DSPT 2026-27 · Standard 6: Responding to Incidents
If you've had a data breach, did you assess the risk to the people affected and tell them where the risk was high?
Why it matters for your practice
For every breach, consider how badly it could affect the people involved. If the risk is high — for example, their medical records were sent to the wrong person, or the data could be used for identity fraud — you must tell them without undue delay. If you've had no such breaches in the last 12 months, answer 'Yes' and note 'Not applicable'.
Is it mandatory?
Yes. GP practices must meet 6.1.3 to reach "Standards Met" in the 2026-27 DSPT.
What changed since 2025-26
Question wording and tooltip updated. See all 2026-27 changes.
Official wording from NHS England
Assertion 6.1: A confidential system for reporting data security and protection breaches and near misses is in place and actively used
If your organisation has had a data breach, did you consider the risk to affected individuals and inform them where the risk was high?
If your organisation has had a data breach that is likely to result in a high risk of adversely affecting individuals' rights and freedoms - you must inform the individual(s) without undue delay. For example, if information breached could allow criminals to commit identity fraud, or if individuals affected are at risk of being targeted by people with malicious intent. If your organisation has had no such breaches in the last 12 months then please tick and write "Not applicable" in the comments box. More information is available from the Information Commissioner's Office (https://ico.org.uk/for-organisations/report-a-breach).
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Incident Response Plan
Ready-to-edit templates are included in paid plans.