DSPT 2026-27 · Standard 10: Accountable Suppliers

Evidence item 10.1.2Mandatory

Do you have a list of all suppliers that handle personal data on your behalf?

Why it matters for your practice

List all external companies that handle personal data for your practice: the supplier of EMIS or SystmOne, your IT support company, payroll provider, occupational health service, DBS checking service, shredding company, cloud storage providers, etc. Include what service they provide and their contact details. Digital Care Hub has a template.

Is it mandatory?

Yes. GP practices must meet 10.1.2 to reach "Standards Met" in the 2026-27 DSPT.

Official wording from NHS England

Assertion 10.1: The organisation can name its suppliers, the products and services they deliver and the contract durations

Does your organisation have a list of its suppliers that handle personal information, the products and services they deliver, and their contact details?

Your organisation should have a list or lists of the external suppliers that handle personal information such as IT or care planning systems suppliers, IT support, accountancy, DBS checks, HR and payroll services, showing the system or services provided. If you have no such suppliers, then 'tick' and write "Not applicable" in the comments box. A template example is available from Digital Care Hub (https://www.digitalcarehub.co.uk/resource/template-suppliers-list/).

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

ClinicShield templates that help

  • Supplier Register

Ready-to-edit templates are included in paid plans.

Track 10.1.2 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.