DSPT 2026-27 · Standard 6: Responding to Incidents

Evidence item 6.1.2Optional

If you've had a data breach, was the management team notified and did they approve an action plan?

Why it matters for your practice

If a data breach occurred, the partners or your practice manager should have been informed and should have signed off on actions to prevent it happening again. If you've had no breaches in the last 12 months, answer 'Yes' and note 'Not applicable'.

Is it mandatory?

No. 6.1.2 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.

Official wording from NHS England

Assertion 6.1: A confidential system for reporting data security and protection breaches and near misses is in place and actively used

If your organisation has had a data breach, were the management team notified, and did they approve the actions planned to minimise the risk of a recurrence?

In the event of a data breach the management team of your organisation, or nominated person, should be notified of the breach and any associated action plans or lessons learnt. If no breaches have occurred in the last 12 months then please tick and write "Not applicable" in the comments box.

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

ClinicShield templates that help

  • Incident Response Plan

Ready-to-edit templates are included in paid plans.

Track 6.1.2 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.