DSPT 2026-27 · Standard 2: Staff Responsibilities
Do all staff contracts and volunteer agreements include data security responsibilities?
Why it matters for your practice
Check your employment contracts — they should mention data security, not just confidentiality. This means covering the confidentiality, integrity and availability of data. If your contracts only mention confidentiality, they need updating. This applies to all staff, locums, and any volunteers.
Is it mandatory?
Yes. GP practices must meet 2.2.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 2.2: Staff contracts set out responsibilities for data security
Do all employment contracts, and volunteer agreements, contain data security requirements?
Clauses in contracts or agreements should reference data security (confidentiality, integrity and availability). Many contracts commonly focus on just confidentiality. Your organisation's staff employment contracts, and volunteer and trustee agreements if you have them, should be reviewed to see if they need to be updated to include a clause on data security.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Staff Confidentiality Agreement
Ready-to-edit templates are included in paid plans.