NHS Data Security and
Protection Toolkit:
We Handle Your DSPT So
You Can Focus on
Patients
Every organisation accessing NHS patient data or systems must complete the nhs data security and protection toolkit annually. The 2025/26 deadline is 30 June 2026. Missing it can mean loss of NHS system access.
The nhs data security and protection toolkit (DSPT) is an annual online self-assessment required for every organisation accessing NHS patient data or connecting to NHS systems. This includes GP practices, NHS dental practices, community pharmacies, opticians, social care providers, and private organisations supplying services to the NHS. We handle the entire nhs dspt compliance process assessing your current position, closing gaps, and submitting before the deadline.
Version 8 of the toolkit (2025/26) introduced significant changes including alignment with the NCSC Cyber Assessment Framework for some categories, mandatory independent audits for Category 1 and 2 organisations, and an interim baseline submission by 31 December 2025. Nhs digital data security requirements have become more specific and evidence must now demonstrate that controls actually work, not just that policies exist. We provide expert dspt assessment help that keeps pace with these changes.
Who must complete the DSPT
GP practices and primary care networks
All GP surgeries accessing NHS systems including NHSmail or e-Referrals must complete the DSPT annually or risk losing system access.
NHS dental practices
Dental practices providing NHS dental services and accessing NHSmail or other NHS systems must submit a DSPT assessment each year.
Community pharmacies
Pharmacies accessing the Electronic Prescription Service (EPS) or NHSmail must complete the data security and protection toolkit guidance requirements to maintain access.
Private organisations with NHS contracts
Any private clinic or health service provider operating under an NHS contract or accessing NHS patient data is required to comply annually.
Social care and community health providers
NHS-connected social care organisations and community health providers all fall under the DSPT requirement regardless of their size.
What the nhs data security and protection toolkit requires
01
10 National Data Guardian standards
The DSPT measures performance against 10 NDG standards covering leadership accountability, staff training, managing data access, process reviews, incident response, data protection, appropriate sharing, IT supplier management, handling unsupported systems, and improving information governance. Every mandatory evidence item must be completed to achieve Standards Met status.
02
Outcome-based evidence
Version 8 requires you to demonstrate that security controls actually work not just that you have a policy on paper. Common evidence includes annual training completion records for all staff, access control documentation, incident records, supplier contracts with security clauses, and technical configuration records. We collect and organise all required evidence as part of our dspt assessment help service.
03
Key 2025/26 deadlines
For the current cycle, two dates matter. The interim baseline submission deadline was 31 December 2025 all organisations must have submitted an initial self-assessment by this date. The final submission deadline is 30 June 2026. Missing either deadline can disrupt access to NHS systems depending on your organisation category. Starting your preparation early is essential.
Frequently asked questions
What happens if my organisation misses the DSPT deadline?
Failing to submit by 30 June 2026 can result in loss of access to NHSmail, e-Referrals, and other NHS systems your practice relies on daily. It may also affect NHS contract eligibility. The consequences vary by organisation type but disruption to clinical operations is a real risk for any NHS-connected practice.
How long does it take to complete the DSPT?
For a small practice with no existing compliance documentation, 4 to 8 weeks is a realistic timeline to gather all required evidence and submit. We handle the entire process so your team does not need to divert time from patient care.
Does a small NHS dental practice need the same DSPT as an NHS trust?
No. Smaller organisations in Category 3 and 4 use the NDG 10 Standards framework rather than the full CAF alignment required for Category 1 and 2. The requirements are proportionate to your organisation size and the systems you access, but all categories must complete an annual submission.
Can I complete the DSPT myself?
Smaller practices with good existing documentation sometimes complete it themselves, though it takes several focused days of work. The main challenge is having the underlying evidence in place current training records, access lists, tested backups. Practices that lack this benefit most from professional dspt assessment help.
Need help completing your DSPT before the deadline?
We handle the full submission process for NHS practices. Get in touch before 30 June 2026.