Meet every requirement for
NHS DSPT with Assuric compliance software

The NHS Data Security and Protection Toolkit (DSPT) is an annual online self-assessment run by NHS England. Every organisation with access to NHS patient data and systems, including suppliers of digital health technology, uses it to show it meets the National Data Guardian’s data security standards. You publish a new assessment each year by 30 June, and NHS buyers check that your status is Standards Met or Exceeded.

The NHS Data Security and Protection Toolkit (DSPT) sets out the data protection and security practices expected of organisations with access to NHS patient data and systems, and is run by NHS England. It aligns with UK GDPR and covers information governance, cyber security and data sharing, to safeguard patient data.

Most organisations, including suppliers, are assessed against the 10 National Data Guardian data security standards, covering areas such as handling personal data, staff training and responsibilities, incident response, business continuity and IT protection. Some larger NHS organisations now complete a version aligned to the NCSC’s Cyber Assessment Framework (CAF).

Not quite. The Information Governance (IG) Toolkit was the DSPT’s predecessor, and was replaced by the DSPT in 2018. You may still hear people call the DSPT the IG Toolkit.

Any organisation with access to NHS patient data and systems must complete the DSPT, and that includes suppliers of digital health technology. If you're selling into the NHS, expect buyers to ask for your DSPT status during procurement.

If your organisation doesn’t already have an Organisation Data Service (ODS) code, request one from NHS England first. Suppliers often don’t have one until they start working with the NHS. Once you have it, register on the DSPT website and you can start your assessment.

The DSPT is an annual assessment. You review and republish your submission every year to keep your status current, and submissions are due by 30 June each year.

A Data Protection Impact Assessment (DPIA) is a structured way to identify and reduce the risks a piece of data processing poses to people’s privacy, before the processing starts. Article 35 of the UK GDPR requires one whenever processing is likely to result in a high risk to individuals, and it records what data you use, why, the risks and the safeguards you’ve put in place.

Almost certainly, yes. UK GDPR requires a DPIA before any processing likely to result in a high risk to individuals, and processing health data usually meets that test. DTAC also asks every supplier for a DPIA for their product, which NHS buyers use when completing their own. NHS England publishes a DPIA template you can start from.

Assuric keeps your DSPT evidence in one place. Your Record of Processing Activities, Information Asset Register and risk register are built in, and work you've done for GDPR, Cyber Essentials and DTAC is mapped across. Our AI questionnaire assistant then drafts answers from your workspace, with citations, for you to review and submit.