Nobody goes into care work because they love filling in online assessments. And yet here we are, talking about the Data Security and Protection Toolkit (DSPT), an annual self-assessment that, unlike most compliance paperwork gathering dust in a folder marked urgent, actually stops your care home from ending up in a headline about a data breach. Stick with it; it's worth the read.
Care homes hold some of the most sensitive information that exists: health and financial records, medication histories, safeguarding notes, etc. That is exactly the kind of data cybercriminals want and that residents and families trust you to protect without a second thought.
The DSPT is the sector's structured answer to proving you are actually doing that properly, rather than crossing your fingers and hoping your care home is too small and unglamorous to notice.
This guide breaks down the Data Security and Protection Toolkit (DSPT) to show you how this annual self-assessment protects sensitive resident data and prevents costly data breaches.
Data Security and Protection Toolkit (DSPT) in Care
The Data Security and Protection Toolkit (DSPT), known throughout the care sector simply as the DSPT, is a free online self-assessment tool that measures how well an organisation handling health and social care data is managing information security, data protection, and cyber resilience.
It is run by NHS England and completed annually, and it applies to a far wider range of organisations than most people initially assume not just NHS bodies, but care homes, domiciliary agencies, and other social care providers that handle personal health information as a normal part of their work.
The assessment works through several distinct areas, including:
- Data Handling: How personal and confidential information is stored, shared, and disposed of, ensuring that paper files in locked cabinets are as secure as digital records.
- Staff Awareness and Training: Whether your team understands data protection basics, recognises phishing attempts, and knows exactly how to respond when an issue arises.
- Technical Safeguards: The strength of your system access controls, password policies, encryption methods, and secure data backups.
- Incident Response: Having a documented, tested process ready to activate the moment a data breach or near-miss is identified.
- Governance and Accountability: Defining who within your organisation is formally responsible for data security, ensuring roles are explicitly written down rather than assumed.
Don't Forget!
Completing the DSPT to at least Standards Met level is a requirement for any care provider that wants access to NHS Mail, NHS Digital systems, or GP Connect. No current DSPT, no access to these systems, which increasingly means no smooth, secure communication with local GP practices or hospital discharge teams either.
Importance of Data Security and Protection Toolkit (DSPT)
Care providers have become an increasingly attractive target for cyberattacks, precisely because health and social care data is so valuable and, historically, smaller providers have had far less investment in cyber defences than large NHS trusts with dedicated IT security teams. Attackers know this, and they act on it.
Care homes assume they are too small to be a target. Attackers do not care about your size; they care about how easy you are to breach.
A few reasons this has shifted from nice-to-have to genuinely urgent:
- Rising Cybersecurity Risks: Ransomware attacks on health and care organisations have risen sharply across the UK in recent years, with smaller providers often less prepared to detect or recover from an incident.
- A Holistic Care Issue: A data breach involving resident records is both a safeguarding failure and a regulatory one, not simply an IT problem contained to a server somewhere in a back office.
- Regulatory Impact: CQC inspectors now expect to see genuine evidence of data security compliance as part of the Safe and Well-led key questions, meaning a poor DSPT status can meaningfully affect your rating.
- Commercial Advantage: Families and commissioners increasingly ask directly whether you hold current DSPT status before placing a resident or awarding a contract.
- Severe Financial Fallout: Potential ICO fines, lasting reputational damage, and the operational cost of recovering from an incident all dwarf the cost of prevention.
Key Benefits of the Data Security and Protection Toolkit (DSPT) for Care Homes
Local authorities and NHS bodies are filtering out providers who cannot evidence current DSPT status before a contract even gets properly discussed, which means an out-of-date toolkit can quietly cost you business you never even knew you were being considered for.
The benefits of the Data Security and Protection Toolkit (DSPT) in your care home include:
- Protects Resident Data: It significantly reduces the risk of breaches involving highly sensitive health, safeguarding, and personal information.
- Builds Commissioner Trust: Maintaining a current DSPT status is increasingly a baseline eligibility requirement rather than an optional extra.
- Enables NHS System Access: It unlocks crucial digital capabilities, including NHS Mail, GP Connect, and shared care records.
- Strengthens Your CQC Evidence: It provides tangible proof of compliance that feeds directly into your Safe and Well-led ratings.
- Reduces Financial Risk: Completing the assessment properly safeguards against potential fines and reputational fallout that far outweigh the time investment required.
- Improves Operational Resilience: Implementing documented backup and recovery procedures substantially reduces downtime whenever systems fail, whether due to a technical glitch or a malicious attack.
- Clear Accountability: It ensures someone becomes formally and documentably responsible for data security, rather than leaving it to whoever happens to have free time.
- Regular Staff Training: It provides ongoing education, making a breach caused by a staff member clicking a convincing phishing link significantly less likely.
- Documented Incident Response: It establishes clear procedures so that if something goes wrong, your team knows exactly what to do and who to notify, instead of panicking in a group chat.
- Ongoing Technical Safeguards: It embeds access controls, secure passwords, and reliable backups as standard daily practices rather than a post-incident scramble.
- Better Supplier Oversight: It prompts a thorough review of third-party software vendors, which is where hidden system vulnerabilities frequently reside.
Pro Tip
Do not treat the DSPT as an IT-only task and quietly hand it to whoever manages your printer. Registered managers and front-line care staff generate and handle sensitive data every single day; they need to understand the basics of data protection just as much as your IT lead does, and their genuine buy-in is often what determines whether your DSPT status reflects good practice or just good paperwork.
Steps Care Homes Can Take to Complete the DSPT
The DSPT is not a form you fill in once a year and quietly forget about. Done properly, it forces genuinely useful habits that protect your organisation well beyond the assessment itself.
Follow the steps below to complete your DSPT process;
- Register on the platform: Sign up on the DSPT platform if you haven't already. Most social care providers are eligible, and it's free.
- Assign a named lead: Formally appoint someone responsible for data security and the submission, with a deputy identified for cover.
- Work through in stages: Complete the assessment in stages rather than one sitting, as governance, staff training, and technical measures are genuinely distinct sections, and rushing produces gaps.
- Gather evidence as you go: Collect your evidence continuously, including policies, training records, and incident logs rather than trying to reconstruct everything at the last minute.
- Book staff training early: Schedule training well ahead of your deadline, as training completed after submission does not retroactively strengthen your assessment.
- Carry out a technical review: Run a basic check on passwords, device security, and backups before submitting, ideally with input from whoever manages your IT.
- Review and resubmit annually: Complete the process every year, keeping in mind that a lapsed status can quietly disqualify you from tenders or NHS system access without warning.
Compliance Reminder
An expired or incomplete DSPT is not a paperwork gap CQC will politely overlook. Data security now sits firmly within the Safe and Well-led key questions, and providers without current status may be asked to explain the gap directly during inspection.
Strengthen Your Care Home with Better Data Protection
The Data Security and Protection Toolkit (DSPT) will never be anyone's favourite item on the compliance calendar, and nobody is pretending otherwise. Skipping it, or letting it quietly lapse while everyone's attention is elsewhere, is not cutting a corner. It is leaving the front door unlocked and hoping nobody tries the handle.
Remember, a completed Data Security and Protection Toolkit (DSPT) is not just a compliance badge to file away. It is increasingly a prerequisite in every care home.
Get Your Data Protection Sorted
👉 Download our 100% free care resources and templates
👉 Invest in CQC-Compliant Care Qualification