DSPT Independent Audit and Compliance Services
The DPO Centre delivers independent audit services and hands-on compliance support, ensuring your organisation meets NHS Data Security and Protection Toolkit (DSPT) standards.
Fulfilling the DSPT’s assertions and evidence items can be complex and time-consuming. That’s why it’s important to evaluate your current status against the DSPT criteria as early as possible. You can then identify the support you need and make informed decisions about the best expertise for your organisation.
What is the DSPT?
The Data Security and Protection Toolkit (DSPT) is an online self-assessment tool for organisations to measure their performance against either the National Cyber Security Centre’s Cyber Assessment Framework (CAF) or the National Data Guardian’s 10 data security standards.
Organisations with access to NHS patient data and systems in England are required to complete the DSPT annually and maintain appropriate data security standards throughout the year. This may also include organisations based outside England.
Scotland, Wales and Northern Ireland have their own requirements for NHS data security and information governance.
2026-2027 DSPT deadline
30 June 2027
HOW OUR DSPT SERVICES HELP YOU ACHIEVE COMPLIANCE
Our specialist Data Protection Officers (DPOs) help you prepare your DSPT submission and carry out independent audits where needed.
If your organisation doesn’t require an independent audit, you can still access our gap analysis and compliance support.
Our DSPT services:
- Gap analysis to review data security and protection measures against DSPT requirements
- Compliance advice from a specialist DPO on the changes needed to meet obligations
- Documentation support to prepare and review policies, procedures, and evidence
- Independent DSPT audit of your Toolkit responses, with an NHS England-aligned report
2026-2027 DSPT ASSESSMENT UPDATES
NHS England has introduced changes to DSPT organisation categories for 2026-2027. The Cyber Assessment Framework (CAF) continues to apply to Category 1 organisations, while the non-CAF DSPT remains applicable to organisations in Categories 2, 3, and 4. Independent audits remains mandatory for Category 1 and Category 2 organisations.
Key changes for 2026-2027:
-
Category 2: Renamed ‘Suppliers’ from ‘Key IT Suppliers’ or ‘Large Suppliers’ to better reflect organisations covered
-
Category 3: Two new sub-categories for CQC Market Oversight providers (3a) and Local Authorities (3b), with additional CAF-related evidence requirements
For more information read our Guide to the latest DSPT requirements and common mistakes
Frequently Asked Questions
If you are a public or private organisation accessing NHS patient data or systems in England, you must complete the DSPT self-assessment. Depending on your organisation category, this measures performance against either the National Cyber Security Centre’s Cyber Assessment Framework or the National Data Guardian’s 10 data security standards.
You should complete the DSPT and submit annually before the relevant deadline. If you are a Category 1 or Category 2 organisation, you will also need to undertake an independent audit once per year. It is important to keep up to date with your DSPT requirements as changes to your systems, services, and staff can occur throughout the year.
A key component of the DSPT is to assess your current cybersecurity procedures, data protection policies, and processes. The questions are designed to help you review and update your security framework where needed, covering areas such as training, back-ups, password management, storage, and more. The Toolkit also ensures trust and confidence in your practices and demonstrates your commitment to best practice data management.
If you’re unsure how to use or complete the DSPT, the DPO Centre can support you by reviewing your current data security and protection procedures, implementing necessary policies and procedures, and guiding you through the submission process. Our assessment can be tailored to either cover all your data protection needs or focus specifically on your DSPT submission.
The DSPT is specifically only for organisations that operate in England. Wales and Scotland each have their own individual data security and protection toolkits governed by their respective national health authorities.
Enquire Today
Fill in your details and we’ll get back to you as soon as possible