The Data Security and Protection Toolkit for Independent Providers: Where to Start

The Data Security and Protection Toolkit for Independent Providers: Where to Start

The Data Security and Protection Toolkit is the mandatory annual self-assessment that organisations with access to NHS patient data or systems must complete to demonstrate they meet the required data security standards. Commissioners will ask for your latest DSPT status during procurement, and an expired or incomplete assessment can pause contract award while you scramble to bring it up to date.

This is not a light-touch tick-box exercise. The 2026 version of the toolkit contains around 130 evidence items across ten standards, and independent providers routinely underestimate both the time required and the gaps in their existing policies.

Who must complete the DSPT

If you hold or process NHS patient data, or connect to NHS systems such as NHSmail or the N3 network, you need a published DSPT assessment. That includes care homes registered with the CQC that record care notes, domiciliary care providers integrated with local authority health pathways, clinical support services touching patient records, and software suppliers whose applications run in NHS environments.

The scope test is functional, not contractual. Even if your contract does not explicitly name the DSPT, if the work requires you to see identifiable patient data or use NHS infrastructure, commissioners expect you to have completed the assessment. Under the Provider Selection Regime that governs direct NHS awards, a current DSPT status is now a standard exclusion ground for health and care services.

Most commissioners will check the published DSPT register during the selection stage. If your organisation is not listed, or the status shows as incomplete or expired, evaluators flag it as a compliance issue before they read your submission. Fixing this mid-procurement is difficult because the assessment window and publication dates are centrally controlled.

How to scope the assessment

Start by confirming which legal entity is bidding. The DSPT is registered to a specific organisation, typically identified by an ODS code if you are an NHS provider or by other central identifiers if you are a private or voluntary organisation. If you work through multiple trading entities or a group structure, decide which one holds the data processing responsibility and ensure that entity is named in both the DSPT account and the contract documentation.

Next, map the actual data flows and access points. The toolkit asks you to document what data you hold, where it is stored, who can access it, and how it moves between systems and organisations. Many independent providers operate across sites or subcontract clinical staff, and the DSPT expects you to describe those arrangements clearly. If you use cloud-based care management software or share records with GP surgeries through interoperability platforms, those connections count as data flows and require documented security assurance.

The scope also covers corporate data, not just clinical records. Staff email, HR records and finance systems do not require the same NHS-specific protections, but they still form part of your information governance baseline. The DSPT will ask about backup procedures, incident response, password policies and access controls for all business-critical systems.

The evidence that tends to be missing

Three areas consistently trip up independent providers during their first DSPT cycle.

The first is staff training records. The toolkit requires you to prove that all staff with access to patient data or NHS systems have completed data security awareness training within the past twelve months. This must be logged and auditable. A general induction session is not enough. The DSPT expects role-specific training for clinical staff, administrators and IT support, with records showing completion dates and content covered.

The second is data flow mapping. Evaluators expect a visual diagram or structured table showing every system that holds or processes patient data, the legal basis for that processing, where data enters and leaves your organisation, and which third parties have access. Most independent providers know what software they use but have never drawn the full picture. If you integrate with local authority social care systems, share data with hospitals, or send invoices that include patient identifiers, those flows need to be documented and risk-assessed.

The third is supplier assurance. If you use third-party software, cloud hosting or outsourced IT support, the DSPT holds you accountable for their security standards. You need written contracts with data processing clauses, evidence that the supplier has appropriate security certifications or DSPT status, and a process for monitoring their ongoing compliance. Independent providers often discover they have no formal contract with a long-standing IT consultant or that their care management software provider has never been asked for security documentation.

Avoiding the late scramble before contract start

The most common mistake is treating the DSPT as a procurement document rather than a compliance obligation. Providers often start the assessment only when a tender specification lists it as a requirement, by which point the evidence gaps cannot be closed quickly.

A worked example illustrates the timeline. A domiciliary care provider wins a place on a local health framework in early 2026. The call-off requires a current DSPT status. The provider begins the assessment in late spring and realises their data flow map is incomplete, their mandatory training records were never centralised, and they have no formal agreement with their scheduling software supplier. Gathering the missing evidence, updating policies, rolling out training to 50 care staff and securing supplier letters takes three months. The original call-off start date is missed, and the commissioner awards the work elsewhere.

Independent providers should aim to complete their DSPT assessment early in the annual window. The submission typically opens in the spring and closes in summer, but published dates vary and you should confirm the current schedule on the official DSPT portal. Start gathering evidence at least three months before you plan to submit. That gives you time to identify gaps, commission third-party documentation, and run training sessions without delaying live tenders.

If you are bidding regularly on NHS work, particularly under frameworks such as RM6291 NHS P23, the DSPT should be maintained continuously rather than rushed each year. Treat it as part of your operational compliance baseline, not a one-off procurement hurdle. Assign internal ownership to a named manager, schedule quarterly evidence reviews, and keep your policies and training logs current.

How DSPT status affects procurement evaluation

Commissioners use DSPT status in two ways. The first is as a pass or fail exclusion ground. If the procurement requires patient data access and your DSPT is not current, you may be disqualified at the selection stage. Evaluators do not score an incomplete DSPT as a weakness. They treat it as non-compliance and remove your bid from the process.

The second use is as a quality signal within scored questions. Even when DSPT is not a formal requirement, evaluators often look for evidence that you understand information governance standards. If you reference your DSPT compliance, describe your data security training programme, or explain your supplier assurance process in response to quality method statements, that adds credibility to your answer. Conversely, if your response to a data protection question is generic or policy-heavy with no operational detail, evaluators will notice the gap, particularly if they cross-reference your DSPT entry and find it incomplete.

Under the Provider Selection Regime, which governs most direct NHS awards as of 2026, a current DSPT is an objective minimum standard. If you cannot demonstrate compliance, the contracting authority cannot lawfully award you the work. There is no discretion or waiver process at evaluation stage.

Frequently asked questions

Can we start a contract while our DSPT assessment is in progress?

Most commissioners will not allow contract mobilisation until your DSPT status shows as published and current. Even if the formal contract signature happens earlier, access to NHS systems and patient data will be blocked until the assessment is complete. Starting work without a current DSPT exposes both you and the commissioner to regulatory and reputational risk. Plan to have your DSPT finalised before the intended go-live date, not after.

Do we need a separate DSPT for each NHS contract?

No. The DSPT is organisation-wide, not contract-specific. Once your assessment is published, it applies to all NHS work you undertake during that annual cycle. However, you must ensure the scope of your DSPT covers all the data types and systems used across your contracts. If you win new work that introduces different data flows or third-party suppliers, you may need to update your assessment mid-cycle to reflect the changed processing environment.

What happens if we fail a DSPT standard?

The toolkit allows you to submit an assessment with improvement plans for standards you do not yet meet, but this will show as an incomplete status on the public register. Some commissioners will accept an improvement plan if the gaps are minor and you can demonstrate progress. Others, particularly for high-value clinical services, require all mandatory standards to be met. Your best course is to address the gaps before submission rather than rely on evaluator discretion. If you have failed a standard, document what has been fixed since the last cycle and provide evidence timelines.

Call 020 3668 5488

Glaxtons, 3 More London Place, London SE1 2RE