DSPT 2026-27 · Standard 1: Personal Confidential Data
If staff or locums take devices that can access patient data, NHSmail or NHS systems abroad, do you manage and record the security risks?
Why it matters for your practice
Think about laptops, phones or tablets that can reach your clinical system or NHSmail. A simple policy is enough: staff tell the practice before travelling with such a device, it must be encrypted and protected by multi-factor authentication, they avoid public or hotel Wi-Fi without a VPN, and they don't access HSCN-connected systems from outside the UK without your ICB's approval. Ask your IT supplier whether your remote access allows overseas connections. If nobody accesses patient data from outside the UK, answer 'Yes' and note 'Not applicable'.
Is it mandatory?
No. 1.3.15 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
What changed since 2025-26
New evidence item for cat 4. See all 2026-27 changes.
Official wording from NHS England
Assertion 1.3: Accountability and Governance in place for data protection and data security
Where staff or contractors take devices (with access to identifiable patient/service user information, NHSmail, or NHS systems) outside the UK, are the associated security risks formally managed and documented by you (or the issuing) organisation?
A proportionate policy for a small practice might include: requiring staff to notify the principal before travelling with a device that has access to patient data; confirming that any such device is encrypted and protected by MFA; advising staff not to access clinical systems or NHSmail over public or hotel Wi-Fi without a VPN; and specifying that HSCN-connected applications should not be accessed from outside the UK without prior authorisation from your ICB. If a locum or contractor uses their own device abroad to access your systems, the same considerations apply. Your IT supplier can advise on whether your current remote access configuration permits or restricts overseas connections. If your organisation/suppliers do not process identifiable patient/service user information outside of the UK, then tick and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Information Security Policy
- Acceptable Use Policy
Ready-to-edit templates are included in paid plans.