DSPT 2026-27 · GP practices
The DSPT, in plain English
The NHS Data Security and Protection Toolkit (DSPT) 2026-27 asks GP practices 49 evidence questions across 10 data security standards. 29 of them are mandatory. Pick any item to see what it really means for your practice and the official wording.
What changed for 2026-27 (9 items)Standard 1: Personal Confidential Data
Confidentiality, Caldicott principles, lawful basis for processing
- 1.1.1What is your ICO registration number?Mandatory
- 1.1.2Do you keep an up-to-date Information Asset Register (IAR) and Record of Processing Activities (ROPA), and review them regularly?Mandatory
- 1.1.3Do you have an up-to-date privacy notice that clearly explains how you use patient and staff data?Mandatory
- 1.1.5Who is responsible for data security in your practice, and how has this been formally assigned?Mandatory
- 1.1.6Have you reviewed how your practice asks for and records patient consent to share personal data?Optional
- 1.2.4Is your practice compliant with the national data opt-out policy?Mandatory
- 1.3.1Does your practice have up-to-date data protection and cyber security policies that follow national guidance?Mandatory
- 1.3.2Do you carry out regular checks that staff are following your data protection policies?Mandatory
- 1.3.6What are your practice's top 3 data and cyber security risks, and what are you doing about them?Optional
- 1.3.8Does your data protection policy cover how you assess risks when starting new projects that involve personal data (DPIA process)?Optional
- 1.3.13What physical security measures does your practice have to prevent unauthorised access to personal data?Mandatory
- 1.3.15If staff or locums take devices that can access patient data, NHSmail or NHS systems abroad, do you manage and record the security risks?Optional
- 1.4.1Do you have a records retention schedule that sets out how long you keep different types of records?Mandatory
- 1.4.3How does your practice securely destroy records and equipment containing personal data or other data needed to deliver care?Optional
Standard 2: Staff Responsibilities
Contracts, confidentiality agreements, role-based responsibilities
Standard 3: Training
Annual IG/data security training, completion records
Standard 4: Managing Data Access
Role-based access, authentication, least privilege
- 4.1.1Do you have an up-to-date list of all staff and their roles?Mandatory
- 4.2.4Do you have a reliable process for removing IT access when staff leave or change roles?Mandatory
- 4.3.1Have your IT administrators (including external IT support companies) signed agreements holding them to higher data security standards?Mandatory
- 4.4.1Are IT administrator activities on your systems being logged, with logs only accessible to appropriate people?Optional
- 4.5.3Is multi-factor authentication (MFA) enabled on all systems that can be accessed remotely?Mandatory
Standard 5: Process Reviews
Data flow mapping, DPIA, lawful basis register
Standard 6: Responding to Incidents
Breach reporting, incident response plan, ICO notification
- 6.1.1Does your practice have a system for staff to report data breaches and near misses?Mandatory
- 6.1.2If you've had a data breach, was the management team notified and did they approve an action plan?Optional
- 6.1.3If you've had a data breach, did you assess the risk to the people affected and tell them where the risk was high?Mandatory
- 6.2.1Do all computers and devices in your practice have up-to-date antivirus software?Mandatory
- 6.3.5Have you had any repeat data security incidents in the last 12 months?Optional
Standard 7: Continuity Planning
Business continuity, disaster recovery, backup testing
- 7.1.1Do you have an up-to-date list of all hardware and software used in your practice?Mandatory
- 7.1.2Does your business continuity plan cover IT failures and cyber attacks, and is it regularly reviewed and tested?Mandatory
- 7.1.5Does your asset register prioritise items by importance and list their dependencies (power, internet, etc.)?Optional
- 7.1.6Do you manage your hardware, software, and data assets throughout their lifecycle — from purchase to disposal?Optional
- 7.1.7Have you tested or rehearsed your business continuity plan for a data or cyber incident in the last 12 months?Optional
- 7.3.2Do you keep an up-to-date list of emergency contacts somewhere separate from your computers, like a printed copy?Mandatory
- 7.3.4Do you have working backups of all important data, and have you tested that they can be restored?Mandatory
Standard 8: Unsupported Systems
Patch management, end-of-life systems, upgrade plans
- 8.1.4Are all your IT systems and software still supported by the manufacturer, or are any risks from unsupported systems being managed?Optional
- 8.2.1If you're using unsupported software, do you have a document explaining the risks and what you're doing about it?Optional
- 8.3.1How does your practice ensure software updates and security patches are installed promptly?Mandatory
- 8.3.8Is your practice registered for the NCSC Early Warning service?Optional
- 8.4.3Do you regularly test for and identify security vulnerabilities in your IT systems?Optional
Standard 9: IT Protection
Firewalls, encryption, anti-malware, network security
- 9.1.1Have all default passwords on your network equipment (routers, Wi-Fi, switches) been changed?Mandatory
- 9.2.1Has your practice had an annual IT penetration test that was properly scoped with senior management?Optional
- 9.5.2Are all laptops, tablets, and removable devices (USB sticks, etc.) that could access patient data encrypted?Mandatory
Standard 10: Accountable Suppliers
Supplier contracts, DPAs, third-party assurance
- 10.1.2Do you have a list of all suppliers that handle personal data on your behalf?Mandatory
- 10.2.1Have you checked that your IT system suppliers have robust cyber security arrangements?Mandatory
- 10.2.2Are your contracts with third parties that handle personal data compliant with GDPR Article 28 (data processing agreements)?Optional
- 10.2.6Do you make sure non-IT suppliers working on your premises (cleaners, contractors, other organisations renting space) can't access patient information they shouldn't?Optional
- 10.2.7If you or your suppliers process patient data outside the UK, have you risk-assessed it and put the right governance in place?Optional
Track every DSPT item in one place
Answer each question in plain English, see your traffic-light status by standard and know exactly what's left before 30 June. Free forever plan, no card needed.
Start your free assessmentOfficial wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.