NHS DSPT Compliance — Data Security and Protection Toolkit Support
The Data Security and Protection Toolkit (DSPT) is the annual self-assessment every organisation with access to NHS patient data or systems must complete — from GP practices, care homes and pharmacies to the software and IT suppliers that serve them. Results are published, and NHS buyers check them before awarding contracts.
For trusts and other larger organisations the toolkit is now aligned to the NCSC Cyber Assessment Framework. Mutex Systems helps you gather evidence, close gaps and reach “Standards Met” before the annual 30 June deadline.
- Category
- Compliance Framework
- Jurisdiction
- United Kingdom
- Issuing Body
- NHS England
- Current Version
- Annual toolkit; CAF-aligned version for NHS trusts and other in-scope organisations from 2024/25
- Who It's For
- NHS trusts and ICBs, primary care, social care providers, and technology suppliers processing NHS data.
Core Domains
A Practical Compliance Path
- 01
Toolkit review
Identify which DSPT version applies and review last year’s submission.
- 02
Evidence gathering
Collect and organise evidence for each assertion or CAF outcome.
- 03
Gap remediation
Fix technical and policy gaps — patching, MFA, backups, training.
- 04
Submission
Final review and submission before 30 June, with an improvement plan if needed.
Evidence once, reused every year
We organise DSPT evidence so it is mostly refreshed rather than rebuilt each year, and reuse ISO 27001 and Cyber Essentials evidence where it applies.
- DSPT-to-ISO 27001 and Cyber Essentials mapping
- Technical checks for patching, MFA and backups
- Support for the independent audit where required
Related Pages
DSPT evidence in one place
grComply tracks DSPT assertions or CAF outcomes, links evidence and owners, and reminds you before the 30 June deadline — with evidence reused from ISO 27001 and Cyber Essentials.
- DSPT and CAF outcomes as a framework
- Evidence expiry and deadline reminders
- Cross-mapping to ISO 27001 and Cyber Essentials
- Board summary of status
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About NHS DSPT
Who needs to complete the DSPT?
Any organisation with access to NHS patient data and systems, including NHS bodies, GP practices, care providers and IT or software suppliers that process NHS data.
When is the DSPT deadline?
The annual submission deadline is 30 June.
What is the CAF-aligned DSPT?
From 2024/25, NHS trusts and other larger organisations complete a version of the toolkit based on the NCSC Cyber Assessment Framework, assessed against outcomes rather than simple yes/no assertions.
What does “Standards Met” mean?
It means the organisation has provided evidence for all mandatory requirements. Lower statuses (such as “Approaching Standards”) usually need an improvement plan.
Ready to Start Your NHS DSPT Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.