DSPT 2026-27 · Standard 1: Personal Confidential Data
What are your practice's top 3 data and cyber security risks, and what are you doing about them?
Why it matters for your practice
Think about your biggest vulnerabilities. Common risks for GP practices include: staff clicking phishing emails, unsupported software (e.g. old Windows versions), no business continuity plan, weak passwords, lack of encryption on portable devices, or insufficient staff training. Name your top 3 and briefly say what you're doing to address each one.
Is it mandatory?
No. 1.3.6 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 1.3: Accountability and Governance in place for data protection and data security
What are the top three data and cyber security risks in your organisation and how does it plan to reduce those risks?
All organisations have risks and should be able to identify what they are. Thinking about your responses to all of the questions in the toolkit, consider which three areas carry the most risk for your organisation. Provide a brief headline for each risk and say what your organisation plans to do to reduce that risk. Your risk conclusions should be communicated to accountable senior individuals.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.