DSPT 2026-27 · Standard 4: Managing Data Access
Have your IT administrators (including external IT support companies) signed agreements holding them to higher data security standards?
Why it matters for your practice
Anyone who has admin-level access to your IT systems — whether internal staff or your external IT support company — should have signed a formal agreement about their higher data security responsibilities. This could be in their job description, contract, or a separate agreement. If you use an external IT company, check that their contract covers this.
Is it mandatory?
Yes. GP practices must meet 4.3.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 4.3: All staff understand that their activities on IT systems will be monitored and recorded for security purposes
Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?
The people within your organisation who are IT system administrators may have access to more information than other staff. Therefore, they need to be held accountable in a formal way to higher standards of confidentiality than others. This requirement applies to IT system administrators working in external companies who support your organisation's IT systems This formal agreement could be part of a job description or a contract with your IT support company and/or systems supplier/s. If your organisation does not use any IT systems, then 'tick' and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Staff Confidentiality Agreement
Ready-to-edit templates are included in paid plans.