Meet the DSPT standard with confidence

The NHS Data Security and Protection Toolkit (NHS DSPT) is required for any organisation handling NHS patient data. NHS Digital and ICB commissioners are looking for submissions that genuinely reflect how you actually operate, not just what your documentation says.

We help you build a submission that is accurate, evidence-led and built to withstand scrutiny from authorities, so you can meet the standard with confidence.

Submit with confidence

Every assertion and evidence requirement is worked through ensuring no gaps or guesswork.

Build beyond compliance

Support to build DSPT as the foundation for ISO 27001.

Protect patient data

Incorporates controls and governance that the DSPT requires and protects the data in your care.

Meet the DSPT standard with confidence

The NHS Data Security and Protection Toolkit (NHS DSPT) is required for any organisation handling NHS patient data. NHS Digital and ICB commissioners are looking for submissions that genuinely reflect how you actually operate, not just what your documentation says.

We help you build a submission that is accurate, evidence-led and built to withstand scrutiny from authorities, so you can meet the standard with confidence.

Submit with confidence

Every assertion and evidence requirement is worked through ensuring no gaps or guesswork.

Build beyond compliance

Support to build DSPT as the foundation for ISO 27001.

Protect patient data

Incorporates controls and governance that the DSPT requires and protects the data in your care.

NHS DSPT Independent Audit

Get your 2025/26 DSPT submission independently assessed against NHS England’s requirements, with clear findings, practical outcomes and a 10 working-day turnaround.

NHS Data Security and Protection Toolkit Services

We provide structured support across your full DSPT submission cycle, from gap analysis through to final validation to ensure you meet the standard with confidence.

Core Services

Core Services

digital justice scale
  • Gap analysis against current DSPT standards
  • Evidence mapping and documentation review
  • Policy and control development
  • Risk assessment alignment
  • Incident management validation
  • Staff awareness and training review
  • Submission support and final sign-off

Additional Support

Additional Support

digital cloud on cyber grid
  • ISO 27001 pathway planning
  • Data Protection Impact Assessment (DPIA) support
  • Ongoing compliance monitoring
0
Incidents notified via the DSPT to the ICO as of 2024

Get in touch

Need support with your DSPT submission? Tell us about your organisation and where you are in the submission cycle and we’ll be in touch to discuss how we can help.

Frequently Asked Questions

Any organisation that has access to NHS patient data or NHS systems is required to complete the DSPT. This includes NHS trusts, GP practices, community health providers, social care organisations and third-party suppliers — including IT providers, consultancies, data processors and cloud service providers — who access or handle NHS data as part of their contracted services. If you are unsure whether your organisation is in scope, we can advise.

The standard DSPT submission deadline is 30th June each year. Organisations are expected to submit at a minimum the ‘Standards Met’ level by this date. NHS Digital publishes the current year’s toolkit and assertion requirements in advance, and standards do change year-on-year. We recommend starting your assessment no later than April to allow sufficient time for evidence gathering and any remediation.

Organisations that do not meet the required standard risk contract non-compliance notifications from commissioners, removal from approved supplier lists and, in more serious cases, referral to the ICO or NHS England. For suppliers, failure to meet DSPT is increasingly treated as a contract breach. Beyond the regulatory consequences, it signals a genuine gap in patient data protection that carries reputational and operational risk.

DSPT is a self-assessed toolkit with specific NHS-mandated assertions designed for the healthcare sector. ISO 27001 is an independently audited international standard for information security management applicable across all sectors. There is significant overlap between the two — strong DSPT compliance is often a solid foundation for ISO 27001 certification, and we help organisations use their DSPT work as a stepping stone rather than treating them as separate exercises.

Yes. DSPT is an annual obligation and the requirements evolve each year. We offer ongoing support through a retainer arrangement that covers monitoring of assertion changes, periodic reviews of your evidence position, and submission support each year. For organisations without a dedicated information governance resource internally, this is typically the most cost-effective model.