DSPT Support — Get to ‘Standards Met’

What the DSPT is, and who must do it

The Data Security and Protection Toolkit is NHS England's annual self-assessment for anyone handling health or care data or using NHS systems such as NHSmail or e-Referrals. If you deliver services under an NHS contract, it's effectively mandatory — and commissioners increasingly make ‘Standards Met’ a condition of the contract.

What changed in version 8

The 2025/26 toolkit (version 8) is the biggest change in years. It's now aligned to the NCSC Cyber Assessment Framework (CAF v3.4) and restructured around outcomes, assertions and evidence. The practical shift: it's no longer enough to say a control exists — you have to show it works and is maintained. If your policy says ‘all staff complete annual training’, you need the records to prove it. There's no exemption for holding Cyber Essentials Plus or ISO 27001.

The 30 June 2026 deadline

Final submissions for 2025/26 are due 30 June 2026. Submitting late risks your access to NHS contracts and data-sharing. If you genuinely can't hit it, the right move is to contact NHS England before the deadline — but for most small providers there's still time to reach ‘Standards Met’ comfortably if you start now.

How we get you there

We start with a plain gap review against your DSPT category, then fix the controls that move the most outcomes fastest — MFA, access control, patching, backups and your asset register — and assemble a clean, audit-ready evidence pack. You submit with confidence. Most practices, pharmacies and care providers reach ‘Standards Met’ in a few weeks; larger CAF-aligned organisations take longer given their scope.

Common questions