DSPT 2026-27 · Standard 5: Process Reviews
If you've had a data or cyber security breach or near miss in the last year, have you reviewed what went wrong and fixed the process?
Why it matters for your practice
If your practice has had any data or cyber incidents — a misdirected referral, an email sent to the wrong person, a lost USB stick, a phishing attack — you should have reviewed the process that allowed it to happen and taken steps to prevent it recurring. Also look for workarounds staff use that put data at risk, like forwarding emails to personal accounts. If you've had no incidents, answer 'Yes' and note 'Not applicable' in comments. It's good practice to review processes annually regardless.
Is it mandatory?
Yes. GP practices must meet 5.1.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 5.1: Process reviews are held at least once per year where data security is put at risk following data security incidents
If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?
If relevant, confirm that your organisation has reviewed any processes that have caused a breach or a near miss, or which force people to use unauthorised workarounds that could compromise your organisation's data and cyber security. Workarounds could be things such as using unauthorised devices such as home computers or personal memory sticks or forwarding emails to personal email addresses. It is good practice to review processes annually even if a breach or near miss has not taken place. If no breaches or near misses in the last 12 months, then please tick and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Incident Response Plan
Ready-to-edit templates are included in paid plans.