Summary
The Data Security and Protection Toolkit changed shape for 2025/26. It is now aligned to the National Cyber Security Centre's Cyber Assessment Framework, with four CAF objectives plus an NHS-specific fifth on the lawful use and sharing of patient information, and it is assessed on outcomes rather than as a checklist. Submission is due by 30 June 2026, an independent audit is mandatory for the organisation types in scope, and holding Cyber Essentials Plus or ISO 27001 does not exempt anyone.
The DSPT used to be a long list of assertions you could work through and tick. For 2025/26 it is aligned to the Cyber Assessment Framework, which asks whether an outcome is actually achieved rather than whether a control exists. That is a different kind of exercise and it takes longer the first time.
For a clinic buying an ambient scribe, the DSPT shows up twice. Your own submission, which is yours regardless of what you buy, and the supplier's, which NHS England's ambient scribing guidance names alongside Cyber Essentials as something you should be checking.
It is worth understanding the shape of it before a supplier tells you they are compliant, because the word means less than it did eighteen months ago.
See it in your clinicAsk us for our position on every one of these before a demo, not after an order.
Request a demo| Objective | What it covers |
|---|---|
| A, managing security risk | Governance, risk management, asset management, supply chain |
| B, protecting against attack | Access control, data security, system security, resilience, staff awareness |
| C, detecting events | Security monitoring and anomaly detection |
| D, minimising impact | Response and recovery planning, lessons learned |
| E, NHS specific | Lawful use and sharing of patient information |
What the CAF alignment changed
The move is from a compliance exercise to an assurance one. Under the older toolkit an organisation could answer that a policy existed. Under a CAF-aligned assessment the question is whether the outcome the policy exists to produce is actually being achieved, and the evidence has to support that.
Four objectives come from the standard CAF and cover managing security risk, protecting against attack, detecting events and minimising impact. NHS England adds a fifth, objective E, on the lawful use and sharing of patient information, which is the part with no equivalent outside health.
An independent audit against the agreed CAF-aligned audit framework is mandatory for the organisation types in scope, which include trusts, integrated care boards, commissioning support units and arm's length bodies, along with designated operators of essential services and genomics organisations.
The deadline, and what does not buy you out of it
Submission is due by 30 June 2026. That is the date to work back from, and the first CAF-aligned submission takes longer than the last checklist one did, because gathering outcome evidence is not the same job as confirming a control.
Holding Cyber Essentials Plus does not exempt an organisation. Neither does ISO 27001. Both are useful evidence inside the submission and neither replaces it, which is a point worth making early to anyone who assumes otherwise.
Supply chain sits inside objective A, which is where your scribe supplier enters your own submission. Their security posture becomes part of your assurance picture rather than a separate conversation.
What to ask the supplier
NHS England's ambient scribing guidance asks that organisations and suppliers comply with the DSPT as well as holding Cyber Essentials certification. So the first question is simply whether they have a current submission and at what standard, and the second is when it was last independently audited.
Then the questions the DSPT will make you answer about them anyway. Where the audio and the transcript are processed and stored. How long each is kept and whether you can shorten it. Who inside the supplier can read a patient record, whether access is logged, and whether you can request that log.
Ask about their own suppliers too. A scribe built on somebody else's speech and language models inherits that company's posture, and objective A does not stop at the first supplier. The full procurement list is in what to ask a scribe vendor.
How this sits beside the DPIA
The DSPT is about security and lawful use at an organisational level. A data protection impact assessment is about this specific processing, with these patients, for this purpose. They overlap and neither substitutes for the other.
NHS England's ambient scribing guidance requires a DPIA alongside the DCB0160 clinical safety work, and using new technology to process special category data at scale is close to the textbook trigger for one under UK GDPR.
Our walkthrough of UK GDPR for ambient scribes covers the lawful basis, the Article 28 processor agreement, residency, retention and the model training question, which are the six things a DPIA will make you write down.
Where wai sits
We answer these in writing before a demo rather than after one. Consultations are not used to train models, retention is set by the clinic, access to a patient record is a named role and every read is logged.
That is a posture rather than a certificate, and it is the posture the DSPT now asks about, since the toolkit moved from confirming that controls exist to asking whether outcomes are achieved.
If an answer does not satisfy your information governance lead, say so and we will either fix it or tell you plainly that we cannot. Clinicians still decide what enters the record.
Bring your information governance lead. Fifteen minutes, and the answers follow in writing.
Request a demoFrequently asked questions
What is the DSPT?
The Data Security and Protection Toolkit, the annual assurance NHS organisations complete on data security and the lawful use of patient information. For 2025/26 it is aligned to the National Cyber Security Centre's Cyber Assessment Framework, which assesses whether outcomes are achieved rather than whether controls exist.
When is the DSPT deadline?
Submission is due by 30 June 2026. The first CAF-aligned submission takes longer than the old checklist did, because gathering evidence that an outcome is achieved is a different job from confirming that a policy exists.
Does Cyber Essentials Plus or ISO 27001 exempt us?
No. Neither exempts an organisation from the DSPT. Both are useful evidence inside the submission and neither replaces it, which is worth saying early to anyone who assumes otherwise.
What are the five DSPT objectives?
Four come from the Cyber Assessment Framework, covering managing security risk, protecting against attack, detecting events and minimising impact. NHS England adds a fifth on the lawful use and sharing of patient information, which is the objective with no equivalent outside health.
Does our AI scribe supplier need a DSPT?
NHS England's ambient scribing guidance asks that organisations and suppliers comply with the DSPT as well as holding Cyber Essentials certification. Supply chain also sits inside objective A of your own submission, so their posture becomes part of your assurance picture whether or not they hold their own.
Is the DSPT the same as a DPIA?
No. The DSPT is organisational assurance on security and lawful use. A data protection impact assessment is about one specific processing activity, with these patients for this purpose. NHS England requires a DPIA for ambient scribing alongside the DCB0160 clinical safety work, and neither document substitutes for the other.
Who has to have an independent audit?
The organisation types in scope, which include trusts, integrated care boards, commissioning support units and arm's length bodies, along with designated operators of essential services and genomics organisations. The audit is against the agreed CAF-aligned DSPT audit framework rather than a general security review.
Sources
Answers before the demo
Fifteen minutes on your workflows. If it is a fit we reply within 24 hours.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits