DSPT for domiciliary care: a practical guide

Domiciliary care providers deliver support in people’s own homes, often with staff working out in the community on mobile devices. If you receive NHS-funded care, use NHSmail, or share data with GPs and community services, you’ll need a current Data Security and Protection Toolkit (DSPT). This guide explains what that means for home care specifically.

Why domiciliary care providers need the DSPT

Home care involves handling sensitive personal and health data — care plans, medication records, risk assessments and GP correspondence — frequently accessed remotely by care workers. Where that data touches NHS systems or NHS-funded care, the DSPT is how you demonstrate you’re protecting it properly.

A current DSPT keeps your NHS data flows switched on and supports your obligations under UK GDPR. It also matters to the CQC, which considers data security within the well-led domain, and to commissioners who increasingly expect to see it.

The mobile working challenge

What makes domiciliary care distinctive is that data travels. Care workers may use phones, tablets or an electronic care planning app in service users’ homes, and your DSPT needs to reflect this reality. Particular attention to:

• Device security — encryption, screen locks and secure configuration on every mobile device
• Remote access controls — who can see care records, and how access is managed and removed
• Lost or stolen devices — a clear procedure so a mislaid phone doesn’t become a data breach
• Secure communication — using approved channels rather than personal messaging for care information

What a domiciliary provider needs to evidence

The toolkit is proportionate to your size. Core evidence includes:

• A named person responsible for data protection — often the registered manager
• Data protection and information governance policies reflecting community-based working
• Annual staff training records for all care workers, office staff and new starters
• An information asset register covering paper and digital records, including your care planning app
• Access controls with a robust joiners, movers and leavers process
• Tested backups of your care records
• An incident and breach procedure, including lost-device scenarios
• Supplier assurance for your care planning software and any third parties handling data

Our DSPT evidence checklist walks through each item.

Common sticking points for home care

Sticking point	What helps
High staff turnover	A simple joiners and leavers log for training and access
Mobile devices in the community	Encryption, screen locks and a lost-device procedure
Personal phones for work	Provide managed devices or a clear, secure policy
Paper care notes in homes	Include them in your asset register and handling rules
Care planning app reliance	Get written supplier assurance and a processing agreement

These map to the common DSPT mistakes we see across the sector.

The deadline

The standard annual deadline is 30 June, and the toolkit resets each year. Because coordinating training across a dispersed workforce takes time, start a couple of months ahead. Our guide to the DSPT deadline and annual cycle shows how to plan, and what happens if you miss the deadline covers the risks of slipping.

Aim for Standards Met

Your goal is Standards Met rather than stopping at Approaching Standards, which leaves work outstanding. Our guide on Standards Met vs Approaching Standards explains the difference.

Technical controls made easier

Several DSPT assertions cover technical controls — device configuration, anti-malware, patching and access management — which matter especially when staff work remotely. Holding Cyber Essentials provides independent evidence for many of these. See our guide on how the DSPT and Cyber Essentials relate, and the glossary for any unfamiliar terms.

Bringing dispersed staff along with you

A defining feature of domiciliary care is that your workforce is rarely in one place — care workers are out in the community, often part-time, sometimes across a wide area. That makes staff training and awareness both more important and harder to coordinate. Building data security into induction, using short refreshers that can be completed on a phone, and keeping a clear log of who has done what all help. When staff understand why a screen lock or a lost-device report matters — because it protects the very people they care for — the good habits stick far better than a rule handed down from the office.

Turning the app to your advantage

Many home care providers now use an electronic care planning app, and while that adds devices to secure, it can also make the DSPT easier. A good system gives you clear access controls, an audit trail of who viewed what, and often supplier assurance you can point to directly. When you review your evidence, treat your care planning software as an ally: it may already provide much of what the toolkit asks for around access management and record-keeping. Just make sure you have a processing agreement in place and written confirmation of how the supplier protects the data.

Keeping it manageable year on year

Because the toolkit resets annually, keeping your evidence in one place turns each renewal into a quick refresh rather than a fresh start. Store your policies, training log, asset register, device records, backup test records and incident log together, each with a review date. Given the turnover common in home care, this simple habit protects you if the person who completed the toolkit this year isn’t the one doing it next, and keeps your submission smooth every cycle.

Check where you stand

Our DSPT readiness checker gives you a quick read on how much work is ahead in just a few minutes.

How we can help

Most home care providers don’t have a dedicated information governance lead, and mobile working adds a layer of complexity the toolkit expects you to address. We offer a clear, fixed-fee engagement that maps your records against every assertion, tells you plainly what’s missing, and supports you through to submission — all in plain English. Explore our DSPT service or get in touch for a friendly, no-obligation chat.