Data Security and Protection Toolkit (DSPT)
Also known as: DSPT, Data Security Protection Toolkit
The Data Security and Protection Toolkit (DSPT) is an online self-assessment that health and adult social care organisations in England complete each year to demonstrate they are handling personal and sensitive data safely and meeting the National Data Guardian’s ten data-security standards.
The Data Security and Protection Toolkit (DSPT) is an annual online self-assessment published by NHS England. It lets health and adult social care organisations measure and publish their data-security and information-governance arrangements against the National Data Guardian’s ten data-security standards. Completing the DSPT is expected of care providers that handle NHS or personal data and is increasingly required in commissioning.
The National Data Guardian’s ten standards
The DSPT is structured around ten data-security standards grouped under three themes — people, process and technology — covering areas such as personal responsibility, staff training, access control, business continuity and managing IT suppliers. Providers confirm the evidence they hold against each standard.
DSPT versus Cyber Essentials
The DSPT is a broad information-governance and data-security self-assessment specific to health and care. Cyber Essentials (and Cyber Essentials Plus) is a separate government-backed certification focused specifically on technical controls that protect against common cyber attacks. They are complementary: the DSPT covers governance and data handling, while Cyber Essentials verifies technical defences, and achieving Cyber Essentials can help evidence parts of the DSPT.
Frequently asked questions
What is the Data Security and Protection Toolkit?
The DSPT is an annual online self-assessment that health and adult social care organisations in England complete to show they handle personal and sensitive data safely and meet the National Data Guardian’s ten data-security standards.
Who needs to complete the DSPT?
Health and adult social care organisations that handle NHS or personal data are expected to complete the DSPT each year. It is increasingly required as part of commissioning and contracts.
Is the DSPT the same as Cyber Essentials?
No. The DSPT is a broad data-security and information-governance self-assessment for health and care, while Cyber Essentials is a certification focused on technical cyber controls. They complement each other.
Related guides
Sources
- NHS England — Data Security and Protection Toolkit
- Digital Care Hub — DSPT, Cyber Essentials and Cyber Essentials Plus
Evidence this standard with MyCareAudit
Digital audits, action tracking and inspection-ready reports that help you demonstrate data security and protection toolkit (dspt) and every other CQC and Ofsted expectation.