DSPT 2026-27 · Standard 6: Responding to Incidents
Does your practice have a system for staff to report data breaches and near misses?
Why it matters for your practice
You need a clear process for staff to report data breaches (e.g. patient records sent to the wrong person) and near misses (e.g. an unlocked computer found unattended). All staff should know how to report these. The DSPT toolkit has a built-in incident reporting tool for reporting to the ICO. Digital Care Hub has free staff guidance you can share.
Is it mandatory?
Yes. GP practices must meet 6.1.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 6.1: A confidential system for reporting data security and protection breaches and near misses is in place and actively used
Does your organisation have a system in place to report data breaches?
All staff, and volunteers if you have them, are responsible for noticing and reporting data breaches and it is vital that you have a robust reporting system in your organisation. There is an incident reporting tool within this toolkit which should be used to report health and care incidents to Information Commissioner's Office ICO. If you are not sure whether or not to inform the Information Commissioner's Office of a breach, the toolkit's incident reporting tool and guide can help you to decide. Digital Care Hub has Staff Guidance on Data Breaches (https://www.digitalcarehub.co.uk/resource/staff-guidance-on-data-breaches).
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Incident Response Plan
Ready-to-edit templates are included in paid plans.