DSPT 2026-27 · GP practices

What changed in the DSPT for 2026-27

NHS England published version 9 of the Data Security and Protection Toolkit on 2 October 2026. For GP practices (Category 4), there are 4 new evidence items and 5 items with updated wording or guidance. Here is each one in plain English, grouped by standard.

Standard 1: Personal Confidential Data

1.1.2UpdatedMandatory

Do you keep an up-to-date Information Asset Register (IAR) and Record of Processing Activities (ROPA), and review them regularly?

What changed: Question wording and tooltip updated

This is a list of all the personal data your practice holds, where it's stored, and who you share it with. Think patient records in EMIS or SystmOne, staff HR files, payroll data, prescriptions, referral letters, etc. You can combine the IAR and ROPA into one document. It needs to have been reviewed by your management team in the last 12 months.

Official wording (NHS England)

Does your organisation maintain an up to date information asset register (IAR) and a record of processing activities (ROPA) and review this regularly?

Read the full guide to 1.1.2
1.1.3UpdatedMandatory

Do you have an up-to-date privacy notice that clearly explains how you use patient and staff data?

What changed: Question wording and tooltip updated

Your privacy notice explains to patients and staff what personal data you collect and why, how long you keep it, who you share it with, how you keep it secure, and their rights. Most GP practices display this on their premises and on their website. You may need separate notices for patients and staff.

Official wording (NHS England)

Does your organisation maintain an up-to-date privacy notice that clearly explains how information is used?

Read the full guide to 1.1.3
1.3.15New for 2026-27Optional

If staff or locums take devices that can access patient data, NHSmail or NHS systems abroad, do you manage and record the security risks?

What changed: New evidence item for cat 4

Think about laptops, phones or tablets that can reach your clinical system or NHSmail. A simple policy is enough: staff tell the practice before travelling with such a device, it must be encrypted and protected by multi-factor authentication, they avoid public or hotel Wi-Fi without a VPN, and they don't access HSCN-connected systems from outside the UK without your ICB's approval. Ask your IT supplier whether your remote access allows overseas connections. If nobody accesses patient data from outside the UK, answer 'Yes' and note 'Not applicable'.

Official wording (NHS England)

Where staff or contractors take devices (with access to identifiable patient/service user information, NHSmail, or NHS systems) outside the UK, are the associated security risks formally managed and documented by you (or the issuing) organisation?

Read the full guide to 1.3.15
1.4.3UpdatedOptional

How does your practice securely destroy records and equipment containing personal data or other data needed to deliver care?

What changed: Question wording and tooltip updated

When you dispose of old patient records, computers, phones, USB sticks, or paper documents, you need to do it securely. This typically means: cross-cut shredding for paper, using a certified destruction company for hard drives/equipment, and wiping devices before disposal. Describe your process, or say 'Not applicable' if you use a third party for all destruction.

Official wording (NHS England)

If your organisation destroys any records or equipment that hold personal data or other data important to the delivery of care, how does it make sure that this is done securely?

Read the full guide to 1.4.3

Standard 6: Responding to Incidents

6.1.3UpdatedMandatory

If you've had a data breach, did you assess the risk to the people affected and tell them where the risk was high?

What changed: Question wording and tooltip updated

For every breach, consider how badly it could affect the people involved. If the risk is high — for example, their medical records were sent to the wrong person, or the data could be used for identity fraud — you must tell them without undue delay. If you've had no such breaches in the last 12 months, answer 'Yes' and note 'Not applicable'.

Official wording (NHS England)

If your organisation has had a data breach, did you consider the risk to affected individuals and inform them where the risk was high?

Read the full guide to 6.1.3

Standard 7: Continuity Planning

7.1.2UpdatedMandatory

Does your business continuity plan cover IT failures and cyber attacks, and is it regularly reviewed and tested?

What changed: Question wording and tooltip updated

Your business continuity plan should cover scenarios like: What if the internet goes down? What if you're hit by ransomware? What if there's a power cut? What if a computer breaks? What if the building is inaccessible? It should include who to contact, how to continue seeing patients, and your data protection obligations during an incident. Relevant staff should know the plan, and you should review and test it regularly.

Official wording (NHS England)

Does your organisation ensure its business continuity plan covers data and cyber security, and that it is regularly reviewed and tested?

Read the full guide to 7.1.2
7.1.7New for 2026-27Optional

Have you tested or rehearsed your business continuity plan for a data or cyber incident in the last 12 months?

What changed: New evidence item for cat 4

This doesn't need to be a full simulation. A tabletop walkthrough counts — sit down as a team and talk through what you'd do if you couldn't access EMIS or SystmOne or NHSmail was down. The NCSC's free Exercise in a Box also counts. Record the date, who took part, what you discussed and any actions that came out of it, and put a summary in the comments.

Official wording (NHS England)

Has your organisation tested or exercised its business continuity plan for a data or cyber incident within the last 12 months?

Read the full guide to 7.1.7

Standard 10: Accountable Suppliers

10.2.6New for 2026-27Optional

Do you make sure non-IT suppliers working on your premises (cleaners, contractors, other organisations renting space) can't access patient information they shouldn't?

What changed: New evidence item for cat 4

Cleaners, maintenance contractors, back-office services and other organisations sharing your building may pass through areas where records or screens are visible. Check their policies on handling data, make sure your contracts limit any access to the purposes you've authorised, and keep them away from unsupervised access to areas where patient records are stored — for example by locking records rooms and screens. Describe your arrangements in the comments.

Official wording (NHS England)

Does your organisation have appropriate information security policies and assurance in place to ensure that non-IT suppliers (for example, cleaning/facilities staff, contractors, HR or other back-office staff, or organisations renting space) do not have inappropriate access to information when working on your premises. Including controls over access to both physical and digital records, systems and sensitive areas. Where access to information is given, non-IT suppliers should have a contractual obligation to only use it for the purposes authorised by you.

Read the full guide to 10.2.6
10.2.7New for 2026-27Optional

If you or your suppliers process patient data outside the UK, have you risk-assessed it and put the right governance in place?

What changed: New evidence item for cat 4

This includes suppliers whose systems or support teams are based overseas, such as some cloud, transcription or AI tools. If that applies, you should have a Data Protection Impact Assessment (DPIA) covering the international transfer, an appropriate transfer mechanism in your contract, and your privacy notice should tell patients if data goes outside the UK. Ask suppliers where data is stored and accessed from. If no patient data is processed outside the UK, answer 'Yes' and note 'Not applicable'.

Official wording (NHS England)

If you or your suppliers process identifiable patient/ service user information outside the UK, have you appropriately risk-assessed the processing, and put relevant governance in place?

Read the full guide to 10.2.7

Get ready for the 2026-27 DSPT

Answer each question in plain English, see your traffic-light status by standard and know exactly what's left before 30 June. Free forever plan, no card needed.

Start your free assessment

Want the full list? See every DSPT standard and evidence item.

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.