DSPT 2026-27 · Standard 3: Training
Have at least 95% of your staff completed data security training in the last 12 months?
Why it matters for your practice
Everyone with access to personal data — GPs, nurses, healthcare assistants, receptionists, admin staff, cleaners with building access — needs to complete data security training annually. The target is 95% (allowing for maternity leave, long-term sick, etc.). The free NHS Data Security Awareness e-learning course at e-LfH counts. Keep a log of who has completed training and when.
Is it mandatory?
Yes. GP practices must meet 3.2.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 3.2: Your organisation engages proactively and widely to improve data security, and has an open and just culture for data security incidents
Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?
All people in your organisation with access to personal data must complete appropriate data security and protection, and cyber security, training every year. Your organisation's training needs analysis should identify the level of training or awareness raising that people need, and you should use a range of training and awareness methods to reach all staff effectively. There is an understanding that due to illness, maternity/paternity leave, attrition or other reasons it might not be possible for 100% of people to receive training every year. Therefore, the target is 95% of people with access to personal data. For clarity, it is the last twelve months prior to the date of publication.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Training Record Log
Ready-to-edit templates are included in paid plans.