Pass your DSPT submission with compliance support built for healthcare organisations

What makes DSPT v8 different

The Data Security and Protection Toolkit has been the NHS’s primary data security assurance mechanism since it replaced the Information Governance Toolkit in April 2018. Version 8 represents a real step change. It covers the 2025-26 toolkit year — NHS England published its outcomes, assertions and evidence items on 18 September 2025 — and it brings healthcare data security requirements closer to the rigour expected of financial services regulation.

The toolkit runs on a fixed annual cycle. Every toolkit year has its own version, and the self-assessment has to be completed and published by 30 June. That date has moved exactly once: NHSX pushed the 2019-20 deadline back to 30 September 2020 in response to COVID-19. Everything else about the cycle is predictable, which is why the organisations that fare best treat each 30 June as the end of a year-round process rather than the start of one.

The key shift is from compliance as documentation to compliance as operational discipline. DSPT v8 does not just ask whether you have policies — it asks whether a named senior officer actively owns your security approach, whether you can evidence regular security discussions at leadership level, and whether your incident detection and response capabilities are genuinely effective.

That makes version 8 much harder to satisfy with a documentation exercise assembled in the weeks before the deadline, and much easier to satisfy where security is already part of how the organisation runs day to day. Our industry IT support makes compliance operational rather than aspirational.

All 10 National Data Guardian standards, evidenced

The DSPT maps to the National Data Guardian’s 10 data security standards. Each standard has specific assertions that your organisation must evidence:

Leadership and Culture — A named senior officer must own data security. Staff must receive annual data security awareness training. Security must be discussed regularly at leadership level, not relegated to an IT function.

Data Security Processes — Access to patient data must follow the principle of least privilege. Role-based access controls must be implemented and reviewed. Data sharing must be lawful, appropriate, and documented.

Technology Controls — Firewalls, malware protection, secure configuration, patch management, and encryption must be in place. Multi-factor authentication is mandatory for remote access and privileged accounts. Backups must be encrypted, tested, and stored securely.

Incident Management — You must be able to detect, respond to, and report security incidents. Near-miss reporting must be encouraged. Lessons learned must feed back into your security improvement programme.

Cyber Essentials Plus alongside your DSPT

NHS Supply Chain’s adoption of Procurement Policy Note 014 has added a parallel compliance requirement. Cyber Essentials Plus certification is now mandatory for suppliers who handle personal data or deliver IT and digital services to the NHS.

The five Cyber Essentials controls — firewalls, secure configuration, access control, malware protection, and software updates — overlap significantly with DSPT technical requirements. But achieving CE+ does not exempt you from DSPT, and vice versa. Both must be completed separately.

The April 2026 update to Cyber Essentials (v3.3) adds further considerations for organisations planning certification, including mandatory MFA across all cloud services. We can prepare the technical work for both pathways and coordinate Cyber Essentials assessment with an approved certification body, reducing duplicated effort while your healthcare and certification advisers retain responsibility for scope and approval.

What the Synnovis attack on London pathology showed

The Synnovis ransomware attack in June 2024 was the most significant cyber attack on NHS infrastructure in recent years. A pathology services provider serving multiple London NHS trusts was compromised, disrupting laboratory services for months. Thousands of patient appointments were cancelled. Blood test results were delayed. Clinical decision-making was impacted.

DSPT v8 increases supply chain security requirements directly in response to incidents like Synnovis. Your organisation must now demonstrate that you assess the data security practices of your suppliers and that your incident response plans account for supply chain disruptions.

This is not theoretical risk. It happened in London, to NHS services, within the last two years.

DSPT-ready IT without the June scramble

We build DSPT readiness into how we run your infrastructure, rather than treating it as a separate project bolted onto it:

Your digital asset register is maintained automatically through our endpoint management and monitoring platform. MFA is deployed and enforced as standard. Patch management follows a documented cycle. Backups are encrypted, tested, and stored in geographically separated locations. Access controls follow least-privilege principles and are reviewed quarterly.

When your annual DSPT submission is due, the evidence already exists because it is a natural output of properly managed IT. We compile the submission, identify any gaps requiring attention, and coordinate the process with your Data Protection Officer or senior information risk owner.

For healthcare organisations, that turns data security into an operational reality rather than an annual panic — and we provide the infrastructure, the cybersecurity expertise, and the ongoing management to keep it that way.

Who we do this for: private healthcare providers and clinic groups, pathology and diagnostic laboratories and dental practices.