how do workers know where to go and what care is needed?

The evidence you'll need

Standard 1 — Personal confidential data: An information asset register and record of processing activities (item 1.1.2) showing which systems hold client and staff data, what they hold and who you share it with. For domiciliary care, this typically includes your care management platform, NHSmail (if used), and any scheduling or communication apps. Note which data is accessed in the field and on which device types. Your data protection and cyber security policies also sit under Standard 1 (item 1.3.1): cover mobile device use, remote access and the specific risks of domiciliary care, and if staff use their own phones for work, item 1.3.11 asks for a bring-your-own-device policy and evidence of how it is enforced.

Standard 2 — Staff responsibilities: An induction that covers data security and protection, and cyber security (item 2.1.1), and employment contracts and volunteer agreements with data security clauses (item 2.2.1). NHS England's tooltip says these clauses should cover "confidentiality, integrity and availability", not just confidentiality. Include bank and agency staff in your induction records. Asking staff to confirm they have read the policy, by signature sheet or email, is good practice.

Standard 3 — Training: At least 95% of staff need to have completed data security training in the last twelve months (item 3.2.1, mandatory for Category 3). NHS England's Category 3 tooltip for 3.2.1 names a free course that "meets this requirement for staff working in adult social care": Digital Care Hub's Data Security and Protection eLearning. The NHS e-Learning for Healthcare data security module is also free. You need a Training Needs Analysis (TNA) completed in the last twelve months (item 3.1.1) and completion records that show you have reached the 95%. Checking that training worked is good practice, but it is not a separate Category 3 evidence item. Bank workers and infrequent staff are a common gap — document how they access and complete training.

Standard 4 — Managing data access: Five items are mandatory for Category 3:

• an up-to-date record of staff, and volunteers if you have them, and their roles (item 4.1.1);
• a reliable way of removing or changing people's access to IT systems when they leave or change role (item 4.2.4);
• a signed agreement holding your IT system administrators, including any external IT provider that administers your systems, to higher standards (item 4.3.1, which version 8 made mandatory for Category 3);
• multi-factor authentication on all remotely accessible and administrator (privileged) accounts on all systems, with any exceptions approved by senior management (item 4.5.3);
• advice to staff on good password practice (item 4.5.4).

An access register covering every system with patient data is the easiest way to evidence 4.2.4. Make it cover field worker app accounts, not just back-office logins, and document what happens to system access when a carer leaves or moves to bank status.

Standard 5 — Process reviews: A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none. NHS England's tooltip adds that "It is good practice to review processes annually even if a breach or near miss has not taken place." (Policy review belongs to Standard 1: NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum".)

Standard 6 — Responding to incidents: An incident response procedure and an incident log (item 6.1.1 asks whether you have "a system in place to report data breaches"). For domiciliary care, common incidents include lost or stolen mobile devices, care notes accessed on the wrong client, and messages sent to the wrong contact. Your procedure needs to address these field-based scenarios specifically, including reporting timelines and what constitutes a notifiable breach. If you had a breach, keep a record that the management team (or a nominated person) was told and approved the actions planned to minimise the risk of it happening again (item 6.1.2, mandatory). Also record that you considered the risk to the people affected and told them where it was high (item 6.1.3, mandatory). If you had no breach in the last 12 months, the tooltips say to tick and write "Not applicable".

Report a notifiable personal data breach to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of it; the tool also notifies NHS England and, for more serious incidents, the Department of Health and Social Care. Our incident response guide covers the steps. For immediate help with a cyber security incident, call the Data Security Centre on 0300 303 5222. Standard 6 also includes item 6.3.2, mandatory for Category 3: a record that staff have been advised that using public Wi-Fi for work is unsafe — directly relevant to carers working between visits.

Standard 7 — Continuity planning: A business continuity plan covering what happens if your care management software is unavailable. In domiciliary care, this is operationally critical: care workers need to know where to go and what care to deliver even if they can't access the digital system. Your plan needs paper-based backup procedures for visit schedules and essential care notes. Item 7.1.2 asks whether the plan is "regularly reviewed and tested", and item 7.2.1 asks how you test it, with NHS England's tooltip adding "This should be in the last twelve months." Standard 7 also holds four more mandatory Category 3 items:

• a digital asset register of your hardware and software, kept up to date (item 7.1.1) — list every phone and tablet issued to carers;
• working, secure backups of important data (item 7.3.1);
• backups that are tested to make sure data can be restored (item 7.3.4);
• emergency contacts kept securely, separate from your computer, and up to date (item 7.3.2).

Standard 8 — Unsupported systems: Item 8.1.4 asks whether all the IT systems and software you use are "still supported by the manufacturer or the risks are understood and managed". Aim for supported operating systems on every device, including those used by field workers; where something unsupported stays in use, item 8.2.1 asks for a document summarising the risk, why you are keeping it and what you are doing to reduce the risk. For employer-owned devices, your IT provider can confirm support status. For bring-your-own-device arrangements, you'll need a policy addressing minimum OS requirements and how workers confirm their device meets them.

Standard 9 — IT protection: Device encryption (item 9.5.2), router and network-device passwords changed from the originals (item 9.1.1), and firewalls (item 9.6.1, not mandatory). The toolkit numbers three related controls under other standards: anti-malware (Standard 6, item 6.2.1), patching (Standard 8, item 8.3.5) and multi-factor authentication on all remotely accessible and administrator accounts (Standard 4, item 4.5.3). For domiciliary care, device encryption is particularly important: every device leaving your premises with patient data on it needs full-disk encryption. For employer-provided devices, your IT or device management provider can confirm this. For BYOD arrangements, document your policy and how workers confirm compliance.

Standard 10 — Accountable suppliers: A list of the suppliers that handle personal information (item 10.1.2). For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better) and record what you checked; if a supplier has none, record what you do instead. A digital social care record supplier on NHS England's Assured Solutions List has already been assured. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence. For domiciliary care, key suppliers include:

• Your care management software provider
• Your scheduling/workforce management platform
• Your managed IT provider (if used)
• Any cloud backup or storage service

Common evidence gaps

Device encryption for field workers. Item 9.5.2 asks whether all laptops, tablets and removable devices that hold or allow access to personal data are encrypted, and in domiciliary care those devices spend the day outside your premises. If care workers use employer-provided tablets or phones, your IT provider should be able to confirm that full-disk encryption is enabled. If workers use personal devices (BYOD), you need a policy requiring encryption and a way to confirm compliance. Assertion without evidence doesn't satisfy the DSPT.

Training for bank and temporary workers. Workers who cover shifts infrequently may not appear in your main training tracking system. Establish a process for confirming training status before a bank worker accesses patient systems, and keep records of how and when training was completed.

Incident log gaps. Small incidents — a care note uploaded to the wrong client profile, a scheduling message sent to the wrong carer — often go unrecorded. Your incident log doesn't need to record every minor administrative error, but it should capture anything involving patient data handled incorrectly. An empty log that clearly captures zero incidents is fine; an absent log suggests no incident-tracking process exists.

Getting your submission ready

Use the version 9 (2026-27) workbook from the official version 9 announcement page, filtered to Category 3, to work through your evidence systematically. Group the work:

1. Policies — update your data security policy to address domiciliary-specific risks, and ask all staff, including bank workers, to read and acknowledge it (good practice).
2. Training records — run a training needs analysis, check that your completion records show at least 95% of staff trained in the last twelve months (bank workers count too), and address gaps.
3. Device inventory and assurance — confirm encryption for all devices and keep the digital asset register (7.1.1) current; check and record the cyber security certifications of your IT and care management software providers for 10.2.1.
4. Access controls — update your access register, check for leavers still with active accounts, and get your IT system administrators (internal and external) to sign the administrator accountability agreement (4.3.1).
5. Incident log and BCP — review your incident procedure and ensure your business continuity plan addresses field-specific scenarios.

For a checklist of every mandatory evidence item for your category, use our free evidence checklist generator. For a timeline to the submission deadline, use the DSPT deadline calculator.

Our DSPT for care homes guide covers the residential care context — many of the same standards apply, with different evidence challenges around fixed-premises operations.

FAQ

Do domiciliary care providers need to complete the DSPT? Yes. Any domiciliary care provider that handles NHS patient data, uses NHSmail, or connects to NHS systems must complete the DSPT annually. This applies even where all care is provided outside a fixed premises.

What DSPT category are domiciliary care providers in? Category 3, alongside residential care homes, pharmacies, dental practices and opticians. Category 3 has a set of mandatory evidence items across the 10 National Data Guardian standards: 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks. NHS England states that the number of mandatory questions is determined by your organisation type, so work from the list your own toolkit shows you. No independent audit is required.

How is the domiciliary care DSPT different from residential care homes? The 10 NDG standards are the same for both. The difference is in the evidence: domiciliary care workers access patient data in patients' homes, often on mobile devices. This introduces risks that don't exist in a fixed premises — devices that leave your building and need to be encrypted, mobile hotspot connections, and care workers who may use personal devices. Your evidence needs to address these specifically.

What happens if a domiciliary care provider misses the DSPT deadline? A missing or out-of-date DSPT can affect NHS-funded work and your use of NHSmail: NHS England describes completion as a contractual requirement in its Standard Conditions contract, and as necessary for organisations that use national systems such as NHSmail. Your status is also public, so commissioners and CQC inspectors can check it. If you are at risk of missing the deadline, the one-off Approaching Standards assessment for social care providers is better than not submitting; if you have already used it, plan for Standards Met. Check the DSPT help pages for current support options.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT organisation types — NHS England
• DSPT overview and introductory guidance — NHS England
• Data security awareness e-learning — NHS e-Learning for Healthcare
• Data Security and Protection eLearning — Digital Care Hub
• Check DSPT status — Digital Care Hub

Dental practices are Category 3 in the DSPT, alongside pharmacies, care homes, and opticians. That means a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, though the exact count is set by your organisation type, so confirm it in your own toolkit — an annual 30 June submission deadline, and no requirement for an independent audit. You complete the self-assessment and publish your result.

What makes dental practices different

The underlying 10 NDG standards are the same across all Category 3 organisations, but the evidence you gather is shaped by how a dental practice actually operates. Three things set dental practices apart from pharmacies or care homes.

Practice management software. Whether your practice management system (PMS) is cloud-based or runs on a server in the practice, your clinical and administrative data lives in that platform. Your DSPT evidence needs to include a check of your PMS provider's cyber security certification (item 10.2.1, below) and your own evidence of how you manage access to the system.

NHS claims and NHSmail. Practices with NHS contracts submit their FP17 claims to the NHS Business Services Authority electronically, through their practice software or NHSBSA's Compass online form, and many have NHSmail accounts. These connections mean you have data-sharing obligations that extend beyond your own four walls. Your evidence needs to show that these access points are appropriately managed and that staff using NHSmail understand their responsibilities.

Staff mix and turnover. Many dental practices employ a mix of permanent staff (receptionists, nurses, practice manager), self-employed associates, and locum dentists. Each person with access to patient records needs to be covered by your training records and your access controls. Associates and locums are a common gap — your DSPT can't assume they'll organise their own data security training.

The evidence you'll need

Category 3 dental practices need to demonstrate compliance with all 10 NDG standards. Here's how each one plays out in a dental context.

Standard 1 — Personal confidential data: Your evidence needs to show that patient data is handled, stored and transmitted securely, and only shared for lawful and appropriate purposes. An information asset register and record of processing activities (item 1.1.2) works well: list each system that holds patient or staff data (PMS, NHSmail, NHSBSA portal, cloud storage), what data it holds, and who you share it with. Your data protection and cyber security policies also sit under Standard 1 (item 1.3.1). NHS England's tooltip says policies "should be updated every three years as a minimum"; reviewing them every year is good practice. The policy doesn't need to be long, but the tooltip sets a minimum: data protection and confidentiality (including data breach management, risk assessment and data subject rights), records management (including retention and disposal) and cyber security (including password management, device and network security, and backups). Name the person or people with overall responsibility for data security and protection (item 1.1.5). Who can access each system is Standard 4 evidence, and associates who access clinical records need to appear there.

Data Protection Officer: If your practice provides NHS dental services, it must also designate a Data Protection Officer (DPO) for that NHS work. The Freedom of Information Act 2000 lists any person providing "primary dental services" under an NHS contract or arrangement as a public authority "in respect of information relating to the provision of those services" (Schedule 1, paragraph 43A). Section 7 of the Data Protection Act 2018 carries that into UK GDPR, and UK GDPR Article 37(1)(a) requires a DPO where "the processing is carried out by a public authority or body". One DPO can be shared across several practices (Article 37(3)).

Standard 2 — Staff responsibilities: An induction that covers data security and protection, and cyber security (item 2.1.1), and employment contracts and volunteer agreements that contain data security requirements (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality." Asking each staff member to confirm they have read the data security policy, by signature sheet or email, is good practice.

Standard 3 — Training: ⚠️ The 95% rule is not gone for dental practices — evidence item 3.2.1 is still marked mandatory for Category 3 in NHS England's version 9 (2026-27) workbook, as it was in version 8. The 2023 change that dropped it applies to Category one organisations only. You need both the 95% completion figure and a documented Training Needs Analysis completed in the last twelve months (item 3.1.1, also mandatory for Category 3). Checking that training worked, for example with a short quiz, is good practice, but no Category 3 evidence item asks for a separate evaluation. The NHS e-Learning for Healthcare data security awareness module is free and generates a certificate — useful for nurses, receptionists, and admin staff. For self-employed associates, you'll need to establish how they meet the training requirement.

Standard 4 — Managing data access: An access control register (who has access to which systems at what level), a joiner/leaver process, and a signed agreement holding your IT system administrators to higher standards. That is item 4.3.1: it was already in version 7, and version 8 made it mandatory for Category 3. Whoever administers your PMS, NHSmail admin access, and any NHSBSA portal administrator (including an external IT provider) all need to be covered by that agreement.

Standard 4 — multi-factor authentication: Multi-factor authentication is a separate mandatory Category 3 item (4.5.3), and it is wider than "staff who work from home". The version 9 item reads: "Multi-factor authentication is used on all remotely accessible and privileged user accounts ... on all systems, with exceptions only as approved by your board or equivalent senior management." NHS England's tooltip says to "consider all systems that can be accessed from the internet – such as email, clinical care systems, and any cloud-based or online systems". So a practice on a cloud PMS, NHSmail or Microsoft 365 needs MFA on those accounts even if nobody ever works off-site, and every administrator account needs it too. Any exception must be approved by the practice's senior management and recorded in the 4.5.3 text box.

Standard 5 — Process reviews: A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none. Reviewing your processes annually anyway is good practice. Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies).

Standard 6 — Responding to incidents: A system for reporting data breaches (item 6.1.1, mandatory for Category 3): an incident response procedure and an incident log. The procedure covers how staff identify, report, and escalate data incidents. The log records incidents (even minor ones like an email sent to the wrong address) and the actions taken. If you've had no reportable incidents, an empty log with the procedure attached demonstrates you have a working system. Make sure the procedure names the right route. Report a notifiable personal data breach to the ICO (now formally the Information Commission) through the DSPT incident reporting tool within 72 hours of becoming aware of it; the tool also notifies NHS England and, for more serious incidents, the Department of Health and Social Care. For immediate help with a cyber security incident, call the Data Security Centre on 0300 303 5222. Our DSPT incident response guide covers the procedure in detail.

If you had a breach, you also need a record that the management team was told and approved the actions to stop it recurring (item 6.1.2, mandatory), and that you considered the risk to the people affected and told them where it was high (item 6.1.3, mandatory). If you had none in the last 12 months, the tooltips say to tick and write "Not applicable".

Standard 7 — Continuity planning: A business continuity plan covering what happens if your PMS goes down, your internet connection fails, or you suffer a cyber attack. For a dental practice, this includes: paper backup procedures for appointments and patient notes, how to access NHSBSA claims if your system is unavailable, and who to contact in an emergency. Item 7.1.2 asks whether the plan is "regularly reviewed and tested", and item 7.2.1 asks how you test it, with NHS England's tooltip adding "This should be in the last twelve months." So review it and test it every year; a tabletop exercise with your team is enough.

Standard 8 — Unsupported systems: A list of all devices (computers, laptops, tablets) used in the practice, with their operating systems confirmed as currently supported. If any device runs an end-of-life OS (Windows 10, whose support ended on 14 October 2025, or older versions such as Windows 7 or 8.1), replace it, or record why you are keeping it, the risks and what you are doing to reduce them: item 8.1.4 asks whether systems are "still supported by the manufacturer or the risks are understood and managed", and item 8.2.1 asks for that risk document. Ask your IT provider for a device list if you don't have one. Our guide to unsupported systems and Standard 8 covers the Windows 10 case.

Standard 9 — IT protection: Confirmation that laptops, tablets and removable devices are encrypted (item 9.5.2), that router and network-device passwords have been changed from the originals (item 9.1.1), and that firewalls are in place (item 9.6.1, not mandatory). Anti-malware (Standard 6, item 6.2.1) and patching (Standard 8, item 8.3.5) are numbered under other standards. If an IT provider manages your systems, a single written confirmation from them covering these controls is usually the simplest evidence to gather. That confirmation covers your own technical controls; it is not the 10.2.1 supplier check below. If you manage IT yourself, screenshots of Windows Security, Windows Update and BitLocker settings are a practical way to show the controls are switched on.

Standard 10 — Accountable suppliers: Two mandatory items. First, a list of the suppliers that handle personal information, the products and services they deliver, and their contact details (item 10.1.2). For dental practices, this typically includes:

• Your practice management software provider
• Your managed IT provider (if you use one)
• Your cloud backup service
• Your NHSBSA portal access (if relevant)
• Any third-party appointment booking or patient communication platform

Second, item 10.2.1 (mandatory for Category 3) asks: "Does your organisation assure that your IT system suppliers have robust cyber security arrangements?" NHS England reworded it in v1.1 of the version 9 (2026-27) workbook, so older advice about collecting a general letter from each supplier is out of date. Check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.

Common evidence gaps in dental practices

Three areas consistently create gaps for dental practices at assessment time.

Associates and locums. Their training status and system access need to be documented even if they're self-employed, and asking them to acknowledge your data security policy is good practice. The simplest approach: include them in your training tracking spreadsheet, send them your policy for acknowledgement, and note whether they complete training through your route or independently.

PMS access for leavers. When a dental nurse, associate, or receptionist leaves, their PMS access, NHSmail account, and any shared drive access need to be revoked promptly. This sounds obvious, but access registers at many practices haven't been audited recently — accounts for staff who left 12+ months ago may still be active. Check your PMS user list and your NHSmail admin panel.

Supplier assurance. Many practices have a verbal relationship with their IT provider and PMS vendor but have never checked their cyber security certification. Email each key supplier to ask which certification it holds, then confirm it yourself using the checks under Standard 10 above. Allow time for replies; do not leave this to the last week.

Preparing your submission

The most efficient approach for a dental practice:

1. Download the version 9 (2026-27) workbook and filter it to Category 3 from the official version 9 announcement page. This gives you the complete list of assertions and evidence items in a format you can annotate.
2. Work through each item and mark it red/amber/green — existing evidence, needs updating, or doesn't exist yet.
3. Group your gaps: policies first, then training records, IT evidence (one request to your IT provider) and supplier assurance (email each key vendor).
4. Upload to the portal once evidence is gathered. The DSPT portal at dsptoolkit.nhs.uk is where you submit your assessment.
5. Submit at Standards Met. NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention dental practices, so build your plan around the full mandatory set and raise any risk of missing the deadline with NHS England early.

For a checklist of every mandatory evidence item for your category, use our free evidence checklist generator. For a week-by-week timeline, our DSPT 90-day action plan works for dental practices as well as care homes and pharmacies.

To see how a dental practice's evidence requirements compare with other Category 3 organisations, see our complete guide to DSPT evidence requirements.

FAQ

Is the DSPT mandatory for dental practices? Yes, for any practice with access to NHS patient information. NHS England says completion is a contractual requirement in the NHS England Standard Conditions contract and DHSC policy for all bodies that process NHS patient information, with a 30 June deadline each year; its Dentist organisation type covers NHS and private dental services. CQC's well-led governance quality statement lists the DSPT as a subtopic, with Regulation 17 (good governance) as the related regulation.

What DSPT category are dental practices in? Dental practices are Category 3, the same category as pharmacies, care homes, and opticians. Category 3 has a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, and NHS England states that the number of mandatory questions is determined by your organisation type, so work from the list your own toolkit shows you. No independent audit is required — you self-certify your compliance.

How is the dental practice DSPT different from other organisations? The core 10 NDG standards are the same across Category 3. What differs is the evidence context: dental practices rely heavily on their practice management software (cloud or server-based), submit NHS claims to the NHS Business Services Authority electronically, and may use NHSmail. Your supplier evidence needs to cover these systems specifically.

What happens if a dental practice misses the 30 June deadline? A missing or out-of-date DSPT can affect your NHS contract compliance and your ability to access NHS systems. NHS England's guidance says completion is 'a contractual requirement specified in the NHS England Standard Conditions contract', and that it 'remains Department of Health and Social Care policy that all bodies that process NHS patient information for whatever purpose provide assurances via the DSPT'. CQC's well-led governance quality statement also lists the DSPT as a subtopic. Plan for Standards Met: NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention dental practices. If you're at risk of missing the deadline, contact NHS England or your commissioner before it passes. Check the DSPT help pages for current support options.

This guide reflects DSPT version 9 (2026-27), the current toolkit, as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT organisation types — NHS England
• National Data Guardian data security standards — GOV.UK
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (items 4.5.3, 6.1.1–6.1.3, 10.1.2, 10.2.1) — NHS England
• DSPT incident reporting — NHS England
• DSPT overview (completion requirement, incident reporting, Approaching Standards) — NHS England
• Mandating of electronic FP17 transmissions (WebEDI or the Compass online form), 14 November 2018 — NHS Business Services Authority
• Well-led: governance, management and sustainability quality statement — CQC
• Windows 10 Home and Pro lifecycle — Microsoft
• Data security awareness e-learning — NHS e-Learning for Healthcare
• Freedom of Information Act 2000, Schedule 1 Part III (paragraph 43A) — legislation.gov.uk
• Data Protection Act 2018, section 7 — legislation.gov.uk
• UK GDPR Article 37: Designation of the data protection officer — legislation.gov.uk

The aim here isn't to teach the DSPT from scratch — it's to catch the high-impact gaps that commonly trip up small providers at the last minute, and to give you a clear plan if time is short.

First: know exactly how long you have

This checklist covers the 2026-27 (version 9) toolkit, released on 1 September 2026, whose deadline is 30 June 2027. It was first written for version 8 (2025/26). The mandatory items are the same in both versions (10.2.1 was reworded; see check 1), so the last-weeks checks below apply in the same way. If you're not sure how many working days that leaves you, our DSPT deadline calculator gives you a personalised countdown with milestones for your organisation type.

If you're already short on time, decide your target now. Standards Met — the mandatory set — is the target. If you are a social care provider and cannot get there, publish at Approaching Standards: a smaller set of 26 items, available to social care as a one-off, with the action plan the toolkit asks for. That is a legitimate, on-time outcome, and far better than chasing a perfect submission and missing the date. NHS England's guidance does not name pharmacies, dentists, opticians or GP practices as eligible for that route, so if you are one of those, plan for Standards Met.

The last-weeks checklist

Work through these in order. The first few are the ones most likely to be incomplete and most likely to hold up a submission.

1. Supplier and IT-provider assurance is in hand

Much of your technical evidence depends on someone else. If you haven't already:

• Check your clinical or PMR system supplier's and IT support company's cyber security certification for item 10.2.1 (mandatory for Category 3 and 4), which NHS England reworded in v1.1 of the version 9 workbook. Check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.
• Confirm your IT support provider has given you the documentation you need for access control, patching, and backups.

Anything that depends on a third party, such as your IT provider's documentation or a copy of an ISO 27001 certificate, can stall at the last minute. Chase it first.

2. Staff training records are complete and current

• Data security awareness training completed in the last twelve months, counting everyone — including locums, bank, agency, and recent starters, who all count towards the 95% (see below).
• Records are dated within the last 12 months and you can produce the completion list, not just the training policy.

Training completion is a frequent gap because of turnover and temporary staff. Item 3.2.1 asks whether at least 95% of staff have completed training in the last twelve months, so in a team of fewer than 20, a single untrained person takes you below the line.

3. The asset register and administrator agreement are in place

Two items became mandatory for Category 3 in version 8 (2025/26) and remain mandatory in version 9 for both Category 3 and Category 4:

• Digital asset register (7.1.1) — "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" NHS England's tooltip adds that "The register should have been reviewed at least once in the last twelve months."
• Administrator agreement (4.3.1) — "Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?" That includes administrators at your IT supplier.

If either of these is missing, build it now — both are straightforward, but providers who last checked before version 8 can easily have missed them. For what changed in version 9, see our guide to the 2026-27 (version 9) DSPT.

4. Governance evidence is in place

• Named IG lead (and Caldicott Guardian / SIRO where applicable), with evidence the role is active.
• A designated Data Protection Officer if you are a GP practice or an NHS dental, optical or pharmacy contractor. For that NHS work you are a public authority for UK GDPR (Freedom of Information Act 2000, Schedule 1 paragraphs 43A and 44, via section 7 of the Data Protection Act 2018). UK GDPR Article 37(1)(a) requires a DPO where "the processing is carried out by a public authority or body". A DPO shared with other practices or contractors is allowed.
• Information governance policy and privacy notice accessible to staff and patients.
• ICO registration is current — the ICO is now formally the Information Commission. Item 1.1.1 asks for your registration number, and paying the data protection fee is a legal duty under the Data Protection (Charges and Information) Regulations 2018.

5. Incident response and continuity are documented

• An incident response process naming who to contact and how you'd report a breach. Report a notifiable personal data breach to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of it; the tool also notifies NHS England and, for more serious incidents, the Department of Health and Social Care. For immediate help with a cyber security incident, call the Data Security Centre on 0300 303 5222. Our DSPT incident response guide covers the procedure.
• A business continuity plan covering a system outage — how you'd operate safely if your clinical/PMR system or NHSmail went down. Item 7.1.2 asks whether it is "regularly reviewed and tested"; for Category 3, item 7.2.1 asks how you tested it, and NHS England's tooltip says "This should be in the last twelve months."

6. Every mandatory item is answered, with the evidence behind it

Open the toolkit and go assertion by assertion. Most mandatory items are a yes/no tick; the rest ask for a short text answer or, for a few, a document. Confirm each mandatory item is answered and that you hold the evidence behind each yes; attach a document where the item asks for one.

7. Publish — don't just save

The most avoidable miss of all: completing every item but never clicking Publish. A saved-but-unpublished assessment does not count as submitted. Publish before 30 June.

If you're not going to finish in time

The toolkit does not let you publish a partial Standards Met assessment. NHS England's guidance says: "Once all the mandatory evidence items have been completed, and all assertions confirmed, you will be able to publish your assessment." What you can do depends on who you are:

1. Social care providers: you can publish a one-off Approaching Standards assessment by completing the 26 items marked mandatory for it. The toolkit then asks you for an action plan covering the remaining items. It is an on-time submission, but it is one-off: Digital Care Hub's guidance says "You cannot republish at Approaching Standards", so your next publication must reach Standards Met.
2. Pharmacies, dentists, opticians and GP practices: NHS England's guidance names no fallback status for you, and its improvement-plan process is for other organisation types (NHS trusts, ICBs, local authorities and similar). So finish the remaining mandatory items before anything optional, and publish the moment the last one is done.
3. Tell the right people early, whoever you are. Contact the DSPT helpdesk and your commissioner or ICB before the deadline if you're at risk of missing it — don't wait until 1 July.

For a social care provider, a published Approaching Standards submission on 30 June, followed by Standards Met as soon as you can, is a good outcome. For everyone else, a late Standards Met that your commissioner knew about in advance is better than a silent miss.

Next steps

• Run the DSPT readiness quiz for a quick readiness estimate across seven of the ten standards before you do your final review.
• Use the evidence checklist generator to check your evidence against every mandatory evidence item for your category.
• For the week-by-week version of this run-up, see our DSPT deadline action plan.
• New to the toolkit this year? Start with the complete DSPT guide.

This checklist was first written against DSPT v8 (2025/26) requirements and has been updated for version 9 (2026-27), whose deadline is 30 June 2027. Always confirm current requirements and deadlines on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2025-26 (version 8) — assertions, evidence items, and deadline — dsptoolkit.nhs.uk
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• DSPT release notes — NHS England
• Data Security and Protection Toolkit portal — dsptoolkit.nhs.uk
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (items 1.1.1, 3.2.1, 4.3.1, 7.1.1, 7.1.2, 7.2.1, 10.2.1) — NHS England
• DSPT incident reporting — NHS England
• DSPT 2025-26 improvement plans (which organisation types they apply to) — NHS England
• Before you start: Approaching Standards and the action plan — Digital Care Hub
• Publish or republish your DSPT — Digital Care Hub
• UK GDPR Article 37: Designation of the data protection officer — legislation.gov.uk
• Data Protection (Charges and Information) Regulations 2018, regulation 2 — legislation.gov.uk
• Well-led: governance, management and sustainability quality statement — CQC

This guide covers the DSPT specifically for GP practices — why you're Category 4, what evidence you need for DSPT version 9 (2026-27), how to coordinate with your clinical system supplier, and how to hit the annual 30 June deadline.

Your DSPT category: why GP practices are Category 4

General practice is Category 4 in the DSPT. This is its own category — separate from Category 3, which covers dentists, opticians, pharmacies, social care providers, and small IT suppliers.

You register at dsptoolkit.nhs.uk with your ODS code, but the code does not decide your category. At first login you choose your organisation's sector in the Organisation Profile, and NHS England states that "the organisation type determines which Category of toolkit is to be completed" — record general practice and the toolkit presents the Category 4 evidence items. You can "change your answers at any time", so if a predecessor recorded the wrong sector, correct it before you start rather than working through the wrong question set.

What Category 4 means in practice:

• You complete a self-assessment against the 10 National Data Guardian (NDG) standards — the same underlying standards every category works to.
• Most evidence items are worded exactly as they are for Category 3: in NHS England's version 9 workbook, 43 of the 47 items Category 4 shares with Category 3 have identical wording. The four that differ (1.3.6, 4.1.1, 4.5.3 and 7.3.4) are reworded, and the 4.5.3 tooltip speaks to practices directly: "Exceptions for practice-commissioned digital services may be decided by the practice management."
• No independent audit is required (that applies to Categories 1 and 2 — NHS trusts and large IT suppliers).
• You work toward Standards Met by 30 June — the deadline NHS England sets every year.

For the 2026-27 (version 9) toolkit, NHS England's version 9 workbook keeps the same 29 mandatory Category 4 items as version 8 and adds four optional ones (1.3.15, 7.1.7, 10.2.6 and 10.2.7). If you submitted last year, the shape of your task will feel familiar.

Don't assume the Category 3 numbers apply to you. A lot of online guidance quotes around 42 mandatory evidence items for Category 3 (care homes, pharmacies). NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks actually mark 45 items mandatory for Category 3 — and 29 for Category 4. Category 4 has its own pre-determined set. Always work from the Category 4 evidence list the toolkit shows you, not a number from a care-home guide. Download the official workbook from the version 9 announcement and filter it to Category 4 to see your exact list.

What changed at DSPT v8 and v9 (and why it matters for GP practices)

Version 8 (2025/26) did not restructure the toolkit for GP practices. NHS England's v8 workbook marks all 36 assertions as unchanged from version 7, and its release notes describe the Category 3 and 4 change as "evidence item minor amendments to update wording". NHS England's v8 announcement says it "is aligned to CAF version 3.4", but that alignment is at framework level: only Category 1 organisations, such as NHS Trusts and ICBs, see a CAF-aligned view.

For a practice manager, what actually changed is:

• Seven items were added to the GP list in v8: 7.1.1, 7.1.5, 7.1.6, 8.1.4, 8.2.1, 8.3.8 and 8.4.3. Only 7.1.1, the digital asset register, is mandatory: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" For a practice, that means a list of every device and the software on it, reviewed at least once a year.
• One mandatory item was dropped in v8: 4.3.3, which asked whether staff had been notified that their system use could be monitored.
• Version 9 (2026-27) added four optional items (1.3.15, 7.1.7, 10.2.6 and 10.2.7) and kept the same 29 mandatory items.

The administrator agreement (4.3.1) was already mandatory for GP practices in version 7 and still is. If you want the full change log, see our DSPT v8 changes explained guide, and if "CAF" is unfamiliar, our Cyber Assessment Framework explained guide covers what the framework is and where it fits.

GP-practice-specific challenges

General practice faces DSPT challenges that care homes and pharmacies don't:

Clinical system dependency (EMIS / TPP SystmOne). The bulk of your patient data lives in your clinical system. Much of your DSPT technical evidence — access controls, audit logging, encryption, role-based access — depends on what EMIS or SystmOne provides and how it's configured. You can't answer many assertions without your supplier's standing assurance documentation.

Multiple data flows. A practice handles data across the clinical system, NHSmail, GP Connect, the Summary Care Record, online consultation tools, the NHS App, document management, and often a separate appointment or telephony system. Each is a data touchpoint that needs documented access control.

Caldicott Guardian, IG lead and Data Protection Officer roles. Practices are expected to have a Caldicott Guardian (a senior person, preferably a health or social care professional, responsible for protecting the confidentiality of people's information) and an Information Governance lead. A practice holding a GMS contract or PMS agreement must also designate a Data Protection Officer (DPO) for its NHS work. The Freedom of Information Act 2000 lists any person providing primary medical services under those arrangements as a public authority "in respect of information relating to the provision of those services". The Data Protection Act 2018 (section 7) carries that definition into UK GDPR, and UK GDPR Article 37(1)(a) requires a DPO where "the processing is carried out by a public authority or body". Article 37(3) allows one DPO to be shared across several public authorities, so a practice can share a DPO with other practices, for example through its ICB or federation. The DSPT asks you to evidence the senior roles that own data security (item 1.1.5) — minutes, role descriptions, and named individuals.

PCN and federation complexity. If you share staff, premises, or systems across a Primary Care Network, data flows between practices need documenting. Shared roles (a PCN-wide IG lead, for example) still need to map cleanly to each practice's own submission.

High patient and data volume with a small admin team. A practice with 8,000 patients may run with a handful of administrative staff. Compliance work competes with appointment management, prescriptions, recalls, and inbound clinical correspondence.

What evidence GP practices typically need

The exact items come from your Category 4 list, but most practices will need to gather evidence across these themes. This is a practical orientation, not a substitute for the official spreadsheet.

Governance and accountability

• A named Caldicott Guardian and IG lead (and SIRO where applicable), with evidence the roles are active.
• A designated Data Protection Officer — required for GMS and PMS practices under UK GDPR Article 37(1)(a), because for their NHS work they are public authorities for UK GDPR (see above). One DPO can be shared across several practices (Article 37(3)).
• An information governance policy and a data protection / privacy notice that staff and patients can access.
• Your practice's registration number with the ICO (now formally the Information Commission), which item 1.1.1 asks for. Registering and paying the data protection fee is a legal duty under the Data Protection (Charges and Information) Regulations 2018.

Staff training and awareness

• Annual data security training for at least 95% of staff in the last twelve months (item 3.2.1, mandatory). Keep completion records for everyone: clinical and administrative staff, locums, GP registrars and bank staff. The e-Learning for Healthcare Data Security Awareness course is the common route. NHS England's e-learning FAQ also accepts local training "where this has been agreed as covering with the learning objectives of the National E-Learning system", provided it is "signed off by the local organisation's SIRO or Caldicott Guardian" and "all staff completing the training will have to achieve the 80% pass mark".
• Evidence that new starters complete training as part of induction.

Access control and technical security

• Role-based access in EMIS/SystmOne — staff see only what their role requires, with smartcard-based access where used.
• A system administrator account register — every admin-level account across the clinical system, NHSmail admin, and network/router management.
• Multi-factor authentication on every account that can be reached over the internet (item 4.5.3, mandatory for Category 4). The version 9 Category 4 wording is: "Multi-factor authentication is used on all remotely accessible user accounts on all systems, with exceptions only as approved by a relevant board or senior management." That covers NHSmail, online consultation tools and cloud systems whether or not anyone works remotely. The tooltip splits the exceptions: "Exceptions for ICB-commissioned digital services should be decided by the ICB board or senior management. Exceptions for practice-commissioned digital services may be decided by the practice management." Record every exception in the 4.5.3 text box.
• A digital asset register — every device, its operating system version, and key software, reviewed at least once in the last twelve months (item 7.1.1, mandatory). Note any device or software that is no longer supported, such as Windows 10 since October 2025: item 8.1.4 (supported, or "the risks are understood and managed") is in the Category 4 list but not mandatory for it.

Supplier assurance

• A supplier list (item 10.1.2, mandatory): the suppliers that handle personal information, what they provide and their contact details.
• Item 10.2.1 (mandatory for Category 4), reworded in v1.1 of the version 9 workbook. Check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence. For your clinical system supplier and IT provider, you can check a DSPT status yourself with the toolkit's organisation search.

Incident response and continuity

• An incident response process, which is how you show a system to report data breaches (item 6.1.1, mandatory). It should name who to contact (your IT provider, and your ICB / NHS England) and the isolation steps for a suspected cyber attack. Report a notifiable personal data breach to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of it; the tool also notifies NHS England and, for more serious incidents, the Department of Health and Social Care. For immediate help with a cyber security incident, call the Data Security Centre on 0300 303 5222. Our DSPT incident response guide walks through the procedure.
• If you had a breach, a record that you considered the risk to the people affected and told them where it was high (item 6.1.3, mandatory). If you had no such breaches in the last 12 months, the tooltip says to tick and write "Not applicable".
• A business continuity plan covering a clinical-system outage: how you'd run safely if EMIS/SystmOne or NHSmail were unavailable. Item 7.1.2 asks whether the plan is "regularly reviewed and tested".

A realistic timeline for GP practices

You don't need to do this in one sitting. A workable approach for a practice:

1. Register / log in and pull your Category 4 list — confirm the toolkit recognises you as a GP practice and download the version 9 workbook, filtered to Category 4.
2. Check supplier certifications early — ask your clinical system supplier and IT provider which cyber security certification they hold, and allow time for replies. Start here.
3. Gather the people-and-policy evidence — Caldicott Guardian, IG lead, training records, policies. This is the bulk of the work and doesn't depend on anyone else.
4. Confirm the technical evidence — access controls, asset register, administrator agreements, MFA — with your IT provider.
5. Review against each assertion and submit — aim for Standards Met by the 30 June deadline. NHS England's guidance names social care organisations as eligible for a one-off Approaching Standards assessment and does not mention GP practices, so do not plan around it.

Spreading this across the spring rather than scrambling in June is the difference between a calm submission and a stressful one. Our DSPT deadline action plan breaks the work into a week-by-week schedule.

Next steps

• Read the complete DSPT guide for the full overview across all categories.
• Check your current position with the DSPT readiness quiz: 10 questions for a quick readiness estimate across seven of the ten standards before you open the toolkit.
• Use the evidence checklist generator to list every mandatory Category 4 evidence item and plan what to gather.
• See exactly how long you have with the deadline calculator.

This guide reflects DSPT version 9 (2026-27) requirements for Category 4 (GP practice) organisations and was last reviewed on 5 November 2026. Category 4 evidence items may be updated — always verify against the official Category 4 spreadsheets on the DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• DSPT 2025-26 (version 8) — assertions and evidence items — dsptoolkit.nhs.uk
• DSPT organisation types and categories — dsptoolkit.nhs.uk
• Cyber Assessment Framework — NCSC
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (items 1.1.1, 3.2.1, 4.5.3, 6.1.1, 6.1.3, 7.1.1, 8.1.4, 10.1.2, 10.2.1) — NHS England
• DSPT incident reporting — NHS England
• DSPT staff training guidance (item 3.2.1) — NHS England
• UK GDPR Article 37: Designation of the data protection officer — legislation.gov.uk
• Freedom of Information Act 2000, Schedule 1 Part III (paragraph 43A) — legislation.gov.uk
• Data Protection Act 2018, section 7 — legislation.gov.uk
• Data Protection (Charges and Information) Regulations 2018, regulation 2 — legislation.gov.uk
• Well-led: governance, management and sustainability quality statement — CQC
• Windows 10 Home and Pro lifecycle — Microsoft

The short version for care homes, pharmacies, dental practices, opticians and GP practices: the assertions did not change, the toolkit kept its ten-standard structure, and a handful of evidence items were added, removed or made mandatory. Two of those matter most: the administrator agreement (4.3.1) and the digital asset register (7.1.1).

When v8 was released and the timeline that matters

NHS England's announcement, "Outcomes, Assertions and Evidence items for the Data Security and Protection Toolkit 2025-26 version 8 (18 September 2025)", is at dsptoolkit.nhs.uk/News/161, and it links to the downloadable workbook for Categories 2, 3 and 4.

The deadline itself is annual. NHS England's guidance asks every organisation to publish "at least one assessment by the deadline of 30 June every year".

The headline: the assertions did not change

NHS England's version 8 workbook for Categories 2, 3 and 4 has an "Assertions" sheet with a column headed "Change v7 to v8". All 36 assertions are marked "None", and their wording is identical to version 7. They are still numbered 1.1 to 10.3 in National Data Guardian standard order, starting with 1.1, "The organisation has a framework in place to support Lawfulness, Fairness and Transparency".

The workbook's evidence-item sheet has no column for a CAF principle or objective. NHS England's current guidance describes the same structure: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through."

NHS England's release notes describe the version 8 change for these organisations in one line: "For NHS Organisations, IT Suppliers, Category 3 and Category 4 evidence item minor amendments to update wording." So a Category 3 or Category 4 provider who completed version 7 opened version 8 to the same standards, the same assertions and mostly the same evidence items.

Where the Cyber Assessment Framework fits

The NCSC Cyber Assessment Framework (CAF) does sit behind the DSPT, but not in the way it is often described. NHS England's v8 announcement says "DSPT Version 8 is aligned to CAF version 3.4". That alignment is at framework level, and it did not start with version 8.

NHS England's page on the change says: "In September 2024 the DSPT changed to adopt the National Cyber Security Centre’s Cyber Assessment Framework (CAF) as its basis for cyber security and IG assurance." That was version 7. The same page sets out who sees what. NHS Trusts, OES, CSUs, ALBs, ICBs and Genomics organisations see "a different interface when they log in, which sets out CAF-aligned requirements in terms of Objectives, Principles and Outcomes." Everyone else "will retain the current interface and will continue to respond to a list of prescriptive controls, which will be mapped nationally ‘in the background’ against a CAF profile."

The v8 announcement follows that split. It offers the "Assertions and Evidence items" workbook to IT suppliers, dentists, GPs, local authorities, opticians, pharmacies, social care, universities and others, and the CAF-style outcome and indicators-of-good-practice spreadsheet only to NHS Trusts, ALBs, CSUs, OES, Genomics organisations and ICBs.

Two details are worth knowing if you read about the CAF elsewhere:

• NHS England's CAF has five objectives, not four. The NCSC describes its CAF as "4 high-level objectives and the 14 principles", lettered A to D. NHS England's health and care version adds an objective E. Its CAF FAQ explains that "objective E was added to ensure appropriate outcomes were included to cover ‘Using and sharing information appropriately’."
• The CAF view is still for the large organisations. NHS England's 2026-27 organisation-type guidance says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements". For dentists, opticians, pharmacies, social care and other Category 3 organisations it says: "DSP Toolkit view is based on the Category 3 evidence items." For more on this, see our guide to what CAF alignment means for Category 3.

What changed in the evidence items

The changes that did happen were at evidence-item level. Comparing the version 7 and version 8 workbooks row by row gives the following.

Category 3 (care homes, pharmacies, dentists, opticians and others)

That takes Category 3 from 77 evidence items (43 mandatory) in version 7 to 76 items (45 mandatory) in version 8. NHS England's own change log in the workbook also lists 1.3.9 as a new Category 3 item, but the requirements sheet has no version 8 item 1.3.9 for Category 3; it marks 1.3.9 "Removed".

Category 4 (GP practices)

Version 8 added seven items to the GP list: 7.1.1, 7.1.5, 7.1.6, 8.1.4, 8.2.1, 8.3.8 and 8.4.3. Of these, only 7.1.1 (the digital asset register) is mandatory. It removed 4.3.3 (staff notified about monitoring), which had been mandatory, and 9.3.8 (connected medical devices). Category 4 went from 40 items to 45, with 29 mandatory in both versions.

The two changes that matter most

The administrator agreement (4.3.1). The item reads: "Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?" It was already in version 7, with the same wording. Version 8 made it mandatory for Category 3; NHS England's change log records "Evidence item made mandatory for category 3 - 4.3.1". For GP practices (Category 4) it was already mandatory in version 7. If you are a Category 3 provider who last looked at this item before 2025, it is easy to have missed. Our DSPT access controls guide covers how to evidence it.

The digital asset register (7.1.1). In version 8 the item became: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" It is mandatory for both Category 3 and Category 4. For Category 3 it replaced a version 7 item about understanding the health and care services you provide, which was not mandatory. For GP practices it was a new item. A spreadsheet of devices and software, with an owner and a review date, is a reasonable starting point.

The other new items (7.1.5, 7.1.6, 8.3.8) are optional. They are worth doing if your asset register is already in good shape, but they do not affect whether you reach Standards Met.

What did not change

• The deadline is 30 June, every year.
• The ten National Data Guardian standards are still the structure. Assertions sit under each standard, and evidence items sit under each assertion.
• Standards Met still means the mandatory items. NHS England's guidance is to complete "all the questions within the assessment which are indicated as being MANDATORY". For Category 3 that is 45 items in the version 8 workbook.
• The portal address is unchanged. dsptoolkit.nhs.uk remains the single point of submission.

What carried into version 9 (2026-27)

Version 9 was released on 1 September 2026, and its workbook was published on 2 October 2026 with a deadline of 30 June 2027. Against version 8, NHS England's version 9 workbook shows:

• The same mandatory items. Category 3 still has 45 mandatory items and Category 4 still has 29, and they are the same items as in version 8. 4.3.1 and 7.1.1 remain mandatory for both.
• Four new items, none mandatory: 1.3.15, 7.1.7, 10.2.6 and 10.2.7, for both Category 3 and Category 4. That brings Category 3 to 80 items and Category 4 to 49.
• The same 36 assertions, with the same wording.
• A newer CAF reference for the large organisations. NHS England's version 9 page says "DSPT Version 9 is aligned to CAF version 4.0". The Category 3 and 4 assessments are still built from evidence items, as above.

The assertion and evidence-item workbook for version 9 is linked from dsptoolkit.nhs.uk/News/169. For a walk-through, see what changed in version 9.

What to do now

If you completed version 8, most of your evidence is still the right evidence for version 9. The practical list:

1. Download the version 9 workbook from dsptoolkit.nhs.uk/News/169 and filter it to your category.
2. Check 4.3.1. Make sure every IT administrator, including your IT supplier's, has signed an accountability agreement.
3. Check 7.1.1. Make sure your digital asset register lists your hardware and software and has been kept up to date.
4. Look at the four new version 9 items and decide which apply to you. None is mandatory.
5. Run staff training again before you publish. Annual data security awareness training is free at e-Learning for Healthcare, and for adult social care NHS England's Category 3 tooltip for item 3.2.1 names Digital Care Hub's free Data Security and Protection eLearning as meeting the requirement. Completion records are among the easiest evidence to gather.

For first-time providers, the how to complete the DSPT guide walks through the full process step by step. For a Category 3 worked example, see the DSPT for care homes guide.

FAQ

When was DSPT v8 released? NHS England's release notes record that "The 2025-26 (version 8) standard has been released" on 1 September 2025, and the assertions and evidence items were published on 18 September 2025. The deadline for that cycle was 30 June 2026. Version 8 has since been replaced: the 2026-27 (version 9) DSPT was released on 1 September 2026, with a deadline of 30 June 2027.

Is DSPT v8 still the version to complete? No. Version 8 covered the 2025/26 cycle, which closed on 30 June 2026. For 2026-27 you complete version 9. For Category 3 and Category 4 the mandatory items are the same in both versions (45 and 29), so most of what you prepared for v8 still applies.

Did v8 restructure the DSPT around the Cyber Assessment Framework? Not for Category 3 and 4 organisations. NHS England's v8 workbook lists the same 36 assertions as v7, each marked "None" in its "Change v7 to v8" column, still numbered 1.1 to 10.3 under the ten National Data Guardian standards. NHS England says "DSPT Version 8 is aligned to CAF version 3.4", but that alignment is at framework level: organisations outside the large-NHS group "will continue to respond to a list of prescriptive controls", mapped to the CAF in the background.

Is the workload bigger in v8 than v7? Slightly, for Category 3. NHS England's workbooks give 77 Category 3 evidence items with 43 mandatory in v7, and 76 items with 45 mandatory in v8: the administrator agreement (4.3.1) and the digital asset register (7.1.1) became mandatory. Category 4 went from 40 to 45 items, with 29 mandatory in both.

Next steps

1. Read the Cyber Assessment Framework guide for what the CAF is and who works with it directly.
2. Read the DSPT complete guide for the full overview tailored to small providers.
3. Use the evidence checklist generator to build a structured list for your category.
4. Take the readiness quiz for a quick readiness estimate across seven of the ten standards.
5. Check the deadline calculator and plan your milestones.
6. Sort out the administrator agreement with the DSPT access controls guide, and record risks with the DSPT risk assessment guide.

This guide is based on NHS England's DSPT workbooks for version 7 (2024-25), version 8 (2025/26) and version 9 (2026-27), and on NHS England's published DSPT guidance. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2025-26 version 8 announcement — NHS England
• Version 8 (2025-26) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
• Version 7 (2024-25) assertions and evidence items (spreadsheet) — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
• Changes to the DSPT for large NHS organisations — NHS England
• CAF-aligned DSPT FAQ (2024-25) — NHS England
• Organisation types — NHS England
• DSPT overview guidance — NHS England
• DSPT system changes and release notes — NHS England
• Cyber Assessment Framework — NCSC
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare
• Data Security and Protection eLearning — Digital Care Hub

This guide explains what the CAF is, who it's for, why NHS England adopted it, and what it actually means for the day-to-day work of completing the DSPT. It is written for people running care homes, pharmacies, GP practices, and other Category 3 / Category 4 organisations — not for NHS Digital security architects.

What is the Cyber Assessment Framework?

The Cyber Assessment Framework (CAF) is a set of cyber security principles maintained by the National Cyber Security Centre (NCSC) — the UK's technical authority on cyber security and a part of GCHQ.

The NCSC says it "developed the CAF in its role as national technical authority for cyber security, with an expectation that it would be used, amongst other things, as a tool to support effective cyber regulation" — including regulation under the Network and Information Systems Regulations 2018 (the NIS Regulations), whose Schedule 2 covers essential services in the electricity, oil, gas, transport, healthcare, drinking water and digital infrastructure subsectors. The NCSC's CAF collection page now says it "is used across sectors currently regulated under NIS and wider CNI, government and other sectors where maintaining operational resilience is essential". NHS England adopted it for the DSPT in September 2024.

The CAF is not a checklist. It is an outcome-based framework: rather than telling you "install a firewall" or "use 12-character passwords," it asks you to demonstrate that you achieve specific outcomes. Outcome A2.a, for example, reads: "Your organisation has effective internal processes for managing risks to the security and resilience of network and information systems related to the operation of your essential function(s) and communicating associated activities." How you achieve those outcomes is up to your organisation.

The full framework is documented at the Cyber Assessment Framework collection on ncsc.gov.uk, which currently presents CAF version 4.0. NHS England's announcement for the current toolkit, version 9 (2026-27), says "DSPT Version 9 is aligned to CAF version 4.0". The previous version, v8 (2025/26), was aligned to CAF version 3.4. The same NCSC page also introduces a CAF "Core Profile", which "establishes a minimum level of cyber resilience for organisations facing moderately sophisticated cyber adversaries, and supports the transition to CAF version 4.0". Like the rest of the CAF, it is not something Category 3 and 4 organisations fill in: the DSPT evidence items are what you answer.

How the CAF is structured

The CAF is organised around four high-level objectives, each containing a set of principles, and each principle expressed as a set of contributing outcomes. The four objectives are:

Each principle has a letter–number identifier (A1 Governance, A2 Risk Management, B1 Service protection policies, processes and procedures, and so on, in CAF version 4.0). Within each principle there are contributing outcomes, and within each outcome there are indicators of good practice.

NHS England uses its own health and care version of the CAF, which adds a fifth objective. Its CAF FAQ explains that "objective E was added to ensure appropriate outcomes were included to cover ‘Using and sharing information appropriately’." Only the large organisations work through that framework directly. If you are a Category 3 or Category 4 organisation, you answer evidence items under the ten National Data Guardian standards instead (version 9 added two CAF items inside Category 3, covered under "Common misconceptions" below).

Why NHS England adopted the CAF

The change came before version 8. NHS England's page on it says: "In September 2024 the DSPT changed to adopt the National Cyber Security Centre’s Cyber Assessment Framework (CAF) as its basis for cyber security and IG assurance." That was version 7 (2024-25), whose announcement said "NHS Trusts, ALBs, CSUs and ICBs will view a new interface aligned to the NCSC Cyber Assessment Framework." NHS England's announcements give the CAF version each year: version 8 (2025/26) "is aligned to CAF version 3.4" (News/161), and version 9 (2026-27) "is aligned to CAF version 4.0" (News/169).

NHS England's own explanation is that "In 2023 the health and care cyber security strategy committed to adopt the CAF as the principal cyber standard." It says it expects the CAF to:

• "Emphasise good decision-making over compliance, with better understanding and ownership of information risks at the local organisation level, where those risks can most effectively be managed."
• "Support a culture of evaluation and improvement, as organisations will need to understand the effectiveness of their practices at meeting the desired outcomes – and expend effort on what works, not what ticks a compliance box."

The same page is clear about who sees the new format. NHS Trusts, OES, CSUs, ALBs, ICBs and Genomics organisations see "a different interface when they log in, which sets out CAF-aligned requirements in terms of Objectives, Principles and Outcomes." Everyone else "will retain the current interface and will continue to respond to a list of prescriptive controls, which will be mapped nationally ‘in the background’ against a CAF profile."

What "CAF-aligned" actually means for Category 3 and 4

If you are a care home, community pharmacy, dental practice, optician, or GP practice, you are most likely Category 3 (or Category 4 for GP practices). Here is what the CAF alignment means in practice. (For the narrower question of what CAF alignment means for Category 3 filings specifically, and who has actually moved onto the CAF-aligned view, we have a companion guide.)

1. The toolkit you see is still organised by the ten standards

NHS England's guidance says: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through." Its version 8 workbook marks all 36 assertions as unchanged from version 7, and version 9 keeps the same 36. The Category 3 and 4 workbook has no column linking evidence items to CAF principles. NHS England's 2026-27 organisation-type guidance says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", while for Category 3 "DSP Toolkit view is based on the Category 3 evidence items."

2. The number of mandatory items is broadly similar

For Category 3 organisations, the mandatory set is 45 evidence items in both NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, up from 43 in version 7; for Category 4 it is 29 in all three. (NHS England states that "the number of mandatory questions are determined by your organisation type", so confirm your own count in the toolkit.)

3. Some items ask for proof, not just a document

This is item by item rather than a change across the toolkit. Item 3.2.1, for example, asks "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?" A policy will not answer that; a training completion record will.

4. A few evidence items have been added

Version 8 added three optional Category 3 items (7.1.5 and 7.1.6 on the asset register, and 8.3.8 on the NCSC Early Warning service) and made two items mandatory: 4.3.1, the agreement your IT administrators sign, and 7.1.1, the digital asset register. It also removed the Category 3 item asking whether your suppliers have completed a DSPT or equivalent (10.2.5). Version 9 added four more items, none of them mandatory: 1.3.15, 7.1.7, 10.2.6 and 10.2.7.

For a more detailed walk-through of the v8 changes specifically, see our DSPT v8 changes guide.

CAF principles in plain English

Category 3 and 4 organisations will not see CAF labels in the toolkit, but most of the topics will be familiar from the evidence items. The right-hand column is our own pairing, for orientation only; it is not an NHS England mapping.

The full list of principles is in the NCSC CAF documentation. NHS England's Category 3 and 4 workbook does not show a CAF principle against each item; its CAF-aligned outcome spreadsheet is published for the large organisations only.

How the CAF differs from Cyber Essentials

Many small providers ask whether having Cyber Essentials means they're "done" — or whether the CAF replaces it. The short answer: they are different things, and both still matter.

Cyber Essentials covers the technical baseline (firewalls, secure configuration, access control, malware protection, patch management). It is genuinely useful and provides clean evidence for several DSPT evidence items. The CAF goes broader — including governance, supply chain, training, and incident response.

If your organisation already has Cyber Essentials, that's a strong starting point. NHS England's version 9 workbook marks six Category 3 evidence items as exempt for organisations with Cyber Essentials PLUS. Read more on Cyber Essentials at ncsc.gov.uk/cyberessentials/overview.

What you actually need to do

If you are completing the DSPT for the first time (or for the first time under version 9), you do not need to study the CAF directly. The relevant work is:

1. Read the version 9 announcement — dsptoolkit.nhs.uk/News/169. It gives the 30 June 2027 deadline and links to the workbook for your category.
2. Download the workbook for your category. The Category 3 and Category 4 evidence items are in the version 9 workbook linked from that page. It lists every evidence item and whether it is mandatory for your category.
3. Use the DSPT structure, not raw CAF documents. Reading the CAF directly will give you a deeper understanding, but it is not required for completion.
4. Collect evidence by assertion, not by CAF principle. The toolkit shows assertions; collect what each assertion asks for.
5. Use the standard evidence patterns outlined in our DSPT evidence requirements guide.

For a structured starting point, our evidence checklist generator lists every mandatory evidence item for your category. The readiness quiz gives a quick readiness estimate across seven of the ten standards.

Common misconceptions about the CAF

"CAF-aligned means harder." Not for small providers. Category 3 and 4 organisations still answer evidence items, and the Category 3 mandatory count is 45 in both the version 8 and version 9 workbooks.

"I need to do a full CAF assessment." No. Only Category 1 organisations, such as NHS Trusts and ICBs, see the CAF-aligned view. Category 3 and 4 organisations complete the DSPT evidence items, which NHS England maps to the CAF in the background. Version 9 added two exceptions inside Category 3, neither of them a full assessment this year. Large care providers in CQC's Market Oversight scheme (Category 3a) are asked to "Submit a Cyber Assessment Framework Assessment" (item 9.4.6, not yet mandatory). Local authorities (Category 3b) must "Submit your current progress in completing the Cyber Assessment Framework for Local Government" (item 9.4.7, mandatory). Our companion guide on CAF and Category 3 covers both.

"CAF replaces Cyber Essentials." It doesn't. They serve different purposes. Cyber Essentials remains useful, particularly as supporting evidence for certain DSPT assertions.

"NCSC inspects me." NCSC publishes the CAF and provides technical guidance, but it does not inspect small NHS providers. The DSPT itself is a self-assessment: nobody checks your evidence before you publish. NHS England's mandatory DSPT audits cover NHS trusts, ICBs, ALBs, CSUs, OES and Genomics organisations and IT suppliers, not Category 3 and 4 providers. Your published status is public, though, and CQC's well-led quality statement on governance lists the DSPT as one of its subtopics.

FAQ

What is the Cyber Assessment Framework? The Cyber Assessment Framework (CAF) is a set of cyber security principles published by the National Cyber Security Centre (NCSC). It is used across UK critical national infrastructure and the public sector — including by NHS England, which made it the basis for cyber security and IG assurance in the DSPT in September 2024.

Do small NHS providers need to use the CAF directly? No. Only Category 1 organisations, such as NHS Trusts and ICBs, see a CAF-aligned view of the DSPT. Category 3 and Category 4 providers (care homes, pharmacies, dental practices, opticians, GP practices) answer evidence items under the ten National Data Guardian standards, which NHS England maps to a CAF profile in the background. Version 9 added two exceptions inside Category 3. Large care providers in CQC's Market Oversight scheme (Category 3a) are asked to submit a CAF assessment (item 9.4.6, not yet mandatory). Local authorities (Category 3b) must submit their progress on the CAF for Local Government (item 9.4.7, mandatory).

How is the CAF different from Cyber Essentials? Cyber Essentials is a baseline certification scheme covering five technical controls — useful but narrow. The CAF is a broader, outcome-based framework covering governance, risk management, supply chain, incident response, and more. NHS England uses the CAF as the basis of its cyber assurance, while Cyber Essentials remains useful evidence for some DSPT evidence items.

Where can I read the CAF itself? The CAF is published on ncsc.gov.uk under Collections → Cyber Assessment Framework. The full guidance is freely available, but most small providers do not need to read it directly. Category 3 and 4 organisations answer the DSPT evidence items, which NHS England maps to a CAF profile in the background.

Is the CAF mandatory for the DSPT? The DSPT is mandatory for organisations accessing NHS patient data or systems. For most Category 3 and 4 organisations the CAF is not something you complete separately: you answer the DSPT evidence items, and NHS England maps them nationally "in the background" against a CAF profile. There are two exceptions. Local authorities (Category 3b) must submit their progress on the CAF for Local Government (item 9.4.7, mandatory). Large care providers in CQC's Market Oversight scheme (Category 3a) are asked for a CAF assessment (item 9.4.6, not yet mandatory).

Next steps

1. Confirm your category — log in to dsptoolkit.nhs.uk. Most small providers will be Category 3 (or Category 4 for GP practices).
2. Download the version 9 workbook for your category from the version 9 announcement page.
3. Read our guide to what changed in DSPT version 9 for this year's new and reworded questions.
4. Use the evidence checklist generator to get a structured list of what to gather.
5. Plan your timeline with the deadline calculator.

This guide is based on the NCSC Cyber Assessment Framework and on NHS England's DSPT guidance and workbooks for version 8 (2025/26) and version 9 (2026-27). The CAF is updated periodically — always verify against the official NCSC CAF collection. This is not legal or compliance advice.

Sources

• Cyber Assessment Framework — National Cyber Security Centre
• Cyber Assessment Framework — NCSC
• Introduction to the CAF — NCSC
• DSPT 2026-27 version 9 announcement — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• DSPT 2024-25 version 7 announcement — NHS England
• Changes to the DSPT for large NHS organisations — NHS England
• CAF-aligned DSPT FAQ (2024-25) — NHS England
• Organisation types — NHS England
• DSPT overview guidance — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
• Network and Information Systems Regulations 2018 — legislation.gov.uk
• NIS Directive and NIS Regulations — gov.uk
• Cyber Essentials overview — NCSC
• DSPT 2026-27 areas of mandatory audit — NHS England
• Well-led: governance, management and sustainability — CQC
• Data security and information governance — NHS Digital

This guide breaks down the evidence requirements by category and standard — what types of evidence are accepted, what "good" evidence looks like versus "just-enough" evidence, and where most small providers get stuck.

How evidence works in the DSPT

NHS England's guidance describes the structure: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through. To complete each assertion, you are required to provide evidence items which demonstrate compliance with the assertion."

• Standards — the ten National Data Guardian data security standards
• Assertions — statements under each standard (e.g., 1.1: "The organisation has a framework in place to support Lawfulness, Fairness and Transparency")
• Evidence items — the questions you answer and the documents you upload (e.g., 7.1.1: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?")

That structure has been stable. NHS England's version 8 workbook marks all 36 assertions as unchanged from version 7, and version 9 (2026-27) keeps the same 36; what changes each year is the evidence items. Our guides to what changed in version 9 and the version 8 changes set them out.

Evidence items vary in what they ask for. Some only ask whether something exists: 1.1.1 asks for your ICO registration number. Others ask whether a control is working: 3.2.1 asks whether at least 95% of staff, directors, trustees and volunteers have "completed training on data security and protection, and cyber security, in the last twelve months". Where an item asks about a policy or process, the strongest answer shows the document and that it is in use.

Category 1 organisations see a different, CAF-aligned format. Our Cyber Assessment Framework explained guide covers where the CAF fits for Category 3 and 4 providers.

Evidence volume by category

The Category 3 and 4 figures are counted from NHS England's version 9 (2026-27) workbook, with version 8 (2025/26) totals in brackets; the mandatory counts are the same in both years. Category 4 is the smaller set — 29 mandatory items against 45 for Category 3 — and most of its items are worded exactly as they are for Category 3. Category 1 is assessed differently: NHS England states that "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", and its 2026-27 CAF-aligned workbook sets out 49 outcomes with indicators of good practice, so there is no Category 1 evidence-item count to compare. Category 2 (large suppliers) uses the evidence-item format with a larger set than Category 3. Both categories require an independent audit — Category 1 covers NHS trusts and other large NHS bodies, plus independent providers designated as Operators of Essential Services (OES) and Genomics organisations; Category 2 covers large suppliers. Our guide to DSPT audit requirements sets out exactly which organisations NHS England mandates an audit for.

If you're a care home, pharmacy, or dental practice, you're Category 3. If you're a GP practice, you're Category 4. The rest of this guide focuses on these two categories.

Evidence by standard: what you actually need

Standard 1: Personal confidential data

What they want to know: Is personal data handled, stored and transmitted securely, and only shared for lawful and appropriate purposes? That is the National Data Guardian's wording for Standard 1; limiting access to the people who need it is Standard 4.

Evidence required:

• Information asset register and record of processing activities (item 1.1.2) — the systems and record sets that hold patient/resident data, what each holds, how it is kept safe and who it is shared with
• Data protection and cyber security policies (item 1.3.1) — customised to your organisation and up to date: NHS England's tooltip says policies "should be updated every three years as a minimum"; an annual review is good practice
• Named senior responsibility (item 1.1.5) — the person or people with overall responsibility for data security and protection, and how that responsibility was formally assigned
• ICO registration number and privacy notice (items 1.1.1 and 1.1.3)

What good evidence looks like: A register listing each system or record set, the data it holds, where it is kept, who it is shared with, and the date it was last reviewed. NHS England's tooltip for 1.1.2 says "The register should have been reviewed and approved by the management team at least once in the last twelve months." Alongside it, a dated policy with a review schedule that names your actual systems and procedures.

What weak evidence looks like: A policy downloaded from the internet with your organisation's name pasted in, no review date, and nothing about which systems you actually use.

Standard 2: Staff responsibilities

What they want to know: Do staff understand their data security responsibilities? The Standard 2 assertions are that "Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards" and that "Staff contracts set out responsibilities for data security".

Evidence required:

• Induction (item 2.1.1) — an induction process that "covers data security and protection, and cyber security", with records that new starters completed it
• Contract clauses (item 2.2.1) — employment contracts and volunteer agreements that "contain data security requirements". NHS England's tooltip says "Clauses in contracts or agreements should reference data security (confidentiality, integrity and availability). Many contracts commonly focus on just confidentiality."

What good evidence looks like: An induction checklist with a data security section, signed and dated by each new starter, plus your contract template showing a clause that covers confidentiality, integrity and availability. Asking staff to read and acknowledge the data security policy at induction is good practice and fits here.

What weak evidence looks like: A contract clause that mentions confidentiality only, and no record of what new starters were told about data security.

Go deeper: how to write a DSPT data security policy walks through what NHS England expects in the policy itself, section by section.

Standard 3: Training

What they want to know: Have at least 95% of staff, directors, trustees and volunteers completed data security training in the last twelve months (item 3.2.1)?

Evidence required:

• Training Needs Analysis (TNA) (Category 3 only: item 3.1.1, mandatory; it is not a Category 4 item) — reviewed or approved annually by the person with overall responsibility for data security, showing what training each role needs
• Training completion records — certificates, attendance registers or completion logs showing that at least 95% of staff, directors, trustees and volunteers have trained in the last twelve months (item 3.2.1)
• Optional: training evaluation — a short note on whether training worked (quiz results, assessment scores). NHS England's evaluation guidance is written for Category one organisations; it is not a Category 3 or 4 evidence item, but it supports your TNA

What good evidence looks like: A TNA table listing each role and the training required, signed by the registered manager or practice manager. A training log listing every staff member's name, role, training completed (or still due), date and certificate reference, so you can see whether you have reached 95%. Optionally, a short evaluation statement noting completion rates and any follow-up actions.

What weak evidence looks like: A list of staff names with "completed" next to each one but no certificates, dates, or evidence of what was completed.

Common gap: Agency and locum staff. They count toward the 95%: NHS England's e-learning FAQ says item 3.2.1 covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation".

Go deeper: our DSPT staff training records guide covers what a training record needs to show now that the assessment is built around a training needs analysis.

Standard 4: Managing data access

What they want to know: Are access controls properly managed throughout the employment lifecycle?

Evidence required:

• Access control register — who has access to which systems, at what level
• Joiner/leaver process — documented procedure for granting and revoking access
• Good practice: periodic access reviews — a check that people's access rights are still at the right level. Item 4.2.4's tooltip says the leaver and role-change process "could be by periodic audit"; the toolkit sets no review frequency, so an annual review is good practice rather than a DSPT requirement
• Administrator agreements — a list of everyone with admin-level access, each with a signed agreement holding them to higher standards (item 4.3.1, mandatory for Category 3 since v8 and already mandatory for Category 4)

What good evidence looks like: A spreadsheet listing every staff member, the systems they access, their access level, when access was granted, and the last review date. A separate column for "date access removed" for leavers. Screenshots of system admin panels showing disabled leaver accounts.

Common gap: Administrator agreements, because 4.3.1 only became mandatory for Category 3 in v8. List every account with admin or superuser access across all systems — PMR, care planning software, NHSmail admin, router/firewall management.

Go deeper: the DSPT access controls guide has a worked admin account register you can copy.

Standard 5: Process reviews

What they want to know: Have you reviewed the process behind any data or cyber security breach or near miss in the last year? Item 5.1.1, mandatory for Category 3 and 4, asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" If there were none, NHS England's tooltip says to tick and write "Not applicable".

Evidence required:

• A short record of each post-incident review: what happened, which process allowed it, and what you changed
• If there were no breaches or near misses, a note saying so ("Not applicable" in the toolkit)
• Optional: an annual review of your data processes. The tooltip says "It is good practice to review processes annually even if a breach or near miss has not taken place."

Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies), not Standard 5.

What good evidence looks like: A one-page note for each breach or near miss: date, what happened, the process that allowed it, what you changed and who signed it off. Keep your policy review schedule too, under Standard 1.

Go deeper: our DSPT risk assessment guide covers documenting the risks those reviews are meant to catch.

Standard 6: Responding to incidents

What they want to know: Can you detect and respond to data security incidents?

Evidence required:

• A system for reporting data breaches (item 6.1.1, mandatory for Category 3 and 4) — NHS England's tooltip says the toolkit's own incident reporting tool "should be used to report health and care incidents to Information Commissioner's Office ICO"
• Management sign-off (item 6.1.2, mandatory for Category 3) — if you had a breach, the management team was told and approved the actions to stop it happening again
• Informing the people affected (item 6.1.3, mandatory for Category 3 and 4) — if you had a breach, you considered the risk to the individuals and told them where the risk was high
• Incident response procedure — step-by-step process for reporting and handling data breaches
• Staff awareness — evidence that staff know how to report incidents (covered in Standard 3 training)
• Incident log — a record of incidents reported and actions taken

What good evidence looks like: A procedure document covering what counts as a data incident, who to report to and the first response steps. It should also say how notifiable breaches are reported to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of them, when to tell the people affected, and how you review the process afterwards. An incident log — even if empty — with column headers for date, description, reporter, reporting decision, actions taken, and resolution.

What if you've had zero incidents? That's fine. An empty incident log with the procedure attached shows you have a working system. If you had no breaches in the last 12 months, NHS England's tooltips for 6.1.2 and 6.1.3 say to tick the item and write "Not applicable" in the comments box.

Go deeper: the DSPT incident response guide covers the reporting routes and the ICO threshold in more detail.

Standard 7: Continuity planning

What they want to know: What happens if your systems fail or you suffer a cyber attack?

Evidence required:

• Business continuity plan (BCP) covering IT failure, cyber attack, and data loss scenarios
• Plan review and test evidence — proof that the plan is "regularly reviewed and tested" (item 7.1.2, mandatory for Category 3 and 4). For Category 3, item 7.2.1 also asks how you test it and what the outcome was, and NHS England's tooltip says "This should be in the last twelve months."

What good evidence looks like: A 2-4 page BCP covering:

• PMR/clinical system failure — manual backup procedures, paper-based alternatives
• NHSmail outage — alternative communication methods
• Ransomware/cyber attack — isolation steps and who to contact: your IT provider; the Data Security Centre on 0300 303 5222 for immediate cyber incident advice; Report Fraud, formerly Action Fraud, on 0300 123 2040 to report the crime. If it is a notifiable personal data breach, report it through the DSPT incident reporting tool (see Standard 6)
• Data loss — backup locations, recovery process
• Reviewed date and next review date

A plan that's been "tested" can mean a tabletop exercise: walk through the scenarios with your team, document what you'd do, note any gaps, and fix them. Record the date, participants, and outcomes.

Go deeper: our DSPT business continuity guide has a Standard 7 plan outline sized for a single-site provider.

Standard 8: Unsupported systems

What they want to know: Are all devices running supported software? NHS England states the standard as "No unsupported operating systems, software or internet browsers are used within the IT estate" — while its assessment guide for Standard 8 recognises that "not all unsupported systems can be upgraded" and asks you to demonstrate "that analysis has been done and informed decisions were made."

Evidence required:

• IT asset register — every device (computer, tablet, phone) used by staff, with make, model, OS version, and key software
• Confirmation that no unsupported operating systems or software are in use — and, for anything unsupported that remains, a risk assessment showing it is categorised, documented, and its data security risks identified and managed (assertion 8.2)

What good evidence looks like: A spreadsheet listing every device: location (reception, dispensary, office), device type, make/model, OS version (e.g., Windows 11 23H2), key software installed, and support status. Where a device is running an unsupported OS (Windows 7, Windows 8, or any other end-of-life build), a documented risk assessment for that device with compensating controls and a replacement date — the analysis and the decision, not a bare claim either way.

Common gap: Old devices in back offices or nurse stations that nobody remembers. Walk the building and check every screen. If your IT provider manages your devices, ask them to generate this list — most remote management tools can do it automatically.

Go deeper: our guide to DSPT Standard 8 after Windows 10 support ended covers what to record for each unsupported device and what a documented decision looks like.

Standard 9: IT protection

What they want to know: Are technical security controls in place and working?

Evidence to gather (the toolkit numbers several of these under other standards, but one IT letter can cover them all):

• Encryption — confirmation that laptops, tablets and removable devices holding patient data are encrypted (item 9.5.2)
• Network-device passwords — confirmation that router and other network-device passwords have been changed from the originals (item 9.1.1)
• Firewall — confirmation that a firewall is active and configured (item 9.6.1: not mandatory for Category 3, and not a Category 4 item)
• Patching — evidence that operating systems and software are kept up to date (Standard 8: item 8.3.5 for Category 3, 8.3.1 for Category 4)
• Anti-malware — antivirus or anti-malware installed and updated (Standard 6: item 6.2.1)
• Multi-factor authentication (MFA) — on all remotely accessible user accounts on all systems and, for Category 3, privileged (administrator) accounts too (Standard 4: item 4.5.3, mandatory for Category 3 and 4). Exceptions need approval: for Category 3, by "your board or equivalent senior management"; for Category 4, NHS England's tooltip says the ICB board or senior management decides for ICB-commissioned services, and practice management may decide for practice-commissioned ones

What good evidence looks like: If you have a managed IT provider: a single assurance letter from them confirming all of these controls are in place. This is the most efficient approach — one document covering the lot. This letter covers your own technical controls; it is not the 10.2.1 check on the IT company itself, which asks for that company's cyber security certification.

If you manage IT yourself: screenshots of Windows Security (Defender status), Windows Update (last update date), BitLocker (encryption status), and your router admin page (firewall enabled).

Go deeper: if you are weighing up certification, read whether Cyber Essentials helps with these Standard 9 items.

Standard 10: Accountable suppliers

What they want to know: Do your IT suppliers have robust cyber security arrangements? Item 10.2.1 (mandatory for Category 3 and 4) was reworded in version 9 v1.1 to ask exactly that.

Evidence required:

• A supplier list (item 10.1.2, mandatory for Category 3 and 4) — the suppliers that handle personal information, what they provide and their contact details
• A certification check on your IT suppliers (item 10.2.1) — check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A digital social care record supplier on NHS England's Assured Solutions List has already been assured.
• Separate UK GDPR duty: data processing agreements (DPAs) — UK GDPR requires a contract with any supplier that processes personal data for you. In the toolkit, the contract check is item 10.2.2, which is not mandatory for Category 3 or 4; a DPA is not the 10.2.1 evidence.

What good evidence looks like: A supplier list showing, for each IT supplier, which certification you checked, how (the IASME certificate search, a copy of the ISO 27001 certificate, the supplier's DSPT status from the organisation search) and when, with a reference to the data processing agreement alongside. Keep these organised by supplier.

Key suppliers for small providers:

• PMR system / care planning software provider
• Managed IT provider
• Any cloud storage or backup service
• Delivery management software (pharmacies)
• Clinical system provider (GP practices)

Go deeper: the DSPT supplier assurance guide covers what to ask each supplier for and what a data processing agreement needs to say.

Category 3 vs Category 4: key differences

Most evidence requirements are shared between Categories 3 and 4. In NHS England's version 9 workbook, every Category 4 item is also a Category 3 item except two:

• 6.3.5 — "Have you had any repeat data security incidents within the organisation during the past twelve months?"
• 8.3.1 — "How do you make sure that the latest software updates are downloaded and installed promptly?" (mandatory for Category 4)

The other difference is size: Category 4 has 49 items, 29 of them mandatory, against Category 3's 80 and 45, and four shared items (1.3.6, 4.1.1, 4.5.3 and 7.3.4) are worded differently for Category 4. The workbook has no separate Category 4 items on NHS Spine, smartcards or clinical-system access, though your evidence for the shared access-control items will naturally come from your clinical system.

If you're a GP practice, check the version 9 workbook for Category 4 specifically. Our DSPT for GP practices guide covers the Category 4 evidence items and where a practice's evidence usually comes from.

Dental practices are Category 3, but the evidence hangs off different systems again — our DSPT for dental practices guide covers the practice-management-software and NHSmail items.

Getting your evidence ready

Rather than working through the DSPT standard by standard, group your evidence preparation by type:

1. Policies first — review, update, and date-stamp all data-related policies. One session, multiple standards covered.
2. Training records next — the most time-consuming evidence to gather. Start early.
3. IT technical evidence — one request to your IT provider covers Standards 8 and 9, and parts of 4, 6 and 7.
4. Access records — document who has access to what. Standard 4.
5. Supplier evidence — certification checks on 3-4 key IT suppliers. Standard 10.

For a checklist of every mandatory evidence item for your category, use the evidence checklist generator.

Next steps

• Generate your mandatory evidence checklist by category
• Check the deadline calculator for your submission timeline
• Take the readiness quiz for a quick readiness estimate across seven of the ten standards
• Read the complete DSPT guide for a full overview
• Follow the step-by-step completion guide when you're ready to start

This guide reflects DSPT version 9 (2026-27), the current toolkit. Category 2, 3 and 4 counts are taken from NHS England's version 9 workbook for those categories, with the version 8 Category 3 and 4 totals from its version 8 workbook; the Category 1 outcome count is from NHS England's version 9 CAF-aligned workbook. Counts may vary by organisation sub-type. Always verify current requirements on the official DSPT portal and download the version 9 workbook for your category. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 — NHS England
• DSPT incident reporting — NHS England
• DSPT e-learning FAQ — NHS England
• Version 9 (2026-27) CAF-aligned outcomes and indicators of good practice (spreadsheet) — NHS England
• DSPT organisation types and categories — NHS England
• National Data Guardian data security standards — GOV.UK
• Cyber Assessment Framework — NCSC

This guide covers the DSPT specifically for community pharmacies — what category you fall under, what evidence you need, how to work with your PMR supplier, and how multi-site operators can use batch submissions.

Your DSPT category

Community pharmacies are Category 3 in the DSPT. This means:

• You complete a core self-assessment against the 10 National Data Guardian standards
• No independent audit required
• A pre-determined set of mandatory evidence items to complete — 45 for Category 3 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks; confirm your own count in the toolkit
• You should plan to reach "Standards Met" by the 30 June deadline, which falls every year (NHS England's guidance names only social care organisations as eligible for a one-off Approaching Standards assessment, so it is not a route to plan around)

You register at dsptoolkit.nhs.uk using your pharmacy's ODS code, but the code does not set your category. You choose your sector in the Organisation Profile at first login, and NHS England states that "the organisation type determines which Category of toolkit is to be completed" — so a predecessor's wrong sector choice quietly gives you the wrong question set. You can change the answer at any time; check it before you start.

Pharmacy-specific challenges

Community pharmacies face DSPT challenges that differ from care homes and GP practices:

PMR system dependency. Your Patient Medication Record system holds the bulk of your patient data. Much of your DSPT evidence — access controls, data encryption, audit trails — depends on what your PMR system provides. You can't answer many technical questions without your supplier's input.

Multiple data touchpoints. A typical community pharmacy handles data across several systems: PMR, NHSmail, NHS Spine, the Electronic Prescription Service (EPS), summary care records, and potentially a delivery management system. Each one needs documented access controls.

Small teams with high volume. A community pharmacy often has a small team handling a high volume of prescriptions every day. There's limited time for compliance administration between dispensing, clinical checks, and patient consultations.

Extended hours and locums. Pharmacies with long opening hours, often including weekends, rely on locum pharmacists and relief staff. Each locum needs data security awareness and access credentials — but they may work at your pharmacy for a single day.

Controlled drugs and clinical records. Pharmacies handle controlled drug registers, clinical interventions, and consultation records for services such as the New Medicine Service and Pharmacy First alongside routine dispensing data. The data sensitivity profile is different from a care home.

Evidence requirements for pharmacies

Here's what Category 3 pharmacies typically need for each of the 10 NDG standards under DSPT version 9 (2026-27). Verify against the official portal for your specific assertion list.

Standard 1: Personal confidential data

What you need:

• An information asset register and record of processing activities (item 1.1.2): the systems holding patient data (PMR, NHSmail, EPS, delivery logs), what they hold and who you share it with
• Data protection and cyber security policies that are up to date (item 1.3.1): NHS England's tooltip says policies "should be updated every three years as a minimum"; an annual review is good practice
• The named person or people with overall responsibility for data security and protection, such as the superintendent pharmacist or pharmacy manager (item 1.1.5)

Pharmacy tip: Who can access each system is Standard 4 evidence, covered below. Keep the register focused on what data you hold, where, and who you share it with.

Data Protection Officer. Separately from the DSPT, UK GDPR Article 37 requires a public authority to designate a Data Protection Officer (DPO). The Freedom of Information Act 2000 lists anyone providing NHS pharmaceutical services as a public authority for information about those services, and the Data Protection Act 2018 applies that definition to UK GDPR. So designate a DPO for your NHS work. The DPO can be a staff member or a contracted service.

Standard 2: Staff responsibilities

What you need:

• An induction process that covers data security and protection, and cyber security, with completion records (item 2.1.1)
• Employment contracts and volunteer agreements with a data security clause (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality."

Pharmacy tip: Add a data security section to your induction checklist, including for locums, and keep the signed copies. Asking staff to read and sign the data security policy is good practice too.

Standard 3: Training

What you need:

• Training completion records showing at least 95% of staff trained in the last twelve months, counting locums (item 3.2.1)
• Training Needs Analysis endorsed by the superintendent pharmacist
• Optional: a short note on whether the training worked (good practice; not a Category 3 evidence item)

Pharmacy tip: The free NHS e-Learning for Healthcare module works well for permanent staff. Locums count towards the 95%: NHS England's e-learning FAQ says item 3.2.1 covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation". Ask locums or their agencies for a current training certificate, and have them sign your data security policy on arrival as good practice.

Standard 4: Managing data access

What you need:

• Access control records for all systems
• Joiner/leaver/mover process for system access
• Evidence of regular access reviews

Pharmacy tip: When a dispenser or pre-reg leaves, remove their PMR access the same day. Screenshot the disabled account as evidence. For locums, decide whether they get temporary individual accounts or supervised access under another user's login — individual accounts are stronger evidence but more administrative work.

Standard 5: Process reviews

What you need:

• A record that you reviewed the process behind any data or cyber security breach or near miss in the last year (item 5.1.1, mandatory for Category 3), or "Not applicable" if there were none
• Optional: an annual review of your data processes, which NHS England's tooltip calls good practice

Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies).

Pharmacy tip: Review all data-related policies together in January — data security, acceptable use, retention, breach notification. Date-stamp each policy when reviewed. One session covering all policies generates evidence for the full year.

Standard 6: Responding to incidents

What you need:

• A system for reporting data breaches (item 6.1.1, mandatory): NHS England's tooltip says the toolkit's own incident reporting tool "should be used to report health and care incidents to Information Commissioner's Office ICO"
• If you had a breach, a record that the management team was told and approved the actions to stop it recurring (item 6.1.2, mandatory for Category 3), and that you considered the risk to the people affected and told them where it was high (item 6.1.3, mandatory)
• Incident reporting procedure
• Staff awareness of how to report data incidents
• Incident log (even if empty)

Pharmacy tip: Common pharmacy data incidents include: misdirected prescription bags (wrong patient), NHSmail sent to wrong address, delivery driver accessing patient names, and lost prescriptions. Your procedure should cover what to do in each case, and that notifiable breaches are reported to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of them. Our DSPT incident response guide covers the route and the 6.1.x items in detail.

Standard 7: Continuity planning

What you need:

• Business continuity plan covering IT failure and cyber attack
• Evidence that the plan is regularly reviewed and tested (item 7.1.2), including a test in the last twelve months (item 7.2.1 asks how you test it and what the outcome was)

Pharmacy tip: Your BCP should answer: if the PMR goes down, can you dispense manually using emergency supply procedures? If NHSmail fails, how do you communicate with GPs? If EPS is unavailable, can you process paper prescriptions? If you suffer ransomware, who do you call? (Your IT provider; the Data Security Centre on 0300 303 5222 for immediate cyber incident advice; and Report Fraud, formerly Action Fraud, on 0300 123 2040. If it is a notifiable personal data breach, report it through the DSPT incident reporting tool; see Standard 6.) A 2-3 page document covering these scenarios is sufficient.

Standard 8: Unsupported systems

What you need:

• IT asset register with OS versions
• Confirmation that no unsupported operating systems are in use, or a risk document for any you keep (item 8.2.1)

Pharmacy tip: Check the computers running your PMR. Older pharmacies sometimes have Windows 7 or Windows 8 machines that haven't been replaced. These are unsupported: replace them, or record why you are keeping them, the risks and what you are doing to reduce them (items 8.1.4 and 8.2.1). Your PMR supplier may have minimum OS requirements — check with them.

Standard 9: IT protection

What you need:

• Encryption on laptops, tablets and removable devices (item 9.5.2), router and network-device passwords changed from the originals (item 9.1.1), and firewall confirmation (item 9.6.1, not mandatory)
• Related controls the toolkit numbers under other standards: antivirus (Standard 6, item 6.2.1), patching (Standard 8, item 8.3.5) and multi-factor authentication (MFA) on all remotely accessible and administrator (privileged) accounts on all systems, with exceptions only as approved by senior management (Standard 4, item 4.5.3, mandatory)

Pharmacy tip: If your pharmacy has a managed IT provider, ask them for an assurance letter covering all technical controls. This letter covers your own technical controls; it is not the 10.2.1 check on the IT company itself, which asks for that company's cyber security certification. If you manage IT yourself, document what's in place: Windows Defender (built-in antivirus), Windows Update (automatic patching), BitLocker (disk encryption), and your router's firewall settings.

Standard 10: Accountable suppliers

What you need:

• A list of the suppliers that handle personal information, what they provide and their contact details (item 10.1.2, mandatory)
• A certification check on your IT suppliers (item 10.2.1, mandatory, reworded in version 9 v1.1): check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead
• Data processing agreements with suppliers that process personal data for you. UK GDPR requires them; the toolkit's contract item (10.2.2) is not mandatory for Category 3, and a DPA is not the 10.2.1 evidence

Pharmacy tip: Your key IT suppliers are your PMR provider, your managed IT company (if any), and any delivery management software. Run the check above for each one and note when you did it.

Working with your PMR supplier

Your PMR supplier is critical for DSPT completion. Several technical questions — about encryption, access controls, audit logging, and data backup — can only be answered with information from your PMR system.

Community Pharmacy England notes that some IT suppliers use the Toolkit IT supplier feature. Your supplier gives you an account address, you add it as a "Member" in the Toolkit's Admin > User List section, and the supplier can then bulk-insert its answers to the mandatory technical questions. You can add to or amend those answers afterwards. Before you add the supplier, note CPE's caveat: "Your supplier, as a 'Member' within the Toolkit, will technically be able to see your answers to all the questions."

Before you start the DSPT:

1. Contact your PMR supplier and ask what DSPT support they offer
2. Ask whether they use the Toolkit IT supplier feature for the mandatory technical questions, and when they upload
3. Ask for their cyber security certification (Cyber Essentials, ISO 27001 or a DSPT status of Standards Met or better) for item 10.2.1, and for a data processing agreement
4. Ask for confirmation of encryption, backup, and access control features

Getting this information in February or March avoids a panicked email exchange in June.

Multi-site operators: batch submissions

If your pharmacies are one legal entity and every branch follows the same policies, you can publish one head office (HQ) assessment for them instead of an assessment per branch. NHS England's Pharmacy HQ organisation type covers "Pharmacy organisations with more than one branch and a Head Office IG function where branch staff are contractually required to follow the policies, procedures and training provided by that Head Office IG function". You complete the DSPT under your head office's ODS code and, when you publish, choose which of the listed branches the assessment covers. Because the one assessment is applied to every branch you select, it has to be true for all of them. Community Pharmacy England describes this batch submission functionality for contractors "with three or more pharmacies"; NHS England's Pharmacy HQ type starts at more than one branch.

Community Pharmacy England provides batch submission guidance including how to set up your HQ-branch structure and ensure all branches are correctly linked via their ODS codes.

Important: Even with batch submission, you need to verify that each branch's ODS code is correctly linked to your head office. NHS England takes the branch list from ODS data and asks you to contact the helpdesk if it is wrong; a branch that is missing from the list, or not selected when you publish, is not covered.

Timeline for pharmacies

NHS England publishes no time estimate. As a planning assumption, allow several weeks to a few months of part-time work for a first submission, and less for a repeat, where you review and update last year's answers. Spreading it across the months before the deadline keeps it manageable.

Next steps

• Use the evidence checklist generator for a checklist of every mandatory Category 3 evidence item
• Read the DSPT staff training guide for detailed training evidence guidance
• Take the readiness quiz for a quick readiness estimate across seven of the ten standards
• Check the deadline calculator for your timeline
• Read the complete DSPT guide for an overview of the current requirements
• Follow the step-by-step completion guide when you're ready to start
• Get your PMR and wholesaler paperwork in order with the DSPT supplier assurance guide

This guide reflects DSPT version 9 (2026-27), the current toolkit, for Category 3 organisations. Always verify current requirements on the official DSPT portal. Community Pharmacy England provides pharmacy-specific guidance. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT guidance for community pharmacies — Community Pharmacy England
• Advanced services (New Medicine Service, Pharmacy First) — Community Pharmacy England
• DSPT organisation types (Pharmacy HQ) — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (items 4.5.3, 6.1.1–6.1.3, 10.1.2, 10.2.1) — NHS England
• DSPT incident reporting — NHS England
• Report Fraud replaces Action Fraud — GOV.UK
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare
• UK GDPR Article 37: designation of the data protection officer — legislation.gov.uk
• Data Protection Act 2018 section 7: meaning of "public authority" — legislation.gov.uk
• Freedom of Information Act 2000 Schedule 1 Part III (paragraph 44: pharmaceutical services) — legislation.gov.uk
• National Data Guardian data security standards — GOV.UK

This guide covers what to gather before you start, how registration and login work, what you'll see on screen, and the most common mistakes that waste time.

Before you log in: what to gather first

The biggest time sink in the DSPT isn't answering questions — it's hunting for evidence. If you open the portal without preparation, you'll spend most of your time switching between the toolkit and your email, filing cabinet, and IT provider's inbox.

Gather these before you start:

Documents you'll need:

• Your current data security policy, with its last review date (NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum")
• Business continuity plan covering IT failure and cyber attack
• Incident reporting procedure
• Staff training records — certificates or completion confirmations with dates
• Confidentiality agreements or employment contract clauses covering data security
• A list of the suppliers that handle personal information (item 10.1.2), and the data processing agreements you hold with them

Information you'll need to look up:

• Your Organisation Data Service (ODS) code — you need it to register. It identifies your organisation but does not set your DSPT category; that comes from the sector you choose in the Organisation Profile (see below)
• A list of every system holding patient/resident data (care planning software, NHSmail, paper records, spreadsheets)
• Who has access to each system and at what level
• Your IT asset register — every computer, tablet, and phone used by staff, with operating system versions
• Your IT provider's contact details (you'll need to check their cyber security certification for item 10.2.1)

People you'll need to involve:

• Your IT provider or managed service company — for technical security evidence
• A named data protection lead (usually the registered manager or practice manager)
• Someone to chase staff training completions

If you can tick off even half this list before opening the portal, you're ahead of most providers.

Registration and login

The toolkit is at dsptoolkit.nhs.uk. You'll need:

1. An ODS code — your organisation's unique identifier. If you don't know yours, Digital Care Hub explains how to find your ODS code, or you can search directly on the DSPT portal during registration.
2. An email address — NHS England's guidance asks only for "an email address", so a work address you check regularly is fine if you don't have NHSmail.
3. Authorisation — you need to be authorised to submit on behalf of your organisation. For a care home, this is typically the registered manager. For a GP practice, the practice manager.

If your organisation submitted last year, its user accounts should still exist — log in with your existing credentials. If this is your first submission, you'll need to register your organisation and create an account. NHS England's guidance adds one step that catches people out: if registration tells you "your organisation already has an administrator", you "will have to contact this person directly as they will be responsible for adding new users for your organisation", and if you don't know who that is, contact the DSPT helpdesk.

Can't find the login? The toolkit is browser-only, with no app: go to dsptoolkit.nhs.uk. If you still can't get in, the DSPT helpdesk handles account and registration problems.

What you'll see on the dashboard

Once logged in, the dashboard shows your submission for the current year (2026-27). The exact layout and labels change from release to release, but you should see:

• Your category — Category 3 (care homes, pharmacies, dentists, opticians) or Category 4 (GP practices). It is not derived from your ODS code: you choose your organisation's sector in the Organisation Profile at first login, and NHS England states that "the organisation type determines which Category of toolkit is to be completed". You can change that answer at any time, so check it is right before you start.
• The 10 standards listed as sections, each expandable to show the assertions and evidence items underneath
• Progress indicators — showing how far through the mandatory items you are
• Your publication status — whether you have published an assessment for this year yet

Each of the 10 National Data Guardian standards contains several assertions — statements about what your organisation should be doing. Under each assertion, there are evidence items — specific documents, confirmations, or screenshots you need to provide.

For Category 3, expect a pre-determined set of mandatory evidence items across all 10 standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, and NHS England states that "the number of mandatory questions are determined by your organisation type", so work from the list your own toolkit shows you. Category 4 (GP practices) has its own pre-determined set — 29 mandatory items in the same workbooks.

How to work through it efficiently

Don't try to do it in one sitting. Save as you go and come back to it. NHS England publishes no time estimate. As a planning assumption, allow several weeks to a few months of part-time work for a first submission, and less for a repeat, where you review and update last year's answers. Digital Care Hub's republishing guidance says: "You need to review, update and save any changes to your previous questions" before you republish.

Work by evidence type, not by standard. Instead of completing Standard 1, then Standard 2, gather similar evidence together:

1. Policy documents first — upload your data security policy, acceptable use policy, incident response procedure, and business continuity plan. These cover multiple standards in one go.
2. Training records next — certificates, completion logs, your Training Needs Analysis. This covers Standard 3 and parts of Standard 2.
3. IT technical evidence — ask your IT provider for one written summary covering firewall configuration, patching, encryption, and antivirus. This covers Standards 8 and 9, plus antivirus, which is item 6.2.1 under Standard 6.
4. Access control records — document who has access to what systems and when access was last reviewed. Standard 4.
5. Supplier assurance — Standard 10. Item 10.1.2 asks for a list of suppliers that handle personal information. For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.

This approach means fewer context switches and less time repeating similar tasks.

Save evidence files with clear names. "Training_log_2026-27.xlsx" is findable next year. "Document1.docx" isn't. The portal doesn't enforce naming conventions, but your future self will thank you.

Common mistakes that waste time

Starting too late. If you begin in June, you're chasing evidence under deadline pressure. Start by March for a calm submission.

Uploading out-of-date documents. NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum", and documents with no review date at all are weak evidence. Check every document has a current review date before uploading; an annual review is good practice.

Forgetting agency staff. Your training records need to cover everyone who handles data — including temporary and agency workers. This catches many care homes out.

Treating it as a tick-box exercise. Some items ask whether a control actually works, not just whether a document exists: 3.2.1, for example, asks whether at least 95% of staff, directors, trustees and volunteers have completed training "in the last twelve months". For each assertion, ask: "Can I prove this actually happens, not just that a document exists?"

Not involving your IT provider early. Standards 8 and 9 (unsupported systems and IT protection) need technical evidence. If your IT provider takes two weeks to respond to requests, factor that into your timeline.

Ignoring the help resources. The DSPT support pages include guidance for each assertion. Digital Care Hub provides free templates and local support for social care providers. Use them — they're specifically designed for small organisations.

Your pre-start checklist

Before opening the portal, confirm you have:

• ODS code for your organisation
• Login credentials (or readiness to register)
• Data security policy with current review date
• Staff training log with completion dates
• Business continuity plan
• List of systems holding patient/resident data
• IT asset register (devices and OS versions)
• IT provider's contact details for certification checks
• Named data protection lead

For a checklist of every mandatory evidence item for your category, use the evidence checklist generator. It shows what to gather before you start.

Next steps

• Check your readiness with the DSPT readiness quiz: 10 questions for a quick readiness estimate across seven of the ten standards
• See how much time you have with the deadline calculator
• Read the complete DSPT guide for what the toolkit is and a full overview of the current requirements
• See what changed in the current version with our guide to the 2026-27 (version 9) DSPT
• Learn where the Cyber Assessment Framework fits in our Cyber Assessment Framework explained guide
• Follow the step-by-step completion guide when you're ready to start

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT support and guidance — NHS England
• DSPT support for social care — Digital Care Hub
• Publish or republish your DSPT — Digital Care Hub
• DSPT organisation types and categories — NHS England
• DSPT version 9 (2026-27) evidence item workbook, v1.1 (items 1.3.1, 3.2.1, 6.2.1, 10.1.2, 10.2.1) — NHS England
• National Data Guardian data security standards — GOV.UK

Care homes fall under Category 3 in the DSPT, which has a pre-determined set of mandatory evidence items across the 10 National Data Guardian standards — 45 in NHS England's version 8 (2025/26) and version 9 (2026-27) workbooks, and NHS England states that "the number of mandatory questions are determined by your organisation type", so work from the list your own toolkit shows you. You don't need an independent audit (that's Categories 1 and 2 only), but your evidence needs to be current, specific, and actually uploaded to the portal by the 30 June deadline.

Care home-specific challenges

Care homes face DSPT challenges that pharmacies and GP practices don't:

• High staff turnover. Staff turnover in a care home can be high, and every starter and leaver means training records to track and system access to manage.
• Mixed IT literacy. Staff range from nurses comfortable with clinical systems to care assistants who primarily use paper. Getting everyone through online data security training requires coordination.
• Agency and bank staff. Temporary staff need data security training too. Getting certificates from agencies — or requiring completion of your own training — adds administrative overhead.
• Multiple access points. Medication administration records (MAR charts), care plans, resident information, NHSmail — several systems hold personal data, often accessed by different staff groups.
• No dedicated IT. A smaller care home often has no IT department of its own. The registered manager or a deputy handles everything, often with an external IT support company.

Evidence requirements by standard

Here's what Category 3 care homes typically need for each of the 10 NDG standards. This reflects DSPT version 9 (2026-27) requirements — always verify against the official portal.

Standard 1: Personal confidential data

What they're asking: Is resident data handled, stored and transmitted securely, and only shared for lawful and appropriate purposes? (Who can access what is Standard 4.)

Evidence you need:

• An information asset register and record of processing activities (item 1.1.2): the systems and records holding resident data (care planning software, NHSmail, paper records), what they hold and who you share it with
• Data protection and cyber security policies customised to your care home, not a generic template, and updated at least every three years (item 1.3.1)
• The named person or people with overall responsibility for data security and protection, usually the registered manager (item 1.1.5)

Care home tip: List paper records too: care plans, MAR charts and handover sheets kept in the building all belong in the register. NHS England's tooltip for 1.1.2 says "The register should have been reviewed and approved by the management team at least once in the last twelve months."

Standard 2: Staff responsibilities

What they're asking: Do staff understand their data security responsibilities?

Evidence you need:

• An induction process that covers data security and protection, and cyber security, with completion records (item 2.1.1)
• Employment contracts and volunteer agreements with a data security clause (item 2.2.1). NHS England's tooltip says clauses "should reference data security (confidentiality, integrity and availability)" and warns that "Many contracts commonly focus on just confidentiality."

Care home tip: Add a data security section to your induction checklist and have each new starter sign it. Digital Care Hub publishes an example staff contract clause, linked from the 2.2.1 tooltip. An annual policy sign-off at a team meeting is good practice too: record the date, attendees and what was covered.

Standard 3: Training

What they're asking: Have at least 95% of staff, directors, trustees and volunteers completed data security training in the last twelve months (item 3.2.1)?

Evidence you need:

• Training completion records showing at least 95% of staff, directors, trustees and volunteers trained in the last twelve months
• Certificates or completion confirmations with dates
• Coverage of temporary/agency staff

Care home tip: Training is a common gap. Start sending training in January — not April. The free NHS e-Learning for Healthcare module generates certificates automatically, and NHS England's Category 3 guidance for 3.2.1 names a second free option: Digital Care Hub's Data Security and Protection eLearning course, which it says "meets this requirement for staff working in adult social care". For staff who struggle with online learning, you can run a supervised group session, but each person still needs to pass the assessment. NHS England's e-learning FAQ says 3.2.1 means staff have completed their training "including passing a mandatory test", and that local training counts "where this has been agreed as covering with the learning objectives of the National E-Learning system". Record attendance and each person's assessment result, not just attendance.

Agency staff count towards the 95%: NHS England's e-learning FAQ says item 3.2.1 covers "95% of all staff including new starters, locums, temporary, students and staff contracted to work in the organisation". For agency staff, either:

1. Ask agencies for data security training certificates for each worker they send, or
2. Include agency workers in your own training sessions.

Asking agency workers to acknowledge your data security policy on their first shift is good practice on top of training, not instead of it.

For what the training record itself needs to show, and what the training needs analysis should cover, see our DSPT staff training guide.

Standard 4: Managing data access

What they're asking: Is access properly controlled and reviewed?

Evidence you need:

• Access control register (who has access to what, and what level)
• Documented joiner/leaver process
• Evidence of regular access reviews (if your care plans are on a digital system, a screenshot of its user management screen showing roles and access levels works well)
• A list of your IT system administrators, each with a signed agreement holding them to higher standards (item 4.3.1, mandatory for Category 3 since version 8)

Care home tip: Create a simple spreadsheet listing every staff member, the systems they access, their role/access level, and the date access was last reviewed. When someone leaves, update the spreadsheet and remove their access the same day. Screenshot the system's user management screen showing the account has been disabled — that's your evidence.

Standard 5: Process reviews

What they're asking: Have you reviewed the process behind any data or cyber security breach or near miss in the last year? Item 5.1.1, mandatory for Category 3 and 4, asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" If there were none, NHS England's tooltip says to tick and write "Not applicable".

Evidence you need:

• A short record of each post-incident review: what happened, which process allowed it, and what you changed
• If there were no breaches or near misses, a note saying so ("Not applicable" in the toolkit)
• Optional: an annual review of your data processes. The tooltip says "It is good practice to review processes annually even if a breach or near miss has not taken place."

Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies), not Standard 5.

Care home tip: Add a "last reviewed" date and "next review" date to every policy document. Review all data-related policies together annually — data security, acceptable use, retention, breach notification. One annual review session covering all policies is more realistic than reviewing each one individually.

Standard 6: Responding to incidents

What they're asking: Can you detect and respond to data security incidents?

Evidence you need:

• A system for reporting data breaches (item 6.1.1, mandatory): NHS England's tooltip says the toolkit's own incident reporting tool "should be used to report health and care incidents to Information Commissioner's Office ICO"
• If you had a breach: a record that the management team was told and approved the actions to stop it recurring (item 6.1.2, mandatory), and that you considered the risk to the people affected and told them where it was high (item 6.1.3, mandatory). If you had none in the last 12 months, the tooltips say to tick and write "Not applicable"
• Incident reporting procedure
• Evidence that staff know how to report incidents
• Incident log (even if no incidents have occurred — the log proves the process exists)

Care home tip: Your incident procedure should cover what counts as a data incident (lost phone, misdirected email, suspected breach), who to report it to (registered manager) and what happens next. That means an assessment; if the breach is notifiable, a report to the ICO through the DSPT incident reporting tool within 72 hours of becoming aware of it; and telling the residents or families affected where the risk to them is high. Our DSPT incident response guide covers the route step by step. If you've had zero incidents, that's fine — the empty log with the procedure attached shows you have a working system.

Standard 7: Continuity planning

What they're asking: What happens if your systems fail?

Evidence you need:

• Business continuity plan covering IT failure, cyber attack, and data loss
• Evidence that the plan is regularly reviewed and tested (item 7.1.2), including a test in the last twelve months: item 7.2.1 asks how you test it and what the outcome was, and NHS England's tooltip says "This should be in the last twelve months."

Care home tip: Your BCP for a care home should answer these questions:

• If the care planning system goes down, where are the paper backup MAR charts?
• If NHSmail is unavailable, how do you communicate with GPs and hospitals?
• If you suffer a ransomware attack, who do you call? (Your IT provider; the Data Security Centre on 0300 303 5222 for immediate cyber incident advice; and Report Fraud, formerly Action Fraud, on 0300 123 2040. If it is a notifiable personal data breach, report it through the DSPT incident reporting tool; see Standard 6.)
• Where are your offline backups of critical resident information?

A 2-3 page document covering these scenarios is sufficient. You don't need a 50-page disaster recovery plan.

Standard 8: Unsupported systems

What they're asking: Are all your devices running supported software?

Evidence you need:

• IT asset register (hardware and software inventory with OS versions)
• Confirmation that no unsupported operating systems are in use, or a risk document for any you keep (item 8.2.1)

Care home tip: The "digital asset register" (item 7.1.1, which the toolkit numbers under Standard 7) has been mandatory for Category 3 since version 8. List every computer, tablet, and phone used by staff, the operating system version, and the key software installed. If your IT provider manages your devices, ask them for this list — most can generate it from their remote management tools.

Check for old Windows 7 or Windows 8 machines that may still be in offices or nurse stations. These are unsupported: replace them, or record why you are keeping them, the risks and what you are doing to reduce them. Item 8.1.4 asks whether your systems are "still supported by the manufacturer or the risks are understood and managed", and item 8.2.1 asks for that risk document.

Standard 9: IT protection

What they're asking: Are technical security controls in place?

Evidence you need:

• Encryption on laptops, tablets and removable devices holding resident data (item 9.5.2)
• Confirmation that router and other network-device passwords have been changed from the originals (item 9.1.1)
• Firewall configuration confirmation (item 9.6.1, not mandatory)

The toolkit numbers two related controls under other standards, but the same IT letter can cover them: patching (Standard 8, item 8.3.5) and anti-malware/antivirus (Standard 6, item 6.2.1).

Care home tip: If you have a managed IT provider, ask them for a single assurance letter covering all of these. Most providers can issue a standard statement confirming: firewalls are configured, patches are applied automatically, devices have encryption enabled (BitLocker for Windows, FileVault for Mac), and antivirus is installed and updated. This letter covers your own technical controls; it is not the 10.2.1 check on the IT company itself, which asks for that company's cyber security certification.

Standard 10: Accountable suppliers

What they're asking: Do you know which suppliers handle personal information, and do your IT suppliers have robust cyber security arrangements? (Both are mandatory; the second, item 10.2.1, was reworded in version 9 v1.1.)

Evidence you need:

• A list of the suppliers that handle personal information, what they provide and their contact details (item 10.1.2, mandatory)
• A certification check on your IT suppliers (item 10.2.1): check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead
• Data processing agreements (DPAs) with suppliers that process resident data for you. UK GDPR requires them; the toolkit's contract item (10.2.2) is not mandatory for Category 3, and a DPA is not the certification check

Care home tip: Your key IT suppliers are likely your care planning software provider and your managed IT company. If your digital social care record supplier is on NHS England's Assured Solutions List, NHS England's tooltip says such suppliers "have been assured by NHS England to meet cyber security requirements" — note that in your answer. For the others, use the check above. Keep these on file — you'll need them every year.

Timeline for care homes

NHS England publishes no time estimate. As a planning assumption, allow several weeks to a few months of part-time work for a first submission, and less for a repeat, where you review and update last year's answers. Spreading it from January keeps it manageable.

Next steps

• Use our evidence checklist generator to get a checklist of every mandatory Category 3 evidence item

• Check the deadline calculator to see how much time you have

• Draft the Standard 7 plan with our DSPT business continuity guide

• Read the complete DSPT guide for a broader overview of the current requirements

• Dive deeper into the evidence requirements by category for the assertion-by-assertion breakdown

• See what changed in version 8 — including the digital asset register and the administrator agreement — in our DSPT v8 changes explained guide

• If you also run a domiciliary care branch, the DSPT for domiciliary care guide covers the device and data-in-transit items that a residential setting doesn't have to answer

This guide reflects DSPT version 9 (2026-27), the current toolkit, for Category 3 organisations. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 — NHS England
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare
• DSPT e-learning FAQ — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (items 6.1.1–6.1.3, 10.1.2, 10.2.1) — NHS England
• DSPT incident reporting — NHS England
• Report Fraud replaces Action Fraud — GOV.UK
• National Data Guardian data security standards — GOV.UK

This guide breaks the submission down into a week-by-week action plan for Category 3 and Category 4 organisations. Each week has one clear task. No marathons, no June panic.

The 90-day timeline at a glance

NHS England publishes no time estimate. As a planning assumption, allow several weeks to a few months of part-time work for a first submission, and less for a repeat, where you review and update last year's answers.

Week 1: Log in and orient yourself

Task: Log in to dsptoolkit.nhs.uk, confirm your organisation's category (3 or 4), and download the version 9 (2026-27) workbook from the version 9 announcement page, filtered to your category.

If you can't log in, check which route you used last time: a DSPT account (email address and password), or "Log in with NHSmail", which NHS England's login page offers "For users who signed up with NHSmail or have upgraded their existing account to NHSmail". If the person who held the account has left, or your ODS code is not linked, contact the DSPT helpdesk (0300 303 5035, Monday to Friday, 8am to 5pm). NHS England asks you to "wait 5 days before escalating" a call that is not urgent, which is why it's Week 1.

Deliverable: Printed or saved copy of the version 9 workbook, annotated with your category's assertions.

Week 2: Audit what you already have

Task: Go through each evidence item in the spreadsheet and mark it red/amber/green:

• Green: Evidence exists and is current (dated within 12 months, matches the current wording)
• Amber: Evidence exists but needs updating (out of date, or written for an earlier version and may not match the current wording)
• Red: No evidence exists — you need to create this

This audit tells you exactly how much work remains. How much is green varies widely between organisations; the audit is what tells you where you stand.

Our evidence checklist generator lists every mandatory evidence item for your category, so you can colour-code those first: they are what Standards Met depends on.

Deliverable: Colour-coded evidence spreadsheet showing your gaps.

Week 3: Launch staff training

Task: Send annual data security awareness training to everyone with access to personal data. Item 3.2.1 needs at least 95% of staff, directors, trustees and volunteers to have completed it in the twelve months before you publish. NHS England's tooltip says "All people in your organisation with access to personal data must complete appropriate data security and protection, and cyber security, training every year." This is the longest lead-time item: it depends on other people completing something, and some will need chasing.

Free options: for adult social care, NHS England's Category 3 tooltip for item 3.2.1 names Digital Care Hub's Data Security and Protection eLearning as a free course that "meets this requirement for staff working in adult social care". The NHS e-Learning for Healthcare data security awareness module is also free: it is split into four modules of around 20 minutes each plus a welcome module, according to NHS England's e-learning FAQ, and generates a downloadable certificate.

Who needs to complete it: Every person with access to patient data or NHS systems. This includes:

• Permanent staff (all roles, including kitchen, maintenance, and admin staff at care homes if they have any access to personal data)
• Part-time and bank staff
• Agency staff (ask agencies for training certificates or require completion of your training)

Deliverable: Training sent to everyone who needs it. Set up a tracking sheet (a simple spreadsheet works) and check completions weekly.

Weeks 4-5: Policies and plans

Week 4 — Data security policy:

• Does your current policy reflect the current requirements?
• Has it been updated in the last three years (NHS England's minimum for item 1.3.1), and ideally reviewed in the last year?
• Have staff acknowledged reading it? (Good practice rather than an evidence item; a signature sheet or email confirmation is enough)

If it has not been updated for three years, update it now; if it has not been reviewed for a year, a quick review is good practice. It doesn't need to be long, but NHS England's tooltip for item 1.3.1 sets a minimum: data protection and confidentiality (including data breach management, risk assessment and data subject rights), records management (including retention and disposal) and cyber security (including password management, device and network security, and backups).

Week 5 — Business continuity plan:

• Do you have a documented plan for what happens if you lose access to your IT systems?
• Does it cover cyber attack scenarios (ransomware, data breach)?
• When was it last reviewed, and when was it last tested? Item 7.1.2 asks for both; for Category 3, item 7.2.1 asks for a test in the last twelve months.

A business continuity plan for a 30-bed care home doesn't need to be a 50-page document. It needs to answer: who does what if the systems go down, how do we access patient records in the interim, and who do we contact?

Week 6: Access controls

Task: Document who has access to which systems, when access was last reviewed, and your process for removing access when someone leaves.

Specifically:

• List every system containing patient data (clinical systems, email, shared drives, cloud storage)
• For each system, record who has access and what level (admin, standard user, read-only)
• Check for leavers who still have active accounts — this is a common gap
• Document your joiner/leaver access process

For GP practices, this includes clinical system access, NHSmail admin, and any shared drives. For pharmacies, include your services platform, NHSmail, and dispensing system access. For care homes, include care planning software, NHSmail, and any electronic records systems.

The register and the joiner/leaver process are the easiest way to evidence items 4.1.1 (an up-to-date record of staff and their roles) and 4.2.4 (a reliable way of removing or amending access when people leave or change role). While you have the list of systems open, check multi-factor authentication too: item 4.5.3 asks for it on all remotely accessible accounts — and, for Category 3, all administrator (privileged) accounts — on all systems, with any exceptions approved by senior management.

Deliverable: Access control register and documented joiner/leaver process.

Week 7: Supplier assurance

Task: List the suppliers that handle personal information (item 10.1.2), then check your IT suppliers' cyber security certifications.

For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better) and record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.

For your clinical system or care records supplier, look up its DSPT status on the toolkit's organisation search. Only the status is public — NHS England says "No information on the content within your toolkit is available publicly" — so ask the supplier for certificate details if you need more.

Deliverable: A supplier list, and a note of each IT supplier's certification and how you checked it.

Week 8: Chase training

Task: Check your training tracker. Item 3.2.1's 95% target applies, so by mid-May most people should have finished. Chase anyone who hasn't.

Common holdouts: night shift staff, part-time workers, and staff on leave. NHS England's tooltip explains why the target is 95% rather than 100%: "due to illness, maternity/paternity leave, attrition or other reasons it might not be possible for 100% of people to receive training every year". Note who is on long-term leave and plan their training for their return.

Deliverable: Updated training completion records showing at least 95% (aim for everyone).

Week 9: Answer everything in the portal

Task: Work through each assertion in the DSPT portal and answer each evidence item. In NHS England's version 9 workbook, most Category 3 items are yes/no questions (52 of 80) or short text answers (19); nine ask for a document, such as your information asset register (1.1.2), privacy notice (1.1.3), training needs analysis (3.1.1) and digital asset register (7.1.1). This is the longest single session, so do it in one sitting if possible.

Tips for an efficient session:

• Keep the evidence behind each yes/no answer to hand, even where the toolkit does not ask you to upload it
• Name document files clearly before uploading (e.g., "Information_Asset_Register_v3_May2027.xlsx")
• Use the text boxes to say briefly what you have and where it is kept
• Cross-reference your colour-coded spreadsheet to ensure nothing is missed

Deliverable: Every item you can answer now, answered in the portal.

Week 10: Gap check

Task: Review the portal's progress dashboard and reports page. Identify any assertions still showing as incomplete. For each gap:

1. Can you source the evidence quickly? (e.g., a supplier hasn't replied — chase them)
2. Is it a mandatory assertion? (The mandatory set is what "Standards Met" requires — do those first)
3. Is it something you genuinely can't evidence? (If it is mandatory, see step 4 under "Starting in June" below. If it is optional, note why, and check the DSPT help pages for support options.)

Deliverable: All mandatory assertions complete, or a clear list of items to resolve in Week 11.

Week 11: Submit

Task: Submit your DSPT at "Standards Met" once the mandatory assertions are complete — that set is what Standards Met requires. If you cannot get there, "Approaching Standards" is the smaller fallback for social care providers: you complete the 26 questions flagged for it and upload the action plan the toolkit asks for, covering the rest. NHS England's guidance names social care organisations as eligible for this one-off assessment and does not mention pharmacies, dentists, opticians or GP practices.

Don't wait until 30 June. Submitting in mid-June gives you a buffer for technical issues, portal downtime, or evidence that needs correcting.

After submission: Save a copy of your submission summary for your records and your own audit trail. Your published status is public: commissioners and CQC inspectors can check it on the toolkit's organisation search.

Week 12: Buffer

Task: Handle anything left over from submission. Check that your status shows on the toolkit's organisation search, and correct and republish any answer you need to — NHS England's guidance says you can "update and republish your assessment any time throughout the year". Having a buffer week means none of this becomes a crisis.

If you're starting later than April

The action plan compresses, but the priorities stay the same:

Starting in May (60 days):

1. Staff training — send immediately, this is your bottleneck
2. Audit evidence — skip the detailed colour-coding, just identify red items
3. Policies — update only what's expired, don't rewrite everything
4. Answer the remaining items and submit — aim for "Standards Met"; if you are a social care provider and cannot get there, the one-off "Approaching Standards" assessment is the fallback

Starting in June (30 days or less):

1. Focus exclusively on mandatory assertions — NHS England's guidance says you can publish "Once all the mandatory evidence items have been completed, and all assertions confirmed"
2. Send training today and chase daily
3. Answer what you can now, then work through the remaining mandatory items in order of lead time
4. If you genuinely can't finish: social care providers can publish the one-off Approaching Standards assessment (the 26 questions flagged for it plus an action plan). Pharmacies, dentists, opticians and GP practices have no partial route in NHS England's guidance, so contact the DSPT helpdesk and your commissioner before 30 June. Check the DSPT help pages for current support options.

Check exactly how many working days you have left with our DSPT deadline calculator. For help choosing the right approach for tracking your progress, see our guide on what to look for in a DSPT compliance tracker. If you're already in the final stretch and need a quick sense-check of what to prioritise, our DSPT final checklist before the deadline covers the highest-impact items to confirm in the last weeks.

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Version 9 (2026-27) evidence-item workbook for Categories 2, 3 and 4 — NHS England
• DSPT overview and introductory guidance — NHS England
• DSPT login — NHS England
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare
• Data Security and Protection eLearning — Digital Care Hub
• Publishing your DSPT for the first time — Digital Care Hub
• Check DSPT status — Digital Care Hub

This guide breaks down what actually matters in a DSPT compliance tracker, so you can evaluate your options — whether you stick with your current approach or look for something better.

The three default approaches (and where they break down)

The DSPT portal itself

The official DSPT portal is where you submit, and it does more than many first-time users expect. NHS England's release notes describe a "progress dashboard and reports" page that can download a list of any mandatory evidence items you have not yet answered ("This can be used as a 'to-do list' for planning purposes"), and a progress indicator on the main assessment screen. Where an evidence item has not changed from the year before, NHS England has in previous years carried existing responses forward into the new year's toolkit for you to review and confirm.

Where it breaks down: The portal records your answers; it doesn't run the work around them. Item 3.2.1, for example, is a yes/no question about whether at least 95% of staff are trained, so the record of who has and hasn't completed training lives in your own files, not in the portal. The same goes for who in your team is gathering which evidence, and where the documents behind each answer are kept.

Spreadsheets

The NHS publishes downloadable evidence spreadsheets for each category. Many providers print these out or copy them into their own Excel tracker, adding columns for status, responsible person, and evidence location.

Where it breaks down: A spreadsheet doesn't remind you of deadlines. It can't track whether staff have completed training. It doesn't carry forward evidence from last year. And by May, the spreadsheet you started in January has been emailed between three people and nobody's sure which version is current.

Consultants

DSPT consultants complete the process for you. Consultancies rarely publish their prices, so expect to ask for a written quote. They gather evidence from you, upload it and submit on your behalf.

Where it breaks down: You spend the same amount every year. Your team never learns the process. If the consultant is unavailable or raises prices, you're starting from scratch. And unless you keep your own login and read the answers, you may not know what was submitted on your behalf, which makes it harder to stay compliant between submissions.

What a good compliance tracker should do

If you're evaluating tools (or deciding whether your current approach is good enough), here's what matters for a small Category 3 or Category 4 organisation:

1. Show your completion status at a glance

You need a dashboard that answers three questions instantly:

• How many evidence items are complete, in progress, and not started?
• Which mandatory items are still blocking "Standards Met"?
• What percentage of mandatory assertions have uploaded evidence?

The DSPT portal's progress dashboard gives you some of this. A tracker should add what it doesn't cover, such as who owns each item and where the evidence is kept.

2. Map evidence to assertions automatically

Some evidence items satisfy multiple assertions. Your information asset register, for example, answers item 1.1.2 under Standard 1, and NHS England's tooltip for item 7.1.1 (the digital asset register, Standard 7) says "You can have a separate list of digital assets or combine it into one document with your Information Asset Register". A tracker that maps one document to multiple assertions saves duplicate uploads and makes coverage gaps obvious.

3. Track staff training completion

Standard 3 asks whether at least 95% of staff, directors, trustees and volunteers have completed data security training in the last twelve months (item 3.2.1), so in practice you are chasing almost everyone, every year. For a care home with 30 staff — including part-time carers, night shift workers, and agency staff — tracking who has and hasn't completed training is the single biggest operational challenge of the DSPT.

A tracker should show you:

• Which staff members have completed training (with certificate dates)
• Which staff still need to complete it
• When each person's training expires (annual renewal)

If you're managing this in a spreadsheet, it works until someone joins, leaves, or goes on long-term leave — then the spreadsheet quietly falls out of date.

4. Carry evidence forward year to year

The DSPT is annual. Much of the evidence you gather this year — policies, access control records, your record of supplier certification checks — will be relevant next year too (assuming nothing has changed). A tracker should carry forward the documents behind your answers, so that year 2 is lighter than year 1.

You publish a new assessment every year. The assertions themselves have been stable: NHS England's workbooks show the same 36 assertions in versions 7, 8 and 9. What changes is the evidence items, which are added, reworded and occasionally removed each year. A good tracker maps last year's evidence to this year's items for you.

5. Send deadline reminders

A 90-day, 60-day, and 30-day reminder before 30 June doesn't sound sophisticated, but it's the difference between a planned submission and a panicked one. Bonus if the reminders include your current completion percentage — "You're 65% complete with 42 days to go" is actionable. "The deadline is approaching" is not.

6. Generate a submission-ready report

Before submitting, you should be able to export a summary showing every assertion, its status, and the evidence uploaded against it. This serves as your internal audit trail and makes it easy to hand over if you change roles or if the CQC asks about your data security practices.

What doesn't matter (for small providers)

Features designed for larger organisations that add complexity without value for a 20–40 bed care home or single-site pharmacy:

• Multi-framework support (ISO 27001, Cyber Essentials, SOC 2) — unless you're pursuing these separately, you don't need one tool covering all of them
• Risk scoring algorithms — useful for enterprise risk management, overkill for a Category 3 provider
• Audit workflow tools — NHS England's 2026-27 mandatory audit areas cover NHS Trusts, ICBs, ALBs, CSUs, OES, Genomics organisations and IT suppliers, not Category 3 and 4 providers
• API integrations — you're not piping DSPT data into a SIEM or GRC platform

How the two default approaches compare

The portal is free but costs time. A consultant saves time but costs money every year and doesn't build your team's capability. DSPTready is building a tracker for small providers along the lines of items 1 and 3 to 6 above; it is not available yet. If the consultant row is the one you are seriously considering, our guide to DSPT consultancy or DIY sets out what to ask before you sign.

Questions to ask when evaluating options

Before choosing any tool or service, ask:

1. Does it cover my specific category? Category 3 and Category 4 have different assertion sets. A tool built for enterprise (Category 1-2) may not map correctly to your requirements.
2. Does it stay current with DSPT versions? The toolkit changes annually. A tool built for version 8 (2025/26) may not include the four evidence items version 9 (2026-27) added. Check when it was last updated.
3. Can I see what was submitted? Whether you use a tool or a consultant, you should always have access to your complete submission and evidence records.
4. What happens if I stop paying? Can you export your data? Is your evidence accessible outside the platform?
5. Is it priced for my size? A 25-bed care home shouldn't pay the same as a 500-bed NHS trust.

If you're a residential or domiciliary care provider deciding between approaches, our DSPT for care homes evidence guide breaks down what good evidence looks like for each Category 3 assertion — useful context for evaluating whether a tool actually understands your obligations.

Next steps

• Assess your current approach — is it actually working, or are you scrambling every June?
• Try our DSPT readiness quiz for a quick readiness estimate across seven of the ten standards, and read how to check your DSPT status before you rely on the result
• Read our complete DSPT guide for a full overview of the current requirements
• Use the evidence checklist generator to audit your current evidence against every mandatory evidence item for your category
• Once you've submitted, what to do after the DSPT deadline covers keeping evidence current so next year's submission starts from a better place

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT Audit 26-27 Areas of Mandatory Audit — NHS England
• DSPT system changes and release notes (progress dashboard and reports) — NHS England
• DSPT toolkit deadline notice (responses carried forward) — NHS England

This guide walks you through the entire process — from first login to final submission — specifically for Category 3 and Category 4 organisations. No IT background assumed.

Before you start: what you need

You'll need these before you sit down with the toolkit. Our DSPT toolkit prep guide covers the same ground in more detail if this is your first submission.

• Your ODS code — this is the Organisation Data Service code that identifies your organisation to NHS systems. If you don't know it, Digital Care Hub explains how to find your ODS code, or you can search during DSPT registration. Care homes, pharmacies, and GP practices each have one.
• An email account — you can log in to the DSPT portal using either an NHSmail or a work email address. NHSmail is not required for registration or access.
• Access to your organisation's records — training certificates, policies, risk logs, and IT supplier contracts. You won't need all of these at once, but you'll need to locate them over the course of the submission.

Step 1: Log in and check your category

Go to dsptoolkit.nhs.uk and log in with your email account, then open your Organisation Profile. Your category is not derived from your ODS code — it follows from the sector recorded in that profile, which you chose at registration and can change at any time. Check it is right before you start, because a wrong sector gives you the wrong question set:

• Category 3 — care homes, domiciliary care agencies, pharmacies, dentists, opticians
• Category 4 — GP practices

Your category determines which assertions and evidence items you need to complete. Category 4 is the smaller set: 49 items, 29 of them mandatory, in NHS England's version 9 workbook, and all but two (6.3.5 and 8.3.1) are also Category 3 items.

Step 2: Download the evidence spreadsheet

Before working through the toolkit online, download the version 9 (2026-27) workbook from the DSPT version 9 announcement page and filter it to your category. This spreadsheet lists every assertion and evidence item in a format you can print, annotate, and use as a tracking sheet.

Why this helps: The spreadsheet gives you the full picture offline — you can see which items share evidence (for example, a staff training record might satisfy multiple assertions) and plan your evidence gathering more efficiently.

Step 3: Audit what you already have

Go through the spreadsheet and mark each evidence item as one of:

• Already have it — ready to use now (e.g., a current data security policy with a recent review date)
• Have it but needs updating — the document exists but is out of date or doesn't match the current requirements (e.g., a business continuity plan that hasn't been reviewed since 2024)
• Don't have it — you need to create this from scratch (e.g., no documented access control process)

This audit is the most important step. It turns an overwhelming list into a prioritised task list.

For the mandatory part of this audit, use our evidence checklist generator: it lists every mandatory evidence item for your category, so you can tick off what you already have.

Step 4: Tackle the evidence in priority order

Work through your evidence items in this order:

Start with: staff training records. Item 3.2.1 asks whether at least 95% of staff, directors, trustees and volunteers have completed data security training in the last twelve months, so aim for everyone. This is the item that causes the most deadline-week panic because it depends on other people completing something. Start now — send training out to staff this week and chase completions monthly.

Free training options include the NHS e-Learning for Healthcare data security awareness module. It's free, is split into four modules of around 20 minutes each plus a welcome module, according to NHS England's e-learning FAQ, and generates a certificate to keep as the evidence behind your 3.2.1 answer.

Next: policies and procedures. Review and update your:

• Data security policy
• Acceptable use policy
• Incident reporting procedure
• Business continuity plan

If your policies are current (NHS England's tooltip for item 1.3.1 says policies "should be updated every three years as a minimum", and they are signed off by a senior person), they are ready to use as they are; an annual review is good practice. If they're outdated, update them now rather than in May.

Then: technical controls evidence. This covers items like:

• Who has access to which systems (and when access was last reviewed)
• Whether any unsupported operating systems or software are still in use — and for anything that is, that it is categorised, documented and its data security risks managed
• Whether encryption is enabled on devices holding patient data
• Patching and update schedules

If you use a managed IT service provider, ask them for a written statement confirming these controls are in place. Many providers can supply this as a standard letter.

Finally: supplier assurance. Item 10.2.1 (mandatory for Category 3 and 4) asks whether you assure that your IT system suppliers have robust cyber security arrangements. Check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. For most small providers the main ones are your clinical or care record system supplier, your IT support company and any other supplier of IT systems you use. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.

If you're a Category 3 care provider, our care home evidence guide walks through each of these categories with care-sector-specific examples and what good evidence looks like.

Step 5: Answer the evidence items in the portal

Most evidence items are questions you answer, not files you upload. In NHS England's version 9 workbook, 52 of the 80 Category 3 items are yes/no questions, 19 ask for a text answer and 9 ask for a document (Category 4: 38, 6 and 5 of its 49). For each assertion in the online toolkit:

1. Read the assertion and its associated evidence items
2. Answer each item — tick yes or no, or type the short text answer it asks for
3. Where an item asks for a document, upload it or describe where it is kept, and add a brief note explaining what it shows (e.g., "Staff training completion report — all 23 staff completed data security awareness training between January and March 2026")
4. Confirm the assertion once its items are answered

Tip: Name your files clearly before uploading. "Data_Security_Policy_v3_March2026.pdf" is much more useful than "Document1.pdf" — both for anyone who asks to see your evidence and for your own reference next year.

Step 6: Review and submit

Before hitting submit, it is worth a short readiness check before you submit, so that what you publish matches what you can evidence. Then:

1. Check for gaps — the portal's progress dashboard and reports page can download a list of any mandatory evidence items you have not yet answered. You cannot publish until every mandatory item is answered and every assertion confirmed (unless you are a social care provider using Approaching Standards; see below).
2. Verify dates — evidence should be current. A policy last reviewed in 2023 may not satisfy the current requirements.
3. Choose your target — "Standards Met" means completing the evidence items marked mandatory for your organisation type (45 for Category 3 in NHS England's version 9 (2026-27) workbook, as in version 8). That is the normal target. "Approaching Standards" is a smaller fallback below it — the same workbook flags 26 items as "Approaching standards mandatory" — and if you publish there, you are asked for an action plan covering the questions still to answer. You cannot republish at Approaching Standards. NHS England's guidance names only social care organisations as eligible for this one-off assessment, so if you are a pharmacy, dentist, optician or GP practice, plan for Standards Met.
4. Submit before 30 June — don't wait until the last day. Technical issues, missing evidence, or staff availability problems are easier to resolve with a buffer.

How long should this take?

NHS England publishes no time estimate. As a planning assumption, allow several weeks to a few months of part-time work for a first submission, and less for a repeat, where you review and update last year's answers. The calendar matters more than the hours, because training depends on other people. A workable order for a first-time submission:

Spread across the months before the deadline, it is a manageable part-time task. Concentrated into June, it is a stressful one.

Common mistakes to avoid

• Leaving training until May. Staff training takes calendar time — you need at least 95% of staff to complete it, and some will need chasing. Start in February.
• Uploading generic policies. A template policy downloaded from the internet without customisation will be obvious. Your data security policy should reference your specific organisation, systems, and processes.
• Ignoring leavers' access. "When did you last review who has access to your systems?" is a common evidence item. If ex-staff still have active accounts, that's a gap.
• Assuming your IT provider handles everything. The DSPT is your organisation's responsibility. Your IT provider can supply evidence, but you need to coordinate and verify it.

If you're behind schedule

If you're reading this in April or May and haven't started:

1. Focus exclusively on the mandatory evidence items — completing all of them is "Standards Met", and unless you are a social care provider using the one-off Approaching Standards route below, you cannot publish until they are done
2. Send staff training out immediately — this is the longest lead-time item
3. Contact your IT provider for a technical controls statement
4. Work through the remaining mandatory items in order of lead time, starting with anything that depends on someone else

If you genuinely can't complete by 30 June, what you can do depends on your sector:

• Social care providers (care homes, domiciliary care) can publish a one-off Approaching Standards assessment: complete the 26 items flagged "Approaching standards mandatory" and the action plan the toolkit asks for on the rest. You cannot republish at Approaching Standards, so plan to reach Standards Met the following year.
• Pharmacies, dentists, opticians and GP practices have no partial route in NHS England's guidance. You can publish only once every mandatory item is complete, and the improvement-plan process is published for other organisation types (NHS trusts, ICBs, local authorities and others). Contact the DSPT helpdesk and your commissioner before 30 June to explain where you are and when you expect to finish.

Check the DSPT help pages for current support routes.

Check our DSPT deadline calculator to see exactly how many working days you have left and plan your milestones.

This guide reflects DSPT version 9 (2026-27), the current toolkit. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 downloads — NHS England
• DSPT 2025-26 version 8 downloads — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4, v1.1 (input types; item 10.2.1) — NHS England
• Improvement plans: instructions for 2025-2026 (organisation types in scope) — NHS England
• DSPT system changes and release notes (progress dashboard and reports) — NHS England
• Publish or republish and share your DSPT (Approaching Standards action plan) — Digital Care Hub
• How to find your ODS code — Digital Care Hub
• Data Security Awareness e-Learning — NHS e-Learning for Healthcare

This guide covers the DSPT version 9 (2026-27) requirements specifically for Category 3 and Category 4 organisations. No enterprise jargon, no assumptions about having an IT department.

What is the DSPT?

The Data Security and Protection Toolkit is an annual online self-assessment run by NHS England. It measures how well your organisation protects patient data against the 10 National Data Guardian (NDG) data security standards. It was originally run by NHS Digital, which legally merged into NHS England on 1 February 2023, so older guidance that says "NHS Digital" is talking about the same toolkit.

Every organisation that accesses NHS patient data or connects to NHS systems must complete it. That includes:

• Residential and nursing care homes
• Domiciliary care agencies
• Community pharmacies
• GP practices
• Dental practices
• Opticians

NHS England's basis is broad: "All organisations that have access to NHS patient information must provide assurances". For adult social care, its organisation types cover services "commissioned by the NHS, local authorities or directly with service users", whether or not the provider is CQC-registered, so a care home with no NHS-funded residents is not automatically out of scope. The simple test: do you process NHS patient information, use NHSmail or another national NHS system, or have a contract with an NHS or local-authority commissioner that requires it? If yes, you need to complete the DSPT annually.

The toolkit is hosted at dsptoolkit.nhs.uk. The 2025/26 submission deadline was 30 June 2026; for the 2026/27 cycle (version 9), NHS England states that "The deadline for the Data Security and Protection Toolkit is 30th June 2027."

It is a self-assessment rather than an audit: you answer the questions, add your evidence and publish. Your status (not your answers) is then public: anyone can look it up with the toolkit's Organisation Search, and NHS England says "No information on the content within your toolkit is available publicly."

What's in DSPT version 9 (2026-27)?

Version 9 is the current toolkit. NHS England's release notes record that "The 2026-27 (version 9) DSPT has been released" on 1 September 2026, and its outcomes, assertions and evidence items were published on 2 October 2026 in the version 9 announcement.

What this means for small providers:

• The same mandatory items. NHS England's version 9 workbook marks 45 evidence items mandatory for Category 3 and 29 for Category 4, the same items as version 8 (2025/26). (The workbook's two new Category 3 variants, 3a for care providers in CQC's Market Oversight scheme and 3b for local authorities, have 81 items each, with 45 and 46 mandatory.)
• Four new evidence items, none mandatory. 1.3.15 (devices taken outside the UK), 7.1.7 (testing your business continuity plan), 10.2.6 (non-IT suppliers' access) and 10.2.7 (processing outside the UK).
• Reworded items. Several existing items have new wording or tooltips, including 1.1.2 (the information asset register and record of processing activities) and 10.2.1 (supplier assurance).
• The CAF stays in the background for most Category 3 and 4 organisations. NHS England says "DSPT Version 9 is aligned to CAF version 4.0", but "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements". Care homes, domiciliary care agencies, pharmacies, dentists, opticians and GP practices still answer evidence items under the ten standards. Version 9 brought two exceptions: large care providers in CQC's Market Oversight scheme (Category 3a) are asked to "Submit a Cyber Assessment Framework Assessment" (item 9.4.6, not yet mandatory, but NHS England asks them to "prepare to complete a CAF assessment as a mandatory part of the DSPT in the future"), and local authorities (Category 3b) must "Submit your current progress in completing the Cyber Assessment Framework for Local Government" (item 9.4.7, mandatory).

The previous version, v8 (2025/26), kept the same assertions as version 7 and changed a small number of evidence items; for Category 3 it made the IT administrator agreement (4.3.1) and the digital asset register (7.1.1) mandatory. Our DSPT v8 changes explained guide sets out the detail, and our Cyber Assessment Framework explained guide covers what CAF alignment actually means for small providers.

Check the version 9 announcement for the downloadable workbook showing the exact assertions and evidence items for your category.

DSPT categories: which one are you?

Your DSPT category determines which assertions and evidence items apply to your organisation.

If you have been told you need an audit, our guide to who actually needs a DSPT audit explains which categories are in scope.

Most readers of this guide will be Category 3 or Category 4. The key difference is size: in NHS England's version 9 workbook Category 4 has 49 evidence items, 29 of them mandatory, against Category 3's 80 and 45. All but two Category 4 items (6.3.5 on repeat incidents and 8.3.1 on software updates) are also Category 3 items.

If you run a residential or domiciliary care provider, our DSPT for care homes guide walks through the Category 3 evidence requirements with care-home-specific examples.

If you're a GP practice, our DSPT for GP practices guide covers Category 4-specific evidence items and the GP systems (EMIS, SystmOne) that most of the technical evidence relies on.

Dental practices sit in Category 3 alongside care homes and pharmacies. Our DSPT for dental practices guide works through the evidence items that hang off practice management software and NHSmail access.

If you deliver care in people's own homes rather than from one site, the DSPT for domiciliary care guide covers the device and data-in-transit questions that only come up when records travel with care workers.

If you're unsure of your category, log in to dsptoolkit.nhs.uk and open your Organisation Profile — your category follows from the sector recorded there, not from your ODS code, and NHS England lets you "change your answers at any time".

The 10 National Data Guardian standards

The DSPT is structured around these 10 standards. Each standard contains assertions (statements about what your organisation should be doing), and each assertion has one or more evidence items, the questions you actually answer:

1. Personal confidential data — handled, stored and transmitted securely, and only shared for lawful and appropriate purposes
2. Staff responsibilities — everyone understands their data security duties
3. Training — at least 95% of staff, directors, trustees and volunteers complete data security training each year (item 3.2.1 counts the twelve months before you publish)
4. Managing data access — access is limited to what each person needs
5. Process reviews — after a breach or near miss, the process behind it is reviewed (item 5.1.1)
6. Responding to incidents — data breaches are detected and reported
7. Continuity planning — plans exist to respond to threats to data security
8. Unsupported systems — the NDG standard is no unsupported operating systems, software or internet browsers in the IT estate; the toolkit's item 8.1.4 asks whether systems are "still supported by the manufacturer or the risks are understood and managed" (our guide to unsupported systems and Standard 8 covers Windows 10 and documenting the risk)
9. IT protection — technical controls are in place (encryption, changed network-device passwords, firewalls)
10. Accountable suppliers — third-party suppliers meet data security standards

For Category 3 organisations, the evidence across these standards includes items like staff training records, data security policies, risk assessment logs, business continuity plans, and records of who has access to what systems.

Several of these standards have a companion guide on this site. Your data security policy (Standard 1, item 1.3.1) is covered in how to write a DSPT data security policy, and Standard 6 in our guide to DSPT incident response — both written around what a Category 3 provider actually has to produce rather than what a large trust would.

Key dates for the 2026-27 cycle

The deadline is a standing annual one rather than a one-off date: NHS England requires that "your organisation has published at least one assessment by the deadline of 30 June every year". The previous cycle, version 8 (2025/26), closed on 30 June 2026.

Missing the 30 June deadline has consequences beyond the toolkit itself:

• Your contract position — NHS England describes completion as "a contractual requirement specified in the NHS England Standard Conditions contract"
• NHSmail and the e-referral service — NHS England says completion "is also necessary for organisations which use national systems such as NHSmail and the e-referral service"
• National applications — NHS England Digital's HSCN connection guidance says "A DSPT assessment is still required to access NHS Digital's national applications (such as the NHS e-Referral Service (ERS), Personal Demographics Service (PDS) and Secondary Uses Service (SUS))"

Neither source describes an automatic cut-off on 1 July, so treat a missed deadline as a risk to that access, and speak to your commissioner and NHS England before the deadline if you are going to miss it. For a care home, losing NHSmail would disrupt communication with GPs and hospitals.

"Approaching Standards" vs "Standards Met" vs "Standards Exceeded"

For most Category 3 and 4 organisations there are up to three published levels, set out below. NHS England also has a fourth status, "Standards Not Met", published with an improvement plan. That route is for NHS trusts, ICBs, CSUs, arm's length bodies, OES and Genomics providers, key IT suppliers and local authorities (a Category 3 type).

• Approaching Standards — a fallback below the mandatory set, not the mandatory set itself: NHS England's version 9 (2026-27) workbook flags 26 items as "Approaching standards mandatory", the same set as version 8. NHS England's guidance says "Social Care organisations are eligible to complete a one-off 'Approaching Standards' assessment" — it does not name pharmacies, dentists, opticians or GP practices. Publishing here means completing an action plan for the remaining items (Digital Care Hub's first-publication guide says you "will be asked to complete and upload an action plan on how you will complete the remaining questions"), so treat it as a deadline safety net rather than a target.
• Standards Met — you've completed every evidence item marked mandatory for your organisation type, with full evidence. NHS England describes it as "responding to all the questions within the assessment which are indicated as being MANDATORY". NHS England's version 9 (2026-27) workbook marks 45 items mandatory for Category 3 and 29 for Category 4 (GP practices), the same as version 8. Digital Care Hub's adult social care guidance (the same first-publication guide) gives that full set as 45 questions in one sentence and 42 in another, and the count varies by organisation type in any case, so take the total from your own toolkit. This is the higher bar most providers should work toward across the year.
• Standards Exceeded — for most organisations, shown where you have gone beyond Standards Met and hold Cyber Essentials Plus recorded in your Organisation Profile (our guide to Cyber Essentials and the DSPT explains how the two fit together). NHS England's wording opens "For all other organisations" for a reason: NHS Trusts, ICBs, ALBs, CSUs, Genomics organisations and independent providers designated as OES instead reach it by meeting the achievement levels forecast for the following year.

Practical advice: Plan for "Standards Met" by 30 June. If you are a social care provider completing the DSPT for the first time and cannot finish the mandatory set in time, you are eligible for a one-off "Approaching Standards" assessment — publish there with an action plan rather than miss the deadline, then work toward "Standards Met"; the toolkit stays open for updates throughout the year. Pharmacies, dentists, opticians and GP practices are not named as eligible for that route, so build your plan around the full mandatory set. If you're in the final weeks before the deadline, our DSPT final checklist covers the highest-impact evidence items to confirm before you submit. Once your submission is in, what to do after the DSPT deadline covers closing the gaps you flagged and keeping evidence current for next year.

Common evidence items you'll need

While the exact requirements depend on your category and the version 9 workbook, most Category 3 organisations will need:

• Staff training certificates — proof that at least 95% of staff (item 3.2.1) completed data security awareness training in the twelve months before you publish; aim for everyone. Staff turnover makes this an item that often needs last-minute chasing.
• Data security policy — a current, reviewed policy (item 1.3.1). Asking staff to read and acknowledge it is good practice.
• Risk assessment log — documenting identified data security risks and what you've done about them.
• Business continuity plan — what happens if your systems go down, you suffer a cyber attack, or you lose access to patient records.
• Access control records — who has access to which systems, when access was last reviewed, and how leavers' access is removed.
• Incident response procedure — how you detect, report, and respond to data security incidents.
• Supplier list and supplier assurance — a list of the suppliers that handle personal information (item 10.1.2). For 10.2.1 (mandatory for Category 3 and 4), check that each IT system supplier and your IT support company holds a cyber security certification (Cyber Essentials on the IASME certificate search, an ISO 27001 certificate, or a DSPT status of Standards Met or better). Record what you checked; if a supplier has none, record what you do instead. A data processing agreement is still needed under UK GDPR Article 28, but it is not the 10.2.1 evidence.

For a more structured breakdown, try our free evidence checklist generator: select your category and get a checklist of every mandatory evidence item for it, grouped by standard. If you're evaluating tools to help with tracking, see our guide on what to look for in a DSPT compliance tracker.

How long does it take?

NHS England does not publish an estimate of how long the DSPT takes, and the time depends mostly on how many of the required policies and records you already have. As a planning assumption, allow several weeks to a few months of part-time work for a first submission. A repeat submission is usually quicker, because you review, update and save last year's answers rather than starting from scratch, but it still needs more than one sitting.

• First submission: the bulk of the time is gathering evidence, not answering questions. If your training records are scattered across email, your policy is three years old, and you've never documented your access controls, expect it to take longer.
• Repeat submissions: Digital Care Hub's guidance is that "You need to review, update and save any changes to your previous questions" before you republish. Each version also adds or rewords some items (version 9 added four and reworded others, including 10.2.1), so some answers need refreshing regardless.

Spread the work over several months rather than leaving it to June. Our DSPT deadline action plan sets out one week-by-week way to do that.

FAQ

What does DSPT stand for? Data Security and Protection Toolkit. It replaced the old Information Governance Toolkit (IGT) in 2018. If you last filed under the old name, our guide to moving from the IG Toolkit to DSPT covers what is different now.

Is the DSPT mandatory? Yes, for any organisation accessing NHS patient data or systems, or whose contract with an NHS or local-authority commissioner requires it. NHS England's guidance says completion is "a contractual requirement specified in the NHS England Standard Conditions contract", and that it "remains Department of Health and Social Care policy that all bodies that process NHS patient information for whatever purpose provide assurances via the DSPT". Digital Care Hub adds that "Commissioners, CQC inspectors, families and people using care services can also check the DSPT status of a care service."

Can I complete the DSPT without a consultant? Yes. The DSPT is designed as a self-assessment. Many small providers complete it independently — it takes longer the first time, but you build capability for future years. Our readiness quiz gives a quick readiness estimate across seven of the ten standards before you start. If you are still weighing it up, we have set out whether to use a DSPT consultant or do it yourself, including what a consultant cannot do on your behalf.

What if I can't meet the 30 June deadline? Speak to your commissioner and NHS England before the deadline to discuss your options. Check the DSPT help pages for current guidance on support routes available to your organisation category. If you are a social care provider, NHS England's guidance makes you eligible for a one-off "Approaching Standards" assessment, and submitting there with an action plan is better than a missed submission. The guidance does not name pharmacies, dentists, opticians or GP practices as eligible, so check with NHS England what applies to you.

How often does the DSPT change? Annually, in late August or early September: NHS England's release notes date version 6 to 30 August 2023, version 7 to 30 August 2024, version 8 to 1 September 2025 and version 9 to 1 September 2026. Across versions 7, 8 and 9 the 36 assertions stayed the same; the changes were to individual evidence items. For the current cycle, see the 2026/27 DSPT (version 9).

Next steps

1. Check your category — log in to dsptoolkit.nhs.uk and confirm whether you're Category 3 or 4.
2. Prepare for first login — our DSPT toolkit prep guide covers what to gather before you open the portal so you don't waste your first session hunting for documents.
3. Download the version 9 workbook — see exactly which assertions and evidence items apply to you.
4. Audit your current evidence — use our evidence checklist generator to list every mandatory evidence item for your category and tick off what you already have.
5. Plan your timeline — the DSPT deadline calculator shows how many working days you have left and suggests milestones.
6. Start with training records — they depend on other people completing courses, so they take longest to close. Get them moving first.

If you run a community pharmacy, our DSPT for pharmacies guide covers pharmacy-specific evidence patterns and the NHSmail/EPS access points that matter most for pharmacy continuity.

This guide reflects DSPT version 9 (2026-27) requirements as published by NHS England. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.

Sources

• DSPT overview and introductory guidance (sections 7 and 8: Standards Met and Approaching Standards) — NHS England
• Data Security and Protection Toolkit — NHS England
• DSPT 2026-27 version 9 announcement — NHS England
• Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
• DSPT system changes and release notes — NHS England
• Organisation types — NHS England
• NHS Digital and NHS England complete merger (1 February 2023) — NHS England
• DSPT 2025-26 version 8 announcement — NHS England
• National Data Guardian review of data security — GOV.UK
• Cyber Assessment Framework — NCSC
• DSPT 2025-26 improvement plans (which organisation types they apply to) — NHS England
• Publishing your DSPT submission for the first time — Digital Care Hub
• Publish or republish your DSPT — Digital Care Hub
• Check DSPT status — Digital Care Hub