DSPT 2026-27 · Standard 2: Staff Responsibilities
Do new staff, locums, and volunteers receive a data security induction when they join?
Why it matters for your practice
When new people join your practice — including GPs, nurses, healthcare assistants, receptionists, admin staff, locums, cleaners and volunteers — they should receive an induction covering data protection and cyber security basics. Keep a record of who's been inducted and when. Digital Care Hub offers a free online training course you can use.
Is it mandatory?
Yes. GP practices must meet 2.1.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 2.1: Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards
Does your organisation have an induction process that covers data security and protection, and cyber security?
All new staff, directors, trustees and volunteers who have access to personal data, should have an induction that covers data security and protection as well as cyber security. It is good practice to keep records of who has been inducted and to review the induction process on a regular basis to ensure it is effective and up to date. Digital Care Hub provides a free Data Security and Protection elearning training course (https://www.digitalcarehub.co.uk/elearning) that organisations can use as part of their staff induction.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Starters & Leavers Checklist
- Training Record Log
Ready-to-edit templates are included in paid plans.