The DSPT and the ten data security standards

The Data Security and Protection Toolkit, usually just called the DSPT, is an online self-assessment that health and care organisations complete every year. It is linked to the NHS and measures performance against the National Data Guardian's ten data security standards. NHS organisations must complete it, and care providers are strongly expected to: a satisfactory DSPT publication is required for access to NHS systems such as NHSmail and shared care records, is asked about by commissioners, and is part of showing regulators like CQC that data is handled properly.

For most staff, the DSPT shows up as the things it requires: annual training, policies, access reviews, and questions about how data flows through the service. Knowing the shape of the ten standards helps you see why those things exist. In outline, they group into three themes.

People

• 1. Confidential data is handled properly, in line with the Caldicott Principles, and only shared lawfully and appropriately.
• 2. All staff understand their personal responsibility for data security and confidentiality.
• 3. All staff complete appropriate annual data security training.

Process

• 4. Access to confidential data is controlled: people only have the access their role needs, and access is reviewed, with logins removed when people leave.
• 5. Processes are reviewed and improved when incidents or near misses reveal weaknesses.
• 6. Incidents, including cyber attacks, are identified, resisted and reported quickly, with lessons learned.
• 7. There is a continuity plan, so care can continue if systems fail or data is unavailable, and the plan is tested.

Technology

• 8. Unsupported, out-of-date systems are not used, or are isolated and managed until replaced.
• 9. IT is protected by an up-to-date strategy against threats such as ransomware, based on a recognised framework such as Cyber Essentials.
• 10. IT suppliers are held accountable for data security through contracts.

You are not expected to fill in the DSPT yourself unless that is your role. You are expected to do the things that make its answers true: complete your training, guard your login, and report problems quickly.