DSPT 2026-27 · Standard 1: Personal Confidential Data

Evidence item 1.1.1Mandatory

What is your ICO registration number?

Why it matters for your practice

Every practice that handles patient data must be registered with the ICO. You can find your registration number on the ICO website. If you're not registered, you need to do this urgently as it's a legal requirement.

Is it mandatory?

Yes. GP practices must meet 1.1.1 to reach "Standards Met" in the 2026-27 DSPT.

Official wording from NHS England

Assertion 1.1: The organisation has a framework in place to support Lawfulness, Fairness and Transparency

What is your organisation's Information Commissioner's Office (ICO) registration number?

Registration with the ICO is a legal requirement for every organisation that uses or shares personal information, unless they are exempt as a small charity. If your organisation is not already registered, you should register as a matter of urgency (https://ico.org.uk/for-organisations/data-protection-fee). You can check whether you are registered and what your ICO registration number is on the Information Commissioner's Office website (https://ico.org.uk/esdwebpages/search).

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

Track 1.1.1 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.