DSPT Evidence Checklist Generator

About the DSPT evidence checklist

The Data Security and Protection Toolkit (DSPT) requires organisations to provide evidence against each assertion in their category. Category 3 organisations (care homes, pharmacies, domiciliary care, dentists, opticians) and Category 4 (GP practices) each have different evidence requirements mapped to the 10 National Data Guardian data security standards.

This checklist covers core evidence items. It was first built from DSPT v8 (2025/26), and its item numbers and mandatory flags have been checked against version 9 (2026-27), the current toolkit: the mandatory items for Category 3 and 4 are the same in both versions, but version 9 rewords some items and adds four optional ones. Use it to audit what you already have and identify gaps before starting your portal submission. For a step-by-step walkthrough, see our guide to completing the DSPT.

Completing the mandatory evidence items is what gets you to “Standards Met” — NHS England’s guidance says to “complete a ‘Standards Met’ assessment by responding to all the questions within the assessment which are indicated as being MANDATORY”, and the number of those depends on your organisation type (45 for Category 3 in both the v8 2025/26 and v9 2026-27 workbooks). “Approaching Standards” is a smaller subset, not the mandatory set — both workbooks flag the same 26 items as “Approaching standards mandatory”, and NHS England’s guidance names social care organisations as eligible for it as a one-off. If time is tight, work the mandatory list; that is the target, not a stepping stone to it.

This checklist is a planning tool, checked against DSPT version 9 (2026-27) item numbers. The exact wording of assertions and evidence items may differ — always verify on the official DSPT portal. This is not legal or compliance advice.