DSPT 2026-27 · Standard 7: Continuity Planning

Evidence item 7.1.2MandatoryUpdated for 2026-27

Does your business continuity plan cover IT failures and cyber attacks, and is it regularly reviewed and tested?

Why it matters for your practice

Your business continuity plan should cover scenarios like: What if the internet goes down? What if you're hit by ransomware? What if there's a power cut? What if a computer breaks? What if the building is inaccessible? It should include who to contact, how to continue seeing patients, and your data protection obligations during an incident. Relevant staff should know the plan, and you should review and test it regularly.

Is it mandatory?

Yes. GP practices must meet 7.1.2 to reach "Standards Met" in the 2026-27 DSPT.

What changed since 2025-26

Question wording and tooltip updated. See all 2026-27 changes.

Official wording from NHS England

Assertion 7.1: Organisations have a defined, planned and communicated response to data security incidents that impact sensitive information or key operational services

Does your organisation ensure its business continuity plan covers data and cyber security, and that it is regularly reviewed and tested?

Your organisation's business continuity plan should cover data and cyber security - for example what would you do to ensure continuity of service if: you had a power cut; the phone line/internet went down; you were hacked; a computer broke down; the office became unavailable (for example through fire). Your plan should include communications with other organisations and your data protection obligations. Your plan should be understood by relevant staff and other stakeholders. An example business continuity plan is available from Digital Care Hub (https://www.digitalcarehub.co.uk/resource/creating-and-testing-a-business-continuity-plan-for-data-and-cyber-security/)

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

ClinicShield templates that help

  • Business Continuity Plan

Ready-to-edit templates are included in paid plans.

Track 7.1.2 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.