Your Data Security and Protection Toolkit, done with you every year.
Care providers with NHS contracts, or access to NHS systems, need to complete the Data Security and Protection Toolkit (DSPT) every year. We work through it with you, gather the evidence and keep it ready for the next year.
How it works
Review
Where you are now, your last submission and what's missing.
Evidence
Policies, training records, asset and data flow registers, and the technical questions answered with you.
Submit
You publish your assessment. The submission must be made by your organisation.
Renew
A reminder and a review before the next deadline.
The evidence in place before the deadline.
The 2026-27 toolkit must be published by 30 June 2027 (NHS England DSPT, 2 October 2026).
Adam leads the toolkit. Where a question needs specialist IT input, we'll tell you and point you to a suitable provider.
Included
- A gap review
- The policies and registers the toolkit asks for
- Staff data security training records, kept in Assure if you use it
- Help with the technical questions
- A yearly renewal
Common questions
Do we need the DSPT?
If you hold an NHS contract or use NHS systems such as NHSmail, usually yes. Check your contract.
Can you submit it for us?
No. The toolkit has to be completed and published by your organisation. We prepare everything with you.
Register your interest
Tell us about your service and when your toolkit is due.
We will only use your details to tell you about this service. Please don't include health details.
Thank you.
You are on the list. We will be in touch when this service opens.