DSPT 2026-27 · Standard 5: Process Reviews
When data protection or cyber security problems are found, are the fixes tracked and reported to senior management?
Why it matters for your practice
When you identify a problem with a data security process, the fix should be tracked and reported to the partners or senior management. This could be through regular team meeting agendas, a simple action log, or briefing notes. The key is that someone senior is overseeing that issues get resolved.
Is it mandatory?
No. 5.2.1 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 5.2: Action is taken to address problem processes as a result of feedback at meetings or in year
Following identification of data protection or cyber security failures, are the actions to address problem processes, being monitored and assurance given to the senior team?
If relevant, confirm that your organisation has taken action to address the issues and that your governance arrangements escalated issues and findings to the management team or board or equivalent.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.