DSPT 2026-27 · Standard 4: Managing Data Access
Do you have a reliable process for removing IT access when staff leave or change roles?
Why it matters for your practice
When someone leaves your practice or changes role, you need to promptly remove or update their access to EMIS or SystmOne, NHS email, shared drives, and any other IT systems. This includes shared email accounts and NHSmail shared mailboxes. Have a checklist for leavers that includes IT access removal.
Is it mandatory?
Yes. GP practices must meet 4.2.4 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 4.2: The organisation assures good management and maintenance of identity and access control for its networks and information systems
Does your organisation have a reliable way of removing or amending people's access to IT systems when they leave or change roles?
When people change roles or leave your organisation, there needs to be a reliable way to amend or remove their access to your IT system(s). This could be by periodic audit to make sure that people's access rights are at the right level. It is important that leavers who had access to personal data have their access rights revoked in line with your policies and procedures. This includes access to shared email addresses.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Starters & Leavers Checklist
Ready-to-edit templates are included in paid plans.