DSPT 2026-27 · Standard 1: Personal Confidential Data

Evidence item 1.4.1Mandatory

Do you have a records retention schedule that sets out how long you keep different types of records?

Why it matters for your practice

You need a document that says how long you keep different types of records — patient records, staff records, financial records, etc. This should be based on the NHS Records Management Code of Practice 2021, which sets the minimum retention period for each type of record.

Is it mandatory?

Yes. GP practices must meet 1.4.1 to reach "Standards Met" in the 2026-27 DSPT.

Official wording from NHS England

Assertion 1.4: Records are maintained appropriately

Does your organisation have a timetable which sets out how long you retain records for?

Your organisation should have a retention timetable in place for all the different types of records that it holds, including finance, staffing and care records. The timetable, or schedule as it is sometimes called, should be based on the Records Management Code of Practice 2021 (https://transform.england.nhs.uk/information-governance/guidance/records-management-code).

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

ClinicShield templates that help

  • Records Retention Schedule

Ready-to-edit templates are included in paid plans.

Track 1.4.1 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.