# DSPT: NHS data assurance **Under NHS policy, organisations that process NHS patient information must complete and publish an annual Data Security and Protection Toolkit (DSPT) assessment.** This includes processing for purposes beyond individual care. An organisation using an NHS system must also meet the DSPT conditions attached to that access. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) The receiving organisation completes the assessment and supplies supporting evidence. The purchaser checks the supplier's assurance and applies the contract's conditions. The sending healthcare provider retains its own disclosure decision. DSPT does not replace the [UK GDPR framework](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) or [confidentiality authority](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md). [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098) **For the MOD recruitment example, the commissioner should require satisfactory DSPT assurance before the contractor first receives identifiable NHS GP records or reports.** The recommended contract makes that requirement binding and maintains it throughout processing. The [recruitment example](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) distinguishes this proposed condition from existing duties. ## Why DSPT is central when NHS information is involved DSPT brings organisational security and information governance into one assurance process. The CAF-aligned approach combines cyber-resilience outcomes with health and care requirements for data protection and confidentiality. CAF means the National Cyber Security Centre's Cyber Assessment Framework. NHS England expressly states that DSPT covers only part of an organisation's legal and regulatory obligations. [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087) The practical distinction is **lawful processing and demonstrable assurance**. A lawful basis does not prove that the service's controls are adequate. A satisfactory DSPT assessment does not supply a lawful basis, authorise a new use or grant unrestricted NHS-system access. The organisation remains responsible for both lawful processing and the required assurance. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055), [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087) ## What makes DSPT mandatory? The policy requirement applies to organisations processing NHS patient information. Statutory duties depend on the information standard's scope. Contractual duties bind the parties to the relevant contract or access arrangement. The following table identifies each source of obligation. | Basis | What it establishes | Limit | |---|---|---| | DHSC policy | Organisations processing NHS patient information must provide DSPT assurance under DHSC policy, for any processing purpose. | Policy supports the requirement; it is not itself proof of a statutory penalty against every recipient. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) | | DAPB0086 and section 250 | The published information standard states that persons subject to it must comply where it is relevant. | Match the entity, activity and applicable release to the statutory categories and standard's addressees. NHS origin alone does not complete that analysis. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) | | Existing contract or access terms | A binding DSPT clause creates an obligation for its parties within its scope. | An NHS Standard Contract term does not automatically enter a contract with another government department. [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) | | New commissioning condition | The purchaser can specify DSPT evidence and continuing obligations in the service contract. | This is the recommended route to make the requirement explicit; it is not a claim about terms already agreed. | | UK GDPR | Security, accountability and, where a processor is used, sufficient guarantees and prescribed terms are legal duties. | Articles 28 and 32 do not name DSPT. DSPT can support assurance, but neither proves all legal duties are met. [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) | The DAPB0086 version 8 notice was published on 12 August 2025. It is later than the 7 July 2025 transition discussed in [information standards](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md#information-standards-the-current-statutory-framework). Do not apply the saving for older standards indiscriminately to this release. Equally, do not infer coverage of an unidentified recruitment contractor without assessing its functions and the standard. [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) Section 250 requires specified addressees within eligible categories. For a private contractor, examine any required regulated-provider registration or relevant IT-provider role and the service's connection with health or adult social care. A purpose beyond individual care does not itself decide that statutory test. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046) The **2026/27 NHS Standard Contract, General Condition 21.2**, expressly requires an annual published DSPT assessment and compliance with applicable mandatory requirements. GC21.6 addresses audit where applicable. These are concrete contractual provisions, but their existence does not prove incorporation into a non-NHS procurement. The [recommended condition below](#recommended-contract-condition) must be agreed in the contract that actually governs the service. [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096) ## Requirements before contract award and access **NHS supplier guidance places the purchaser's check of the supplier's latest published DSPT status before contract award.** It does not set a universal deadline for a fresh assessment before procurement begins. The receiving organisation remains responsible for its assessment and for meeting any earlier contract or access deadline. [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107), [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) | Stage | Responsible organisation and action | Basis | |---|---|---| | Procurement planning | The purchaser should specify the acceptable status, covered service, evidence and deadlines in the procurement documents. | Recommended implementation of the [contract condition](#recommended-contract-condition). | | Before contract award | The purchaser checks the supplier's latest published DSPT status and considers the assurance evidence proportionate to the service risk. | NHS supplier guidance. [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107) | | Before first receipt or system access | The receiving organisation must satisfy any DSPT condition that the governing contract or access terms require at that stage. The named acceptance owner checks that evidence. | Actual contract or system-access arrangement; the proposed MOD condition requires satisfactory status before receipt. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) | | Each assessment year | The assessed organisation completes and publishes its annual return by the applicable deadline, with any required audit. | Annual DSPT requirements and any additional contractual milestones. [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) | The annual deadline does not postpone an earlier contractual or access condition. Conversely, the opening of a new assessment year does not automatically invalidate the previous published return. | Information or service | Consequence for DSPT | |---|---| | Identifiable records or reports received directly from NHS GPs | The recipient processes NHS patient information and is within the stated DHSC policy. A live NHS connection is not necessary. | | NHSmail, shared NHS records or another NHS system | The organisation seeking access is responsible for satisfying the system's assurance conditions and permitted-purpose rules. | | NHS-commissioned service | The provider must meet the DSPT terms in the actual contract. GC21.2 applies where the NHS Standard Contract governs the service. | | Privately owned or privately funded service | NHS information, system access, contractual terms and regulatory status determine the relevant requirements. Private ownership is not an exemption. | | Service with no NHS information or system access | These two policy/access triggers are absent. Other contracts, regulatory requirements and general data-protection law may still apply. | These distinctions follow the registered policy, contract and scope guidance. Information-standard duties require an eligible addressee and relevant activity. Some independent providers also have duties as designated operators of essential services. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-061](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-061), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096) ### NHS-origin records outside NHS commissioning **The commissioner should include an explicit, continuing DSPT condition in a contract for a service receiving identifiable NHS GP information.** Under the recommended condition, the contractor must provide satisfactory assurance before receipt and maintain it throughout processing. This procurement recommendation is grounded in NHS policy and the purchaser's need for demonstrable safeguards. It does not assume that the NHS Standard Contract already binds the contractor. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) The requester should supply its DSPT evidence as part of [readiness for receiving records](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md). It must govern its own processing even where the source provider states no conditions. DSPT supports assurance; it does not replace a required DPIA, role-specific agreement or appropriate policy document. [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018), [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103) The source controller should identify its disclosure requirements. This does not establish that every GP must refuse every authorised disclosure to a recipient without DSPT. Individual authority for a report also does not replace the recipient's Article 6 basis and Article 9 condition. The requester must limit collection to its justified purpose. GMC guidance normally favours relevant information over the whole record for employment and similar reports. [SRC-067](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-067), [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083) ## What the annual assessment covers DSPT is broader than a security badge. Its requirements address organisational arrangements and evidence, with different assessment structures for different categories. The 2026–27 version 9 notice aligns requirements with CAF 4.0. Specified CAF cohorts use outcomes and indicators; other categories use assertions and evidence items. The assessed organisation must use the current requirements for its category. [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) Some categories have independent audit requirements. The 2026–27 audit notice specifies separate mandatory areas for CAF organisations and IT suppliers. A published DSPT submission is not necessarily independently certified, and audit duties differ between categories. [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) ## Verify a published DSPT claim The purchaser checks the assessed organisation in the [official organisation search](https://www.dsptoolkit.nhs.uk/OrganisationSearch), using its name or Organisation Data Service (ODS) code. The receiving organisation supplies the supporting scope and audit evidence. The public record shows the assessment period, publication date and status; it does not expose that supporting evidence. [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088), [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) | Purchaser's question | Evidence supplied by the receiving organisation | |---|---| | Does the assessment belong to the organisation receiving the data? | Legal entity, registered organisation name and ODS code, including the relationship to any trading or group name. | | Is the published assessment acceptable for the required date? | Assessment year, publication date and status, compared with the annual deadline and any earlier contractual milestone. | | Does the assessment cover the contracted service? | Included systems, locations and participating organisations, with any exclusions or separate subcontractor assessments. | | Has the organisation met the audit requirements for its category? | Organisation category, required audit, findings and improvement actions, supplied through a controlled route where necessary. | | Who keeps the assurance current? | Named owner, renewal date, changes requiring review, and contractual reporting and remediation arrangements. | A published assessment is not necessarily a **Standards Met** assessment. Its displayed status must be considered separately from the fact of publication. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) These are recommended due-diligence records. A parent entry is useful only where its assessment covers the relevant services and activities. A public status is an initial check, not evidence that every group company or subcontractor is covered. [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) The requester maintains this evidence and supplies it to the provider or purchaser where the relevant terms require it. The recommended acceptance record names the purchaser's decision owner, the evidence reviewed, the service covered and any unresolved actions. The provider makes its separate disclosure decision; the purchaser's acceptance does not authorise every use of the information. ### Current assessment period As checked on **19 October 2026**, the operational cycle is **2026–27 version 9**, with a published submission deadline of **30 June 2027**. An earlier contractual milestone or required interim submission remains applicable. Opening this cycle does not itself prove that an assessment for the previous period has lapsed. [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) The DAPB0086 information-standard page still lists version 8. Its notice, scope and assurance dates are distinct from the operational version 9 materials. [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080), [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) ## Recommended contract condition The following is a **proposed mandatory contract condition**, not a quotation of legislation or an existing agreement. The purchaser should include it in the procurement specification and binding security/data schedules. The contract should name the purchaser's acceptance owner and enforcement rights. 1. **Before receipt:** the contractor must hold published DSPT **Standards Met** or **Standards Exceeded** status for the applicable assessment period before it receives identifiable NHS patient information. 2. **Coverage:** the contractor must identify the legal entities, relevant subcontractors and processing covered. It must supply evidence that the assessment covers the contracted service. A parent or prime contractor's entry alone does not establish coverage of every participant. 3. **Maintenance:** the contractor must renew annually by the applicable deadlines, use the correct organisation category and complete any required independent audit. It must reassess coverage when the service or supply chain changes. 4. **Evidence and remedies:** the purchaser must have agreed rights to inspect relevant assurance evidence. The contractor must promptly report lost status, material security incidents and coverage changes. The contract must set remediation deadlines and proportionate rights to suspend data access. This proposed condition combines the annual assurance model with service-specific oversight. Registration or a historical submission alone should not satisfy it. Published status does not expose all supporting evidence or prove that every processing purpose is lawful. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) An improvement plan or an undertaking to submit later does not satisfy this proposed pre-receipt threshold. If an exception is proposed, the purchaser must decide and document its contractual treatment. It cannot waive an applicable statutory duty or another organisation's access conditions. NHS supplier guidance also describes an equal-or-higher assurance route for its supplier check. That route does not automatically override an express DSPT contract term or system-access condition. [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107) Organisation type depends on services, contracts and other reasons for assessment. Operating software does not automatically make an organisation an “IT Supplier” for DSPT. Parent assessments can cover other sites only where their services and activities are included. The purchaser and contractor should settle the coverage and current category when agreeing the contract schedule. [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082) ## DSPT and DTAC answer different questions DSPT concerns the organisation and its assessed processing. DTAC assesses an in-scope digital health product. NHS England's DTAC guidance identifies when DSPT applies and removes overlapping questions. A DSPT return does not satisfy the whole DTAC data-protection assessment. NHS-origin data alone also does not determine whether a product is in DTAC's scope. See [product and information-standard assessment](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md). [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054), [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055) ## Expanding the commercial summary The user-supplied Motics article highlights NHS information, annual assessment and public status checks. It is a secondary research prompt, not authority for this wiki's conclusions. Its shorthand needs these qualifications. [SRC-086](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-086) | Proposition in the article | Qualified reading for this wiki | |---|---| | Handling NHS data activates DSPT | NHS policy covers patient information; access conditions and statutory duties have their own scope. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) | | Private clinics without NHS flows do not need DSPT | Regulatory status and contracts may add requirements. Private funding is not itself an exemption. [SRC-061](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-061), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) | | DSPT is an annual self-assessment against NDG standards | Current requirements include CAF arrangements for specified cohorts and category-specific audits. [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087), [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) | | An older entry means assurance has lapsed | The assessment period and required submission deadline determine relevance; calendar age alone is insufficient. [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) | | A public result establishes the vendor's position | The purchaser checks the entity, service coverage and supporting evidence. Public status is not a universal compliance certificate. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088) | **Related:** [Overview](https://healthcare-data-management-wiki.pages.dev/index.md) · [Applicability map](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) · [Operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) · [Evidence matrix](https://healthcare-data-management-wiki.pages.dev/evidence-matrix/index.md) · [Validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md)