What is the DSPT?

The Data Security and Protection Toolkit (DSPT) is an annual self-assessment published by NHS England. Every organisation that handles NHS patient data — including CQC-registered adult social care providers — must complete it by 30 June each year.

There are two possible outcomes: Standards Met and Approaching Standards. Only Standards Met means your submission is complete. Anything less and your organisation may be considered non-compliant — with real consequences for NHS contracts, CQC relationships, and your data security obligations.

Why it matters for your organisation

The DSPT is not a box-ticking exercise. It is the mechanism by which NHS England verifies that care providers handling patient data are meeting the 10 National Data Guardian standards. Achieving Standards Met signals to NHS commissioners, ICBs, and local authorities that your organisation takes data security seriously.

Practically speaking, the stakes are significant:

NHS contracts — many NHS-funded contracts now require Standards Met as a condition of award or renewal
CQC inspections — inspectors increasingly reference DSPT status when assessing Well-Led and Safe domains
ICO and regulatory risk — Approaching Standards is a documented gap that could be cited in the event of a data breach
Data sharing agreements — shared care records, digital social care records (DSCR), and integrated care system participation often require Standards Met
Staff and family confidence — demonstrating that your organisation meets national standards builds trust with the people you support and their families

Category 3 organisations — the category that covers most adult social care providers — must complete 42 mandatory evidence items across the 10 standards. That is a significant body of work. Most providers who sit at Approaching Standards year after year are not failing to care about data security — they simply don’t have the capacity or expertise to complete the assessment properly.

The Programme

£1,950 + VAT

A structured, hands-on programme designed to take adult social care providers from wherever they are now to a confident Standards Met submission. Fixed fee — no surprises.

What’s included

Gap analysis — a detailed review of your current position against all 42 mandatory evidence items, identifying exactly what’s in place, what’s missing, and what needs updating
Evidence mapping — we work through each of the 10 standards together, matching your existing policies and practices to the evidence requirements
Policy and documentation support — tailored templates and guidance to fill your evidence gaps, written to reflect how your organisation actually works
Toolkit navigation — step-by-step support completing the DSPT portal, so you understand what you’re submitting and why
Pre-submission review — I review your completed assessment before you publish it, flagging any risks or gaps that need addressing
30-day post-submission support — included as standard, so you’re covered if queries arise after submission

What’s not included

This programme covers the consultancy and documentation work to achieve Standards Met. It does not include technical IT infrastructure changes (such as new hardware or software licensing), legal advice, or costs associated with the DSPT portal itself (which is free to use).

Who it’s for

CQC-registered adult social care providers in England — care homes, domiciliary care organisations, and supported living services — who need to achieve or maintain Standards Met. Particularly valuable for providers who have previously sat at Approaching Standards, who are new to the DSPT, or who are preparing for NHS contract renewals or CQC inspection.

Get started

Timeline

Most organisations can reach Standards Met in 8–10 weeks with focused support. To submit comfortably before the 30 June deadline, the programme works best when started by mid-April.

Week 1–2 — Kickoff, gap analysis, and evidence mapping across all 42 items
Weeks 3–6 — Working through the 10 standards: documentation, policy review, and evidence completion
Weeks 7–8 — DSPT portal completion, internal sign-off, and pre-submission review
Week 8–10 — Submission and 30-day post-submission support window

If your deadline is tight or you have a specific contract requirement driving urgency, get in touch and we’ll assess whether an accelerated approach is feasible.

Common questions

We’ve never completed the DSPT before — is that a problem?

No. In some ways it’s easier to start fresh than to unpick years of partially completed submissions. The gap analysis at the start of the programme will establish exactly where you are and build from there.

We’ve been submitting at Approaching Standards for years — can you help?

Yes — this is the most common situation. Approaching Standards typically means there are a handful of evidence items that haven’t been completed or documented correctly. The gap analysis will identify them quickly and the rest of the programme focuses on closing those specific gaps.

Do we need to involve our IT provider?

Possibly, for a small number of technical evidence items. Most of the 42 evidence items for Category 3 providers relate to policies, training, and data governance rather than infrastructure. Where IT input is needed, I’ll tell you exactly what to ask for and why.

What happens after the submission?

The 30-day post-submission support window is included in the programme fee. Beyond that, many clients choose to engage on an ongoing basis to maintain their DSPT position year-on-year — updating policies, preparing for the next cycle, and keeping pace with changes to the toolkit. We can discuss what that looks like once we’ve completed the initial programme.

DSPT Standards Met Programme