What is the DSPT? A plain-English guide for care providers

The Data Security and Protection Toolkit (DSPT) is the NHS’s annual online self-assessment for organisations that handle health and care data. If you use NHS systems or hold patient information, completing it isn’t optional — it’s how you prove you’re looking after that data properly.

This guide explains the essentials in plain English.

Who must complete the DSPT?

Any organisation that accesses NHS patient data, including:

• Care homes and nursing homes receiving NHS-funded care
• Domiciliary (home) care and supported living providers
• GP practices, dental practices and community pharmacies
• Any supplier that connects to NHS systems such as NHSmail or GP Connect

If you rely on NHSmail, the Electronic Prescription Service, GP Connect or similar, you almost certainly need a current DSPT.

Why it matters

A completed DSPT keeps your NHS data flows switched on. Just as importantly, the CQC looks at data security as part of the well-led domain, and commissioners and families increasingly expect to see it. Failing to submit can mean losing access to the very systems you depend on.

The DSPT deadline

The standard annual deadline is 30 June. Some larger organisations also have an earlier baseline submission. The toolkit resets each year, so it’s an ongoing commitment, not a one-off.

How to reach “Standards Met”

At a high level you’ll need to:

1. Confirm the right organisation profile and registration
2. Map your evidence against each assertion (policies, training, technical controls)
3. Close any gaps — staff training, access controls, backups, incident processes
4. Submit and keep your evidence pack ready for any audit

Getting help

Most care teams don’t have a dedicated IT or information-governance lead — which is exactly where we come in. We take you from “Not started” to “Standards Met” remotely, in plain English, at a fixed price.

Book a free DSPT readiness check → or read more about our DSPT service.