Every practice with access to NHS patient data and systems completes the Data Security and Protection Toolkit (DSPT) each year. New tools need to show up in it.
- Whose job
- Your practice
- Who usually leads
- Practice manager, with your DPO and ICB GP IT team
- How often
- Every year, by 30 June
What it is
An online self-assessment against the National Data Guardian’s data security standards. Organisations with access to NHS patient data and systems must complete it.1 The 2025-26 toolkit for GP practices had 45 evidence items, with a deadline of 30 June 2026.2
Large NHS organisations are moving to a version based on the Cyber Assessment Framework. Other organisations stay on the current version until NHS England tells them it’s their turn.3
The year at a glance
July to March: keep it up to date as things change. A new tool means updating your information asset register and data flow map.
April to June: review every answer, gather the evidence, and submit.
By 30 June: publish the assessment. The aim is "Standards Met".
Where a new tool comes in
- Asset registerAdd the tool to your list of information assets.
- Data flowsRecord what data goes to the supplier and where.
- DPIAKeep the DPIA and data processing agreement as evidence. The DPIA.
- TrainingStaff who use it are trained, and it’s recorded.
- IncidentsData breaches involving the tool are reported through the DSPT. Data breaches.
Many practices get help from their ICB or DPO service, which often provides template evidence. Ask yours before you start.
References
- Data Security and Protection Toolkit. NHS England
- Data Security and Protection Toolkit 2025-26 update. NHS North East London ICB. An example of ICB guidance for practices
- CAF-aligned DSPT: evolution of our assurance model. NHS England
Sources on this page last checked 6 November 2026.