DSPT 2026-27 · Standard 1: Personal Confidential Data
What physical security measures does your practice have to prevent unauthorised access to personal data?
Why it matters for your practice
Describe how you physically protect patient data. For most GP practices this typically includes: locked filing cabinets for paper records, key-coded or badge-access doors to clinical areas, a clear desk policy, lockable server room/cupboard, secure disposal bins for confidential waste. If you have multiple sites, cover all of them.
Is it mandatory?
Yes. GP practices must meet 1.3.13 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 1.3: Accountability and Governance in place for data protection and data security
Briefly describe the physical controls your buildings have that prevent unauthorised access to personal data.
Physical controls that support data protection include lockable doors, windows and cupboards, clear desk procedure, security badges, key coded locks to access secure areas etc. Provide details at high level and, if you use more than one building, summarise how compliance is assured across your organisation's sites.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Clear Desk & Clear Screen Policy
Ready-to-edit templates are included in paid plans.