DSPT 2026-27 · Standard 4: Managing Data Access
Are IT administrator activities on your systems being logged, with logs only accessible to appropriate people?
Why it matters for your practice
Your IT support company or internal IT admin should have their activities logged when they access your systems. These logs should only be viewable by authorised people. Ask your IT support provider whether they log admin activities on your systems. If you don't use IT systems, mark as 'Not applicable'.
Is it mandatory?
No. 4.4.1 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 4.4: You closely manage privileged user access to networks and information systems supporting the essential service
The person with responsibility for IT confirms that IT administrator activities are logged and those logs are only accessible to appropriate personnel.
IT Support staff typically have high level access to systems. The identities of these people should be known and managed, and their activities on your systems should be logged and only available to appropriate personnel. If your organisation does not use any IT systems, then 'tick' and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.