DSPT 2026-27 · Standard 1: Personal Confidential Data
Do you carry out regular checks that staff are following your data protection policies?
Why it matters for your practice
At least once a year, you should do spot checks to make sure staff are following your data protection policies. For example: Are computers locked when unattended? Are paper records stored securely? Are emails being sent to the right people? Keep a record of these checks and any actions taken.
Is it mandatory?
Yes. GP practices must meet 1.3.2 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 1.3: Accountability and Governance in place for data protection and data security
Does your organisation monitor your own compliance with data protection policies and regularly review the effectiveness of data handling and security controls?
Your organisation should carry out spot checks that staff are doing what it says in your data protection, staff confidentiality and related policies. These should be undertaken at least every year. They could be part of other audits that you carry out. You should keep a record that spot checks have been carried out, including details of any actions, who has approved the actions, and who is taking them forward if applicable. There is an example audit checklist that you can download from Digital Care Hub (https://www.digitalcarehub.co.uk/resource/data-security-audit-checklist/).
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Clear Desk & Clear Screen Policy
Ready-to-edit templates are included in paid plans.