Glossary, regulation and privacy
What is the DSPT?
The Data Security and Protection Toolkit (DSPT) is the online self-assessment that organisations with access to NHS patient data and systems use to show they handle that data securely. It measures each organisation against the National Data Guardian's 10 data security standards.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called Data Security and Protection Toolkit.
Why DSPT matters to a clinic
All organisations that have access to NHS patient data and systems must use the toolkit.1 For a private clinic that works with the NHS, holds NHS patient data or supplies an NHS body, a current DSPT assessment is often a condition of the contract.
The toolkit changes each year. The 2026 to 2027 version was released on 2 October 2026, and its audit guidance is being aligned to the Cyber Assessment Framework.1 NHS buyers also ask their suppliers how they support the buyer's own submission.
Questions
Does a private clinic need to complete the DSPT?
If it has access to NHS patient data or systems, yes. A purely private clinic usually does not, though some complete it to show NHS partners and insurers the same standard.
What do NHS buyers ask a supplier for?
Usually the supplier's own security position, its subprocessors, where data is hosted and how it supports the buyer's DSPT and clinical safety work. See security and the NHS page.
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.