DSPT 2026-27 · Standard 10: Accountable Suppliers
Are your contracts with third parties that handle personal data compliant with GDPR Article 28 (data processing agreements)?
Why it matters for your practice
Any contract with a supplier that handles personal data on your behalf should include a Data Processing Agreement (DPA) that complies with GDPR Article 28. This covers things like: what data they process, how they protect it, what happens if there's a breach, and what happens when the contract ends. Review your key supplier contracts to check this is in place.
Is it mandatory?
No. 10.2.2 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 10.2: Basic due diligence has been undertaken against each supplier that handles personal information
Contracts with all third parties that handle personal information are compliant with ICO guidance.
A review of all contracts has been undertaken to ensure that they comply with the requirements set out in Article 28 of the GDPR and have completed a Data Security and Protection Toolkit. If you have no such suppliers, then 'tick' and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Supplier Register
Ready-to-edit templates are included in paid plans.