DSP Toolkit 2025: A complete guide to achieving ‘standards met’ for health and care organisations

The Data Security and Protection Toolkit (DSPT) is a mandatory online self-assessment and compliance framework for any organisation that processes or accesses NHS health and care data. The toolkit helps demonstrate that your organisation meets the National Data Guardian’s 10 Data Security Standards and complies with UK data protection and cybersecurity requirements.

Successful completion of the assessment provides assurances that highly sensitive personal health and care data is being handled by organisations in line with the minimum standard of current security guidelines.

In this blog, we are going to identify the organisations that are required to undertake the assessment, and then provide an overview of how the DSPT assessment is structured. In doing so, we will pull out the most relevant pieces of information that your business needs to be aware of before undertaking the assessment and provide guidance to get started on the road to certification. 

Who needs to complete the DSPT self-assessment?

The most important thing to be aware of is that getting DSPT certified is mandatory for any health and care provider, or organisation processing, storing, or transferring health and care data, or wishing to access NHS services.

Is DSPT compliance mandatory for my organisation in 2025?

You must complete the DSPT if your organisation:

• Processes or stores health and care data

• Accesses NHS systems, such as NHSmail or the NHS e-referral service

• Provides services under an NHS contract

• Intends to work within the UK health and social care sector

From 2024/25, organisations that do not submit their DSPT may face contractual restrictions and access limitations to NHS systems.

Benefits of the DSP Toolkit

Other than being mandatory, the DSP Toolkit brings a number of benefits. Firstly, the toolkit has been developed by the NHS in consultation with health and care organisations and therefore is uniquely adapted to take account of your business’ operating context within the UK healthcare sector.  

The standard is not simply about meeting minimum requirements but provides a roadmap for organisations towards continuous improvement of their security posture. Hence the toolkit identifies non-mandatory security items that organisations should consider in order to continue to improve their overall security policies, procedures and controls. 

As an organisation, by aligning with security best-practice guidelines, you are mitigating the risk of a data breach or information security incident that could lead to significant damages, both financially and to your reputation.  

Finally, as with obtaining any recognised security standard, you are demonstrating to your clients, supply chain, staff and other key stakeholders that you take information security seriously, that you are handling data safely and legally, and you are a trusted partner.  

Why DSPT matters in 2025

Beyond mandatory compliance, achieving “Standards Met” status offers strategic advantages:

• Builds trust with patients, partners, and NHS stakeholders

• Demonstrates a commitment to data security and GDPR compliance

• Reduces cyber risk through alignment with recognised best practice

• Supports contract eligibility with NHS and health-sector partners

• Aligns with broader frameworks like Cyber Essentials and DSPT-aligned IG Toolkits

DSPT 2025 structure – update to the latest terminology.

Note: As of 2025, organisations are encouraged to renew DSPT annually to maintain access to NHS services and contracts.

When do I need to submit my assessment?

The current DSPT submission window is for the 2024/25 reporting period, and the deadline for submission is 30 June 2025.

Submitting after this deadline may result in disruption to NHS system access or funding issues.

How is the DSPT structured?

The DPST is split into 3 levels referred to as “Approaching Standards”, “Standards Met” and “Standards Exceeded” (see figure 1). It is important to note that organisations are only required to achieve “Standards Met” to pass the assessment.  

“Approaching Standards” applies to social care organisations that are on their way but haven’t yet met the “Standards Met” requirements. Organisations must evidence 27 mandatory items and present a development plan detailing how they will achieve the remaining mandatory items.  

To meet “Standards Met”, organisations must evidence all mandatory evidence items such as having a formalised security policy and implementing training and awareness programmes. Evidence items are grouped under 4 security headings: 

• Staffing and Roles 
• Policies and Procedures 
• Data Security 
• IT Systems and Devices 

The number of mandatory items you will need to evidence is defined by your organisation’s category. DSPT defines 4 categories with an increasing number of mandatory evidence requirements to reflect the different risk profiles of organisations in different categories. The majority of organisations will likely fall into category 3, but we will discuss this in more detail later in this blog. 

Figure 1: DSP Toolkit structure 

DSPT has a 3rd level that sits above “Standards Met” named “Standards Exceeded”. Organisations will gain the label “Standards Exceeded” if they hold the Cyber Essentials Plus certification at the time they achieve “Standards Met”. 

In summary, all organisations should achieve or be aiming to achieve “Standards Met”. This requires that you evidence a number of items which are determined by the category in which your organisation sits. There are 3 levels of compliance, which are: 

• Approaching Standards: for care providers who are approaching but not yet able to meet “Standards Met”. Organisations are required to answer 27 mandatory questions and submit a plan detailing how you will achieve the remaining evidence items. 
• Standards Met: Organisations are required to evidence all mandatory items as defined by their category (see figure 2, below) in order to achieve DSPT status “Standards Met”. 
• Standards Exceeded: Organisations that achieve “Standards Met” and currently hold a Cyber Essential+ certification are assigned the highest level and will have “Standards Exceeded” displayed as their DSPT status. 

Organisations are required to meet, or in the case of “Approaching Standards” evidence that they are on their way to achieving “Standards Met”. 

How is your organisation categorised under the DSP Toolkit?

The DSP Toolkit evidence requirements are linked to the risk profile of your organisation. Central organisations such as an NHS Trust or Ambulance Trust will be required to complete a more extensive assessment than a GP, dental practice, or optician, for example. Organisations are split into the 4 categories shown below. 

• Category 1: NHS Trusts, Ambulance Services, Mental Health Trusts 
• Category 2: ALBs, ICBs, Shared Services
• Category 3: Independent providers, social care, third-party vendors
• Category 4: GP practices only

Figure 2: Evidence requirements 

Each category will be required to evidence a number of mandatory security practices to achieve the “Standards Met” level. After evidencing all required mandatory items, organisations can submit answers to evidence the non-mandatory items at their discretion. However, this is not required to meet the “Standards Met” classification.  

In 2025, more emphasis is placed on proportionality — smaller organisations are not expected to meet the same requirements as NHS Trusts.

What else do you need to know?

There are a few more things you should be aware of, or already have in place, when undertaking the DSPT assessment.   

Your ODS Code (Organisation Data Service Code)

This code is used by the NHS to provide every health and care organisation with a unique code. If you do not know your code, you can locate it using this search tool here. If you do not have a code, you will need to get in contact with the DSP Toolkit help desk to acquire one.  

Single vs multi-site organisations

The number of DSPT submissions you are required to make depends on your organisation’s size and how your security governance framework has been structured. 

Single site entities (e.g., a single care home) and organisations that have centralised security and data policies and procedures covering all their sites are only required to complete one DSP Toolkit. 

Multi-site organisations that do not share the same security and data policies and procedures should complete additional assessments based on the number of distinct segregated operating units you have.  

Accountability

Accountability is a core security concept and a key step to achieve this is to identify a named individual who is ultimately responsible for your information security. In order to pass the assessment, you will need to nominate a Data Protection Officer and identify a single person accountable for your information security.  The persons in each of these roles should be adequately qualified and experienced.  

Additionally, all NHS organisations and local authorities providing social services must have a Caldicott Guardian who is required to be registered on the publicly available National Register of Caldicott Guardians. Other health and social organisations (e.g., from the independent sector) are encouraged to register a Caldicott Guardian but are not required to. 

What’s new in the DSP Toolkit for 2025?

• Continued streamlining of evidence requirements

• Emphasis on integrated cyber resilience (e.g. managing supply chain and connected devices)

• Support for small organisations with clearer guidance

• Alignment with Cyber Essentials and DSPT for social care initiatives

• Encouragement of multi-year roadmaps for improvement (but annual submissions still required)

Full details of the latest changes and release notes can be found on the DSPT website. 

How to get started with the DSP Toolkit

In this blog, we have given you the basic information to understand what the Data Security Protection Toolkit is, how it’s structured, and whether or not it is relevant to your organisation. To summarise, the Toolkit is a mandatory assessment for businesses working, or looking to begin working, with UK health and care data or NHS systems.

It defines a minimum standard of security and is therefore not meant to be a difficult standard to achieve for any organisation. Yet, knowing where to start is not necessarily clear, especially for organisations on the first steps towards good information security management.  

Your starting point should always be to understand the scope of your organisation, including your business context, operating locations, and the coverage of your current information security and IT framework(s).

• Define your scope – Identify the sites, services and systems involved in handling health and care data.

• Determine your category – This defines how many mandatory evidence items you’ll need.

• Assess your current posture – Evaluate your current policies, training, and technical controls.

• Close the gaps – Build and implement a roadmap to align with DSPT requirements.

• Assign accountability – Nominate a DPO and information security lead. Ensure senior leadership buy-in.

• Submit before 30 June 2025 – Keep access to NHS systems and contractual eligibility.

Need help?

Our team of experienced security professionals have successfully worked with organisations to achieve compliance with the DSP Toolkit. Our consultants can support your organisation through the entire certification process.  

Whether you’re starting from scratch or looking to improve your security maturity, we can:

• Conduct a gap analysis and support in scoping

• Create a prioritised remediation roadmap

• Develop compliant policies, training and controls

• Support your submission through to certification

Get in touch for a no-obligation consultation and practical guidance tailored to your organisation.