Clinical safety and assurance
The NHS Data Security and Protection Toolkit (DSPT) explained
The Data Security and Protection Toolkit (DSPT) is an online self-assessment that lets organisations measure themselves against the National Data Guardian's 10 data security standards. Every organisation with access to NHS patient data and systems must use it. The 2026-27 version (version 9) is aligned to the Cyber Assessment Framework (CAF) 4.0 and is due by 30 June 2027.
Who completes it
The DSPT site says all organisations that have access to NHS patient data and systems must use the toolkit to show they practise good data security and handle personal information correctly. That includes suppliers: NHS England's DTAC guidance says suppliers of products with access to NHS systems or patient data must also complete the DSPT, and it removed DTAC questions the DSPT already covers.
The 2026-27 toolkit
The outcomes, assertions and evidence items for 2026-27 (version 9) were released on 2 October 2026, with a deadline of 30 June 2027. Version 9 is aligned to CAF version 4.0. The DSPT publishes the requirements in two shapes:
- Outcomes and indicators of good practice (the CAF-aligned format) for NHS trusts, ICBs, arm's length bodies, commissioning support units, independent providers who are operators of essential services, and genomics organisations.
- Assertions and evidence items for IT suppliers (category 2); dentists, local authorities, opticians, pharmacies, social care, universities and others (category 3); and GPs (category 4).
Audits for larger organisations
For 2026-27, NHS trusts, ICBs, ALBs, CSUs, operators of essential services and genomics organisations have 11 mandated outcomes to audit, plus one of their choice. They are A1b roles and responsibilities, A3a asset management, B2c privileged user management, B2d identity and access management, B3a understanding data, B4c secure management, B6a culture, B6b training, C1e personnel skills for monitoring and detection, D1c testing and exercising, and E4a managing records.
Statuses and improvement plans
A published assessment ends in one of four statuses: Standards Exceeded, Standards Met, Approaching Standards or Standards Not Met. An organisation that hasn't met the expected level for every outcome publishes a Standards Not Met assessment with an improvement plan: actions, owners, priorities, milestones and dates. If NHS England and DHSC approve the plan, the status becomes Approaching Standards, and Standards Met once every action is done. For 2025-26, plans with dates beyond June 2027 weren't accepted without exceptional circumstances.
What it does not mean
- It isn't a one-off. Each year has its own toolkit version and deadline (30 June 2026 for 2025-26, 30 June 2027 for 2026-27).
- It isn't only for NHS bodies. Any organisation with access to NHS patient data and systems, including IT suppliers, uses it.
- A supplier's DSPT status doesn't cover the hospital. Each organisation publishes its own assessment.
Where Thalix fits
Thalix doesn't hold a DSPT status of its own today; if a pilot gives us access to NHS patient data or systems, completing the DSPT is part of that work. The design does line up with what the toolkit looks for: patient data stays on the hospital's servers, access is by role and purpose with field-level redaction, break-glass access is time-limited and reviewed, secrets are held as references, PHI is kept out of logs, and every read and action goes into a hash-chained audit log your teams can verify.
Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.
Questions people ask
When is the DSPT deadline?
The deadline for the 2026-27 toolkit (version 9) is 30 June 2027. The 2025-26 deadline was 30 June 2026.
Is the DSPT aligned with the Cyber Assessment Framework?
Yes. The DSPT says version 9 (2026-27) is aligned to CAF version 4.0, and larger NHS organisations complete outcomes in the CAF-aligned format.
What does Approaching Standards mean?
It's the status given when an organisation that hasn't met every expected outcome has an improvement plan approved by NHS England and DHSC. It moves to Standards Met once all the actions are complete.
Sources
Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.
- Data Security and Protection Toolkit NHS England, DSPT · checked October 2026
- Outcomes, assertions and evidence items for DSPT 2026-27 version 9 NHS England, DSPT · checked October 2026
- DSPT audit 26-27: areas of mandatory audit NHS England, DSPT · checked October 2026
- Improvement plans: instructions for 2025-2026 NHS England, DSPT · checked October 2026
- DTAC in relation to other regulatory and assurance processes NHS England Digital · checked October 2026
General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.