DSPT 2026-27 · Standard 1: Personal Confidential Data

Evidence item 1.2.4Mandatory

Is your practice compliant with the national data opt-out policy?

Why it matters for your practice

Since July 2022, all CQC-registered organisations must comply with the national data opt-out. This means patients can choose to stop their confidential data being used for research and planning. If you share data for those purposes, the supplier of EMIS or SystmOne can help you check it against opt-outs, but you need to make sure your policies and privacy notice mention it, and that staff know about it.

Is it mandatory?

Yes. GP practices must meet 1.2.4 to reach "Standards Met" in the 2026-27 DSPT.

Official wording from NHS England

Assertion 1.2: Individuals' rights are respected and supported

Is your organisation compliant with the national data opt-out policy?

The national data opt-out gives everyone the ability to stop health and social care organisations from sharing their confidential information for research and planning purposes, with some exceptions such as where there is a legal mandate/direction or an overriding public interest for example to help manage the covid-19 pandemic. As a provider, you should help the people who use your services to understand that they can opt out of their data being used for other purposes. You should check that your policies, procedures, and privacy notice cover the opt out. From July 2022, it is a legal requirement for all health and social care CQC registered organisations to be compliant with the national data opt out. More detailed guidance that gives advice about compliance with the national data opt-out policy is available from NHS England (https://digital.nhs.uk/services/national-data-opt-out-programme/compliance-with-the-national-data-opt-out) and Digital Care Hub (https://www.digitalcarehub.co.uk/data-security-protecting-my-information/national-data-opt-out).

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

ClinicShield templates that help

  • Privacy Notice
  • Data Protection Policy

Ready-to-edit templates are included in paid plans.

Track 1.2.4 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.