DSPT support for care providers
We help care providers reach Standards Met or Standards Exceeded on the DSPT.
Days until the DSPT deadline
Publish by 30 June
Every adult social care provider is asked to complete the toolkit every 12 months.
What the DSPT is
The DSPT is the NHS self assessment of your data governance, security, policies and best practice.
The Data Security and Protection Toolkit (DSPT) is the official NHS self assessment for data protection and cyber security. It measures how your organisation looks after information against the National Data Guardian’s ten data security standards.
Adult social care providers in England, including residential and nursing homes, are expected to complete it every 12 months and publish it by 30 June.
The four DSPT levels and what each one means
1
Standards Not Met
Your assessment shows this level when some of the required items are not yet in place, and our team helps you work through them.
2
Approaching Standards
This level shows you are making progress, and it is the level the NHS asks for before you can use NHS.net Connect, the NHS email service formerly called NHSmail.
3
The level to aim for
Standards Met
This level shows that your home looks after information safely and has good data governance in place. It is also the level the NHS asks for before you can apply to use shared systems such as GP Connect and local shared care records.
4
We can help you get here
Standards Exceeded
This is Standards Met together with a current Cyber Essentials Plus certificate, the highest level a care provider can reach.
How our team helps you reach Standards Met
01
A free DSPT review
We look at where you are today and give you a plan to reach Standards Met.
02
Your gap report
You get a list of what is missing, with the most important gaps first.
03
Your policies
We advise and recommend how to enhance your data protection and incident policies, agreed by you and signed off.
04
Staff training
We can recommend data security training and a training provider.
05
Evidence and submission
We gather the evidence with you and help you publish before 30 June.
06
Support every year
We keep your evidence current and help you republish each year.
What is new this year
What has changed in version 9 of the toolkit for 2026 to 2027
- Version 9 for 2026 to 2027 was released on 1 September 2026.
- You can now reuse evidence from last year where it still applies.
- Organisations now record the products and services they get from suppliers.
- An extended detection and response (XDR) policy is now required.
- The wording on two step sign in (multi factor authentication) has been tightened.
Last checked against the DSPT website on 3 November 2026.
Free support
You can also use free help alongside us.
Better Security, Better Care and the Digital Care Hub offer free guidance, templates and local support for care providers working through the DSPT.
We are happy to point you to them, and our team can help with the parts that need hands on IT work.
Questions care providers ask us about the DSPT
Do we have to complete the DSPT?
All adult social care services in England are strongly recommended to complete it every 12 months, and services with NHS funding must do so under their contract.
When is the deadline?
Each year’s assessment must be published by 30 June.
What does Standards Met mean?
Standards Met shows that your company is looking after personal information safely and meets the National Data Guardian’s ten data security standards. It is also the level the NHS asks for before a care provider can apply to use shared systems such as GP Connect, local shared care records and proxy access to GP records.
How long does it take?
It depends on where you are starting from. We begin with a free DSPT review and then give you a plan with timings.