What happens if you miss the DSPT deadline?

The standard annual Data Security and Protection Toolkit (DSPT) deadline is 30 June. If that date slips past without a completed submission, it isn’t the end of the world — but it does have real consequences worth understanding, and the sooner you act, the better. This guide explains what can happen and how to recover.

The short answer

Missing the deadline doesn’t trigger an automatic fine, but it can affect your access to NHS systems, your standing with commissioners, and how your data security is viewed by regulators. The most sensible response is to complete the toolkit as soon as you can and communicate proactively with anyone who relies on your DSPT status.

Possible consequences

Access to NHS systems

Your DSPT status underpins access to services such as NHSmail, GP Connect and the Electronic Prescription Service. An out-of-date or missing submission can put that access at risk. For providers who depend on these systems day to day, that’s the most immediate and disruptive consequence — losing the very tools you rely on to deliver care.

Contracts and commissioning

NHS commissioners and integrated care systems increasingly expect a current DSPT as a condition of working with them. A lapsed submission can raise questions during contract reviews or tenders, and may need explaining to partners who share data with you.

Regulatory standing

The CQC considers data security as part of the well-led domain. While a late DSPT is not the same as a breach, a pattern of poor information governance can feed into how your service is assessed. Keeping your submission current is one clear, evidenced way to show you take data protection seriously.

Reputation and assurance

Families, service users and partners increasingly ask how their data is protected. A current DSPT is a simple, recognisable signal that you’re handling information responsibly. A lapse undermines that reassurance.

What to do if you’ve missed it

Don’t panic — take clear, prompt action.

1. Log in and check your current status. You may be further along than you think, and completing what remains might be quicker than expected.
2. Identify the gaps. Work out which assertions you can’t yet confirm and what evidence each needs. Our DSPT evidence checklist helps here.
3. Prioritise the essentials. Focus first on foundational controls — training records, access management, backups and your information asset register.
4. Complete and submit as soon as you can. Even a late submission is far better than none, and it stops the clock on further risk.
5. Tell anyone who needs to know. If a commissioner or NHS contact relies on your status, a short, honest update showing you’re actively resolving it goes a long way.

Aim for the right status, not just a submission

When you do complete it, aim for Standards Met rather than stopping at Approaching Standards, which leaves work outstanding. Our guide on Standards Met vs Approaching Standards explains the difference so you know what you’re working towards.

Avoiding a repeat next year

The best way to never face this again is to treat the DSPT as an annual rhythm rather than a June deadline. Spreading the work across the year — as set out in our guide to the DSPT deadline and annual cycle — means you reach 30 June with time to spare. Keeping a live evidence pack turns each renewal into a quick refresh rather than a scramble, and sidestepping the usual common DSPT mistakes keeps you on track.

A late submission is not a permanent black mark

It’s worth keeping perspective. A DSPT that has slipped past the deadline is a problem to fix, not a permanent stain on your record. Once you complete and submit, your status updates to reflect the work you’ve done. What matters most to commissioners and regulators is that you took data security seriously, acted promptly to put things right, and can show a clear path back to a current submission. A single late year, addressed openly and quickly, is a very different picture from a pattern of neglect.

The value of acting early, even now

If the deadline is looming rather than already past, the same advice applies with even more force: act now. The earlier you engage, the more options you have. There’s a real difference between quietly finishing a slightly late submission in a week and scrambling under pressure while your NHS access hangs in the balance. Whatever point you’re at, the next best step is always to log in, take stock, and start closing the gaps — momentum is your friend here.

Learn from the lapse

When the immediate pressure eases, it’s worth a short, honest look at why the deadline was missed. Was there no clear owner? Did the evidence take longer to gather than anyone expected? Did staff training slip? Identifying the root cause lets you put a simple safeguard in place — a named owner, a calendar reminder in the spring, a live evidence pack — so the same thing doesn’t happen next year. A missed deadline, used well, can be the prompt that makes every future renewal smooth.

Check where you stand now

If you’re behind and unsure how much work is left, our DSPT readiness checker gives you a fast read in a few minutes, and the glossary explains any unfamiliar terms.

How we can help

If you’ve missed the deadline and feel under pressure, you don’t have to sort it alone. We offer a clear, fixed-fee engagement that quickly identifies what’s outstanding, helps you close the gaps, and supports you through to submission — calmly and in plain English. Explore our DSPT service or get in touch and we’ll help you get back on track.