What is the DSPT? A plain-English guide for care providers

The Data Security and Protection Toolkit (DSPT) is the NHS’s annual online self-assessment for any organisation that handles NHS patient or service-user data. If you use NHS systems such as NHSmail, or you hold health and care information about the people you look after, completing it is not optional. It is how you demonstrate, once a year, that you are protecting that data to a nationally recognised standard.

This guide explains what the toolkit is, who has to complete it, how it is structured, what the statuses mean and how to approach it for the first time. It is written for care homes, home-care agencies and GP, dental and pharmacy practices rather than for large NHS trusts, though the fundamentals are the same.

What does DSPT stand for?

DSPT stands for Data Security and Protection Toolkit. You will also see it written as the DSP Toolkit or, informally, “the toolkit”. It is run by NHS England, having originally been launched by NHS Digital in 2018 as the successor to the Information Governance (IG) Toolkit. If someone in the NHS or a local authority asks for your “IG Toolkit status”, they mean the DSPT.

The toolkit measures organisations against the ten data security standards set by the National Data Guardian. Those standards cover people (staff responsibilities and training), process (how data is accessed, shared and protected) and technology (supported systems, patching, anti-malware and back-ups).

Who must complete the DSPT?

The simple test is this: if your organisation sends, receives, stores or views NHS patient data, or uses an NHS-provided system, you almost certainly need a current DSPT. In the care and health sectors that includes:

• Residential care homes and nursing homes, particularly those delivering NHS-funded or NHS-linked care
• Domiciliary (home) care, supported living and extra-care providers
• GP practices, dental practices, optometrists and community pharmacies
• Hospices, community health providers and social enterprises delivering NHS services
• IT suppliers, software vendors and other third parties that connect to NHS systems on a provider’s behalf

Many care providers hold NHS data without realising it: through shared care records, hospital discharge summaries, medication administration records or proxy access to GP records. If any of that applies to you, you are in scope.

Genuine exemptions are narrow. An organisation with no access to NHS data and no connection to NHS systems does not need to complete the toolkit. If you are unsure, a short scoping conversation is far cheaper than discovering mid-year that a data flow has been switched off. Our sector guides cover the detail for care homes, domiciliary care, GP practices, dental practices and pharmacies.

Why the DSPT matters

The most immediate reason is access. A current, satisfactory DSPT is usually a condition of using NHSmail, GP Connect, the Electronic Prescription Service, the Summary Care Record, shared care records and proxy access arrangements. Organisations that let their status lapse can find those services suspended, which is disruptive for staff and unsafe for the people they support. Our guide to what happens if you miss the deadline explains the consequences in more detail.

Beyond system access, the DSPT has become a marker of a well-run service:

• Commissioners increasingly write it into local-authority and integrated care board (ICB) contracts.
• The Care Quality Commission (CQC) looks at information governance under its well-led question, and a published DSPT status is straightforward evidence.
• Families and referrers can look up your status, because the toolkit publishes each organisation’s result on its public website.
• It overlaps heavily with UK GDPR obligations, so completing it properly strengthens your wider data protection compliance.

How the toolkit is structured

The DSPT is an online questionnaire organised around the ten data security standards. Under each standard sit a number of assertions: statements about your organisation, such as “staff have completed appropriate data security and protection training”, which you confirm are true. Beneath each assertion are evidence items: the specific questions or uploads the toolkit asks for in support. Some evidence items are mandatory and some are not, and you cannot publish a “Standards Met” status until every mandatory item is complete.

The exact question set depends on your organisation type and profile. Smaller social care organisations, GP practices and dental practices complete a proportionate version with far fewer items than an NHS trust, which completes a longer assessment aligned to the Cyber Assessment Framework. Getting your profile right at the outset matters, because answering the wrong set wastes weeks. Our guide to DSPT assessment levels and profiles explains how to check.

To register, you need your organisation’s ODS code (the identifier the NHS uses for every provider). Most CQC-registered providers already have one; if yours is missing, the ODS team can issue it, though allow time for this before the deadline.

The DSPT statuses: what “Standards Met” means

When you publish your assessment, the toolkit assigns you a status. The main ones you will encounter are:

• Standards Met: all mandatory evidence items are complete. This is the target for the vast majority of providers and the status commissioners and NHS system owners look for.
• Approaching Standards: available to adult social care providers who have not yet completed every mandatory item but have published an improvement plan. It shows commitment and usually keeps data flows open while you close the gaps, but it should be a stepping stone, not a destination.
• Standards Not Met: mandatory items are incomplete and no improvement plan has been accepted. Expect questions from commissioners and potential restrictions on NHS system access.
• Standards Exceeded: awarded to some larger organisations that complete additional non-mandatory items.

The difference between the first two is explained in our guide to Standards Met vs Approaching Standards. Remember that every status is a self-declaration: you are attesting that the evidence exists. The toolkit does not check your uploads line by line, but commissioners, auditors and the CQC can ask to see them, so declare only what you can prove.

When is the DSPT deadline?

The assessment runs on an annual cycle. Each year’s toolkit usually opens in the autumn, and the standard publication deadline is 30 June the following year. Some larger NHS organisations also have an earlier baseline submission, but for care providers and primary care the date to plan around is 30 June.

Because the toolkit resets every year, a status is only ever valid for that assessment year. Organisations that treat it as a one-off tend to find themselves starting from scratch each June. Our guide to the DSPT deadline and annual cycle sets out a calendar that spreads the work across the year.

How to complete the DSPT for the first time

If you are new to the toolkit, a realistic path looks like this:

1. Register and confirm your profile. Create your account with your ODS code, check the organisation type is correct and confirm the question set you have been assigned.
2. Read every assertion before you answer any. Understand what is being asked and what evidence would prove it. Many items can be satisfied with documents you already hold.
3. Map your existing evidence. Policies, staff training records, access-control lists, back-up arrangements, supplier contracts and your incident log will cover a surprising amount. Use our DSPT evidence checklist to match them to assertions.
4. Close the gaps. This is where most of the effort goes: updating policies, delivering data-security training, tightening user access, confirming back-ups are tested and writing down your incident-response process.
5. Complete, review and publish. Enter your responses, attach evidence where the toolkit asks for it, sanity-check the whole assessment and publish your status before 30 June.
6. Keep the evidence pack live. Store everything in one place so next year is an update rather than a rebuild, and so you can answer an audit request quickly.

The common DSPT mistakes we see most often are treating the toolkit as an IT-only task, declaring Standards Met without holding the evidence and leaving everything to the last fortnight of June.

What evidence will you need?

The exact list depends on your profile, but a typical care provider’s evidence pack includes:

Area	Examples of evidence
Governance	Data protection and information governance policies, a named responsible person, ICO registration
Staff	Annual data security awareness training records, confidentiality clauses in contracts
Access	User access controls, unique logins, a joiners/movers/leavers process
Technical	Supported operating systems, anti-malware, patching, multi-factor authentication, tested back-ups
Incidents	An incident and breach reporting procedure and a log of incidents and near-misses
Suppliers	Data processing agreements with IT and care-planning software suppliers

If you already hold Cyber Essentials, several of the technical assertions become much easier to evidence.

Does the DSPT cost anything?

The toolkit itself is free to use. The cost lies in the time and expertise needed to gather evidence and close gaps. Adult social care providers can also access free support from the Digital Care Hub’s Better Security, Better Care programme, which is well worth using. Where teams struggle is when nobody in the organisation owns information governance, evidence is scattered, or the deadline is close; that is where specialist help earns its keep.

Getting help with the DSPT

Most care teams do not have a dedicated IT or information-governance lead, and that is exactly the gap we fill. We take providers from “not started” to a confident, well-evidenced Standards Met remotely, in plain English, at a fixed price agreed up front.

A good first step is our free DSPT readiness checker, which takes two minutes and shows where your gaps are likely to be. When you are ready to talk, book a free readiness check or read more about our DSPT consultancy service.