Say Hi to NHS DSPT without the annual panic

The Data Security and Protection Toolkit is a mandatory annual self-assessment for any organisation that handles NHS patient data or uses NHS systems like NHSmail and e-Referrals. This includes NHS trusts, GP practices, independent care providers, pharmacies, and IT suppliers. If you handle health or care data, you need DSPT.

DSPT submissions are required annually. Missing the deadline means losing access to critical NHS systems, contract restrictions, and financial penalties. Start evidence collection early—last-minute heroics rarely work out well.

Category 1: Large NHS bodies (Trusts, ICBs, arm's-length bodies)
Category 2: Operators of Essential Services under NIS Regulations and critical IT suppliers
Category 3: Community providers (pharmacies, care homes, domiciliary care)
Category 4: GP practices providing primary care services

Each category has tailored requirements. Category 1 and 2 organisations face more rigorous assessment including independent external audits.

DSPT assessment covers four main areas:

• Staffing and Roles: Staff responsibilities, training, and accountability
• Policies and Procedures: Data security policies and documented processes
• Data Security: Risk assessments, incident management, data protection controls

IT Systems and Devices: Technical security, system hardening, access controls

You lose access to NHS systems like NHSmail and e-Referrals. Contracts get delayed or restricted. Reputation takes a hit. And depending on your contracts, financial penalties start appearing. Better to just pass.

Evidence requirements depend on your category but typically include staff training records, policy acknowledgements, risk assessments, audit logs, incident response documentation, and proof of technical controls. Category 1 & 2 organisations need more comprehensive evidence for independent audits.

Category 1 and selected Category 2 organisations must undergo independent external audits in addition to self-assessment. Categories 3 and 4 complete self-assessment without external audit requirements.

We automate evidence collection across all four security headings, deploy NHS-compliant policy templates, track staff training completion, and maintain audit-ready documentation trails. Everything organises itself—you handle approvals, not admin slog.

Absolutely. The platform scales from single GP practices (Category 4) to large NHS trusts (Category 1). Same automation benefits—staff training tracking, policy management, evidence collection—without paying for enterprise bloat you don't need.

Most organisations reach "Standards Met" readiness in 8-12 weeks using our guided workflow. We automate evidence collection, policy deployment, and staff training tracking. No heroic weekend efforts required.

"Standards Met" is the minimum passing grade required to maintain NHS access and contracts. "Standards Exceeded" demonstrates additional maturity and best practices. Most organisations aim for "Standards Met" unless contractually required to exceed.

Annually. With continuous monitoring and automated evidence collection, renewals become routine rather than crisis management. That moment when next year's submission is already half-done because evidence collected itself.