DSPT: NHS data assurance

Assess the Data Security and Protection Toolkit (DSPT) early whenever a service receives NHS patient information or accesses NHS systems. This includes processing for purposes beyond individual care. Establish the applicable requirements, verify the assessment and maintain assurance through the service lifecycle. DSPT does not replace the UK GDPR framework or confidentiality authority. SRC-056, SRC-081, SRC-087

For a commissioned service receiving identifiable records directly from NHS GPs, the recommended decision is to make DSPT mandatory in the contract. Establish any existing duty as well. A procurement recommendation and a finding of an existing statutory obligation are different conclusions. The recruitment example applies this distinction to eligibility assessment.

Why DSPT is central when NHS information is involved

DSPT brings organisational security and information governance into one assurance process. The CAF-aligned approach combines cyber-resilience outcomes with health and care requirements for data protection and confidentiality. CAF means the National Cyber Security Centre's Cyber Assessment Framework. NHS England expressly states that DSPT covers only part of an organisation's legal and regulatory obligations. SRC-087

The practical distinction is lawful processing and demonstrable assurance. A lawful basis does not prove that the service's controls are adequate. A satisfactory DSPT assessment does not supply a lawful basis, authorise a new use or grant unrestricted NHS-system access. Apply both the legal tests and the assurance requirements. SRC-001, SRC-055, SRC-087

What makes DSPT mandatory?

State mandatory under which instrument, for which organisation and activity. The following routes can overlap.

Basis	What it establishes	Limit
DHSC policy	Bodies processing NHS patient information for any purpose are expected to provide DSPT assurance.	Policy supports the requirement; it is not itself proof of a statutory penalty against every recipient. SRC-056, SRC-081
DAPB0086 and section 250	The published information standard states that persons subject to it must comply where it is relevant.	Match the entity, activity and applicable release to the statutory categories and standard's addressees. NHS origin alone does not complete that analysis. SRC-046, SRC-080
Existing contract or access terms	A binding DSPT clause creates an obligation for its parties within its scope.	An NHS Standard Contract term does not automatically enter a contract with another government department. SRC-081
New commissioning condition	The purchaser can specify DSPT evidence and continuing obligations in the service contract.	This is the recommended route to make the requirement explicit; it is not a claim about terms already agreed.
UK GDPR	Security, accountability and, where a processor is used, sufficient guarantees and prescribed terms are legal duties.	Articles 28 and 32 do not name DSPT. DSPT can support assurance, but neither proves all legal duties are met. SRC-005, SRC-014, SRC-019

The DAPB0086 version 8 notice was published on 12 August 2025. It is later than the 7 July 2025 transition discussed in information standards. Do not apply the saving for older standards indiscriminately to this release. Equally, do not infer coverage of an unidentified recruitment contractor without assessing its functions and the standard. SRC-047, SRC-080

Section 250 requires specified addressees within eligible categories. For a private contractor, examine any required regulated-provider registration or relevant IT-provider role and the service's connection with health or adult social care. A purpose beyond individual care does not itself decide that statutory test. SRC-046

The 2026/27 NHS Standard Contract, General Condition 21.2, expressly requires an annual published DSPT assessment and compliance with applicable mandatory requirements. GC21.6 addresses audit where applicable. These are concrete contractual provisions, but their existence does not prove incorporation into a non-NHS procurement. The recommended condition below must be agreed in the contract that actually governs the service. SRC-096

Establish the requirement before selecting a supplier

Data flow or circumstance	DSPT assessment to make
Identifiable NHS GP records or reports received directly	Apply the policy expectation for NHS patient information used for any purpose. Identify disclosure conditions and make the purchaser's assurance requirement explicit. A live system connection is not the only trigger.
NHSmail, shared NHS records or another national system	Check that system's current access and assurance conditions as well as the permitted purpose.
NHS-commissioned service	Identify the actual contract and applicable information standards. Do not assume every public-sector contract incorporates the NHS Standard Contract.
Privately owned or privately funded service	Check NHS data, system access, contracts and relevant regulatory status. Private ownership alone does not establish an exemption.
Service with no NHS information or system access	Those triggers are absent. Check other applicable requirements before concluding DSPT is optional; general data-protection duties still apply to personal data.

The first three routes follow NHS policy and contract guidance. Relevant information standards need an addressee and scope assessment. Some independent providers are designated operators of essential services; their regulatory status needs separate consideration. The table is an assessment method, not a finding about an unidentified organisation. SRC-056, SRC-061, SRC-080, SRC-081

NHS-origin records outside NHS commissioning

Require continuing DSPT assurance expressly when commissioning a service that receives identifiable NHS GP material for purposes beyond individual care. Make it a condition of receiving and processing that material. This is the wiki's procurement recommendation, grounded in NHS policy and the purchaser's need for demonstrable safeguards. It does not depend on proving that the NHS Standard Contract already binds the contractor. SRC-056, SRC-081, SRC-019

The requester should supply its DSPT evidence as part of readiness for receiving records. It must govern its own processing even where the source provider states no conditions. DSPT supports assurance; it does not replace a required DPIA, role-specific agreement or appropriate policy document. SRC-014, SRC-018, SRC-002, SRC-103

The source controller should identify its disclosure requirements. This does not establish that every GP must refuse every authorised disclosure to a recipient without DSPT. Individual authority for a report also does not replace the recipient's Article 6 basis and Article 9 condition. Limit collection to the justified purpose; GMC guidance normally favours relevant information over the whole record for employment and similar reports. SRC-067, SRC-083

What the annual assessment covers

DSPT is broader than a security badge. Its requirements address organisational arrangements and evidence, with different assessment structures for different categories. The 2026–27 version 9 notice aligns requirements with CAF 4.0. Specified CAF cohorts use outcomes and indicators; other categories use assertions and evidence items. Follow the current requirements for the actual organisation. SRC-082, SRC-093

Some categories have independent audit requirements. The 2026–27 audit notice specifies separate mandatory areas for CAF organisations and IT suppliers. Do not describe every DSPT submission as independently certified, or assume that all organisations require the same audit. SRC-094

Verify a published DSPT claim

Use the official organisation search. Search by organisation name or its Organisation Data Service (ODS) code. The public record identifies the assessment period, publication date and status; it does not expose all supporting evidence. SRC-088, SRC-056

Check	Evidence to retain
Identity	Legal entity, registered organisation name and ODS code; reconcile trading names and group companies.
Period and status	Assessment year, publication date, displayed status and the deadline governing the required submission.
Coverage	The service, systems, locations and participating organisations included in the assessment; identify relevant exclusions.
Assurance depth	Applicable category, required audit, findings and improvement actions. Obtain relevant evidence through an appropriate controlled route.
Continuing assurance	Renewal date, owner, material-change triggers and contractual reporting and remediation arrangements.

These are recommended due-diligence records. A parent entry is useful only where its assessment covers the relevant services and activities. A public status is an initial check, not evidence that every group company or subcontractor is covered. SRC-082, SRC-088, SRC-094

The requester should maintain this evidence and supply it to the provider or purchaser as appropriate. The purchaser should record who accepted the contractual evidence, when it was checked and which service it covered. Keep unresolved gaps and renewal actions with named owners. This recommended acceptance record supports oversight; it does not approve the provider's disclosure or the recipient's processing.

Current assessment period

As checked on 19 October 2026, the operational cycle is 2026–27 version 9, with a published submission deadline of 30 June 2027. Check any earlier contractual milestone or required interim submission. Opening this cycle does not itself prove that an assessment for the previous period has lapsed. SRC-093

The DAPB0086 information-standard page still lists version 8. Keep its notice, scope and assurance dates distinct from the operational version 9 materials. Do not combine different releases into one supposed deadline. SRC-080, SRC-093

Recommended contract condition

The following is a proposed mandatory procurement condition, not a quotation of legislation or an existing contract. Put it in the service specification and binding security/data schedules. Identify who verifies it and who can enforce it.

Before receipt: require published DSPT Standards Met or Standards Exceeded status for the applicable assessment period before identifiable NHS patient information enters the service.
Coverage: identify the legal entities, relevant subcontractors and processing covered. Obtain evidence that the assessment covers the contracted service. Do not assume a parent or prime contractor's assessment covers every participant.
Maintenance: require annual renewal by the applicable deadlines, the correct organisation category and any required independent audit. Reassess coverage when the service or supply chain changes.
Evidence and remedies: provide contractual rights to inspect relevant assurance evidence. Require prompt notification of lost status, material security incidents and coverage changes. Set remediation deadlines and proportionate rights to suspend data access.

This proposed condition combines the annual assurance model with service-specific oversight. Registration or a historical submission alone should not satisfy it. Published status does not expose all supporting evidence or prove that every processing purpose is lawful. SRC-056, SRC-081

An improvement plan or an undertaking to submit later does not satisfy this proposed pre-receipt threshold. If an exception is proposed, the purchaser must decide and document its contractual treatment. It cannot waive an applicable statutory duty or another organisation's access conditions.

Organisation type depends on services, contracts and other reasons for assessment. Operating software does not automatically make an organisation an “IT Supplier” for DSPT. Parent assessments can cover other sites only where their services and activities are included. Confirm the actual coverage and current category before fixing the contract schedule. SRC-082

DSPT and DTAC answer different questions

DSPT concerns the organisation and its assessed processing. DTAC assesses an in-scope digital health product. NHS England's DTAC guidance identifies when DSPT applies and removes overlapping questions. A DSPT return does not satisfy the whole DTAC data-protection assessment. NHS-origin data alone also does not determine whether a product is in DTAC's scope. See product and information-standard assessment. SRC-054, SRC-055

Expanding the commercial summary

The user-supplied Motics article highlights NHS information, annual assessment and public status checks. It is a secondary research prompt, not authority for this wiki's conclusions. Its shorthand needs these qualifications. SRC-086

Proposition in the article	Qualified reading for this wiki
Handling NHS data activates DSPT	Identify the patient information, access route and governing requirements. Do not treat the slogan as a statutory scope test. SRC-056, SRC-080
Private clinics without NHS flows do not need DSPT	Check all applicable triggers, including regulatory status and contracts. Private funding is not itself an exemption. SRC-061, SRC-081
DSPT is an annual self-assessment against NDG standards	Include the current CAF arrangements and category-specific audit requirements. SRC-087, SRC-093, SRC-094
An older entry means assurance has lapsed	Compare the assessment period with the applicable deadline and required submission; calendar age alone is insufficient. SRC-093
A public result establishes the vendor's position	Match the entity, then verify actual service coverage and supporting evidence. Public status is not a universal compliance certificate. SRC-056, SRC-082, SRC-088