DSPT 2026-27 · Standard 9: IT Protection
Are all laptops, tablets, and removable devices (USB sticks, etc.) that could access patient data encrypted?
Why it matters for your practice
Any portable device that holds or can access personal data must be encrypted. For Windows laptops, this means BitLocker should be enabled. For tablets, check that device encryption is turned on. Ideally, also disable USB ports or restrict removable media use. If you don't use any portable devices, you can mark this as 'Not applicable'.
Is it mandatory?
Yes. GP practices must meet 9.5.2 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 9.5: You securely configure the network and information systems that support the delivery of essential services
Are all laptops and tablets or removable devices that hold or allow access to personal data, encrypted?
Mobile computers like laptops and tablets and removable devices like memory sticks/cards/CDs are vulnerable as they can be lost or stolen. To make these devices especially difficult to get into, they can be encrypted (this protects information by converting it into unreadable code that cannot be deciphered easily by unauthorised people). Devices can be further protected, for example, by preventing the use of removable devices like memory sticks. This is called computer port control. You may need to ask your IT supplier to assist with answering this question. If your organisation does not use any mobile devices, or equivalent security arrangements are in place, then tick and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Information Security Policy
- Acceptable Use Policy
Ready-to-edit templates are included in paid plans.