NHS DSPT: The Data Security and Protection Toolkit for Suppliers

The DSPT (Data Security and Protection Toolkit) is the online self-assessment that every organisation with access to NHS patient data and systems must complete and publish each year. Run by NHS England, it shows that you handle health and care information securely and in line with the National Data Guardian’s ten data security standards. NHS trusts, integrated care boards and other Category 1 bodies complete a version aligned to the NCSC Cyber Assessment Framework (CAF), while suppliers, GP practices, care providers and other organisations answer a set of assertions and evidence items. The deadline for the 2026-27 toolkit is 30 June 2027.

This guide is written for suppliers and smaller providers. Facts about organisation types, audits and deadlines come from the toolkit site’s 2026-27 guidance, checked on 13 October 2026; NHS England reviews them every year, so confirm them before you rely on them.

What is the DSPT?

The DSPT is an annual, evidence-based self-assessment hosted at dsptoolkit.nhs.uk. In the DSPT toolkit you answer the questions for your organisation type, attach or describe your evidence, and a senior person publishes the assessment. Your published status is visible to anyone through the toolkit’s organisation search, which is how NHS buyers and partners check you. For many organisations it is also a condition of their NHS contract, and it is needed to use national systems such as NHSmail.

The toolkit grew out of the National Data Guardian’s 2016 Review of Data Security, Consent and Opt-Outs, which set ten data security standards for health and care, and it replaced the older Information Governance Toolkit in 2018.

Two points are often misunderstood:

• It is not a certificate. You publish a new assessment, and so a new status, every year.
• It covers data protection as well as cyber security. Training, confidentiality, records, data sharing and incident reporting sit alongside technical controls.

Who needs to complete the DSPT?

The NHS DSPT requirements apply to every organisation that has access to NHS patient data and systems: NHS bodies, GP practices, dentists, pharmacies, opticians, care providers, local authorities, universities, charities and the companies that supply them. For a supplier, the scope is the health and care data it processes, not the whole business.

The toolkit sorts organisations into four categories for 2026-27, and your category decides which questions you see.

A supplier registers as Category 2 only if it meets all three criteria: 50 or more staff, turnover of £10 million or more, and supplying digital goods or services to the NHS or care. A supplier that misses any of them registers as Other, in Category 3. Check the organisation types guidance in the toolkit’s help pages before you register, because a different category means a different set of questions.

How does the CAF-aligned DSPT differ from the standards-based one?

Both versions cover similar ground, but they are built and scored differently.

The CAF-aligned DSPT (Category 1)

NHS England introduced the CAF-aligned version for 2024-25, and the 2026-27 toolkit is aligned to CAF version 4.0. It uses the CAF’s objectives and contributing outcomes, plus a fifth objective, E, that NHS England added for health and care information governance. Each outcome is self-assessed as achieved, partially achieved or not achieved, guided by indicators of good practice, and NHS England sets the profile, the level each outcome is expected to reach, against which the result is judged.

Category 1 organisations have also been asked to publish an interim assessment by 31 December, and their assessment must be independently audited. For 2026-27, NHS England mandates 11 outcomes for audit, plus one the organisation chooses. Our guide to the Cyber Assessment Framework explains how CAF outcomes and profiles work, and the NCSC publishes the framework itself in its CAF collection.

The standards-based DSPT (Categories 2 to 4)

Suppliers and smaller organisations answer assertions and evidence items, some of them mandatory, organised around the National Data Guardian’s ten standards. Once every mandatory evidence item is complete and every assertion confirmed, you can publish. The statuses you can reach are explained in the next section.

Some IT suppliers also face an audit. NHS England publishes separate audit areas for IT suppliers, including for 2026-27, so check whether your category or contract requires one. The toolkit’s FAQ says an IT supplier with an audit requirement must complete a DSPT audit to reach Standards Met, and that ISO 27001 or Cyber Essentials Plus certification reduces the audit’s scope to the evidence items those audits do not cover.

What do the DSPT statuses mean?

Your DSPT status is the result of your latest published assessment, and anyone can see it through the toolkit’s organisation search; the content of your answers stays private. These are the statuses described in the toolkit’s own help pages, checked on 13 October 2026:

Organisations that reach Standards Met or Standards Exceeded can download a DSPT certificate for the latest year, showing the status, the toolkit year and the publication date. A Standards Not Met result has consequences beyond your profile: the toolkit tells organisations that send data to NHS England systems through an API to assess the risk and, if necessary, stop until it is fixed. You can update and republish your assessment at any time during the year, so a status can improve before the next deadline.

What are the National Data Guardian’s ten data security standards?

The ten standards sit under three leadership obligations: people, process and technology.

When is the DSPT deadline?

The 2026-27 toolkit is version 9. Its outcomes, assertions and evidence items were published on 2 October 2026, and the deadline is 30 June 2027. Earlier toolkits followed the same pattern: 30 June 2025 for 2024-25 and 30 June 2026 for 2025-26. You can update and republish your assessment at any time during the year.

Start early: several items need a track record across the year, such as training, a tested continuity plan and timely patching, so book any Cyber Essentials Plus assessment or penetration test months ahead.

Does the DSPT require Cyber Essentials Plus?

No. The toolkit’s own FAQs state that Cyber Essentials Plus certification is not mandatory. It still matters in four ways:

1. Standards Exceeded. Outside Category 1, an organisation that reaches Standards Met and records a current Cyber Essentials Plus certificate in its profile is shown as Standards Exceeded.
2. Fewer questions. The toolkit says certificate holders may be exempt from some questions.
3. Evidence. Standard 9 calls for an IT protection strategy based on a proven framework such as Cyber Essentials. A Cyber Essentials Plus certificate shows those controls were independently tested on a sample of your devices.
4. Contracts. PPN 014 applies to NHS bodies as well as central government, so many NHS contracts that involve personal data require Cyber Essentials or Plus in addition to the DSPT. Our guide on whether Cyber Essentials is mandatory explains the rules.

Where do Cyber Essentials Plus, penetration testing and ISO 27001 fit?

They supply evidence for parts of the toolkit, mostly the technology and process standards. None of them answers the information governance questions on confidentiality, data sharing and records.

Check that each certificate or test covers the systems that hold NHS data, and keep dated reports from the current assessment year. Our vulnerability scanning service and ISO 27001 consultancy produce this kind of evidence.

Can someone help with DSPT compliance?

Yes. Many organisations use outside help with DSPT compliance, but the assessment stays yours: your staff answer the questions, your evidence supports them and a senior person in your organisation publishes it. Adult social care providers can get free help through the Better Security, Better Care programme, delivered by Digital Care Hub.

Useful support means interpreting the questions for your category, checking answers against the evidence you actually hold, organising it against each item (policies, training records, asset and supplier lists, test reports) and supplying technical evidence such as a Cyber Essentials Plus certificate.

How Sovereign Secure helps

We help NHS suppliers and smaller providers build the evidence their toolkit needs.

• Cyber Essentials and Cyber Essentials Plus certification. We are an IASME-licensed certification body, so we issue both certificates. Cyber Essentials packages start at £320 + VAT.
• Cyber Essentials consultancy to close technical gaps, such as unsupported systems and missing MFA, before you certify.
• Penetration testing and vulnerability scanning of the systems that hold or reach NHS data, with dated reports you can cite. See our penetration testing services.
• ISO 27001 consultancy, from a company that is ISO 27001 certified itself.

Where we advise you and also certify you for Cyber Essentials, IASME’s independence rules for certification bodies apply. We explain how advice and assessment are kept separate before work starts, and advice does not make a pass more likely. Our Cyber Essentials consultancy page sets this out.

Sovereign Secure Ltd was incorporated in 2012 and is headquartered at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are registered with the ICO. For the wider picture in the sector, see our page on healthcare cyber security.

What should you do next?

Check your category and current status on the toolkit site, download the 2026-27 evidence items and list the ones you cannot yet evidence. Then tell us which gaps are technical, and we will quote for Cyber Essentials Plus, penetration testing or vulnerability scanning. Use the enquiry form on this page or call +44 161 523 5276.