The DSPT, made simple
Working with NHS data means a toolkit submission every year. AI drafts your answers and policies from everything it knows about your organisation. You review, approve and publish.
The Data Security and Protection Toolkit (DSPT) is how organisations that work with the NHS show they look after patient data properly. Meeting the standards is often a condition of an NHS contract.
- data security standards
- 10
- assessment to publish by 30 June each year
- 1
- place for all your evidence
- 1
How it works
From first answer to annual submission
Add your organisation
Tell us who you are and how you work with NHS data, and upload any policies you already have so we can build on them.
Add your people and systems
Include staff, devices, systems and suppliers, so your answers reflect how you actually work.
Answer the assertions
AI drafts an answer to each evidence item from what you’ve captured. You review, amend and confirm.
Gather your evidence
AI drafts the policies the toolkit asks for, and keeps them alongside training records and the answers they support.
Publish and stay compliant
Publish your assessment on the toolkit by 30 June, then keep everything current so next year starts where you left off.
Everything,
in one place
Your existing documents
Upload what you have. We compare it against each evidence item and flag conflicts and gaps.
Every evidence item
Questions covering all 10 data security standards, with AI-drafted answers you check and confirm.
Policy pack
Data protection, information governance and security policies, written by AI for your organisation, with versioning and approval.
Staff training records
The toolkit asks you to show your staff understand data security. See who has completed training, and when.
Asset and supplier registers
The devices, systems and suppliers that handle NHS data, with the details the toolkit asks for.
Year-round compliance
Incidents, reviews and policy sign-offs, with evidence attached, so your next submission is a check rather than a scramble.
Common questions
- What is the DSPT?
- The Data Security and Protection Toolkit is an online self-assessment run by NHS England. It measures how well you meet the National Data Guardian’s 10 data security standards, and you publish a new assessment every year.
- Who has to complete it?
- Any organisation with access to NHS patient data and systems. That includes GP practices, pharmacies, dentists, care providers and suppliers to the NHS.
- Which version do we complete?
- It depends on your organisation type. NHS trusts, integrated care boards and some national bodies complete a version aligned to the NCSC Cyber Assessment Framework. Most others, including GP practices, pharmacies, dentists, care providers and IT suppliers, answer assertions built around the 10 standards.
- Does ComplySmart submit it for me?
- No. You publish your assessment yourself on the DSPT website. We get your answers and evidence ready, so that part is quick.
Get submission-ready
and stay that way.
The DSPT is coming to ComplySmart. Book a call with our sales manager to hear what’s planned and get early access.
Book a call with our sales manager(opens in a new tab)