Plan for 30 June 2027. The Data Security and Protection Toolkit (DSPT) runs on a toolkit year from 1 July to 30 June, and the deadline for the 2025-26 toolkit was 30 June 2026. As of 16 October 2026, the DSPT website has not published a confirmed submission date for the 2026-27 toolkit (version 9), so treat 30 June 2027 as your working deadline and check the toolkit home page for confirmation.
The date matters less than starting early. In a small dental practice or care home, the items that take longest are rarely technical. They are staff training, gathering policies, chasing suppliers and getting the right person to sign things off.
When is the DSPT deadline?
The DSPT is an annual self-assessment, and you must publish it at least once in each toolkit year. Recent deadlines have fallen on 30 June, at the end of the toolkit year:
- 2025-26 toolkit: due by 30 June 2026.
- 2026-27 toolkit (version 9): released on 1 September 2026. No confirmed date published yet, so plan for 30 June 2027.
You can publish at any point in the toolkit year. Publishing in spring, rather than in the last week of June, leaves time to fix anything that comes up and avoids the rush when support lines are busiest.
Who has to meet the deadline?
All organisations that have access to NHS patient data and systems must use the toolkit. For the organisations we work with, that usually means:
- Dental practices holding an NHS contract.
- Care homes and home care providers that deliver services under an NHS contract, access NHS patient data, or use NHS systems such as secure NHS email or shared care records.
- GP practices, community pharmacies and other primary care providers.
- Charities and suppliers that handle NHS patient data on behalf of the NHS.
Local authorities are also increasingly asking care providers for a published DSPT in their contracts. If you are unsure whether it applies to you, assume it does and check with your commissioner.
What happens if you miss it?
Your status is public. Anyone can look your organisation up on the DSPT website, including commissioners, local authorities and the Care Quality Commission. Missing the deadline means your organisation does not have a published assessment for the current year, which can cause problems with NHS contract monitoring, with access to systems that require a published DSPT, and with questions at inspection. It is also an easy thing for a prospective client or family to check.
A month-by-month plan for June 2027
| When | What to do |
|---|---|
| October to November | Log in and check that at least two people can access the toolkit. Download the version 9 list of evidence items and compare it with last year's answers. |
| December | Update your record of the personal data you hold, who you share it with and every supplier that processes it, such as your practice or care records system, payroll, rota software and website host. |
| January | Review your data protection, data security, record keeping and business continuity policies. Check they reflect how you actually work. |
| February | Book and run staff data security training, including part-time, bank and agency staff. This is usually the slowest item to finish. |
| March | Technical basics: multi-factor authentication on email and cloud systems, devices and software up to date, backups tested, and email protected against impersonation. |
| April | Walk through your incident and business continuity plans with the team. Record what you would change. |
| May | Answer the remaining questions, attach or note your evidence, and get sign-off from the person responsible for data security. |
| Early June | Publish. Do not leave it to the last week. |
What usually slows small teams down?
- Staff training. Getting everyone through it, and recording it, takes longer than expected in a shift-based team.
- Supplier evidence. You may need contracts or assurances from suppliers who are slow to reply.
- IT evidence. If an IT provider manages your systems, they need to confirm things like updates, backups and account controls. Ask them early.
- Sign-off. The person who can approve the submission is often the busiest person in the organisation.
One thing you can check today
Email security is part of the picture, and it is often missed. In our October 2026 check of 1,337 Yorkshire healthcare providers, 83% could have email sent in their name by someone else, including 91% of dental practices and 73% of care homes. You can see where you stand in seconds with our free DMARC checker.
Frequently asked questions
Is the DSPT deadline always 30 June?
Recent deadlines have been 30 June, at the end of the toolkit year that runs from 1 July to 30 June. The 2025-26 deadline was 30 June 2026. Always check the DSPT website for the confirmed date for the current toolkit.
Can I publish my DSPT early?
Yes. You can publish at any time during the toolkit year, and you can update and republish if something changes. Publishing in the spring leaves time to fix problems before the deadline.
Do I have to complete the DSPT every year?
Yes. The DSPT is an annual self-assessment, and you must publish at least once in each toolkit year to keep a current status.
What if we cannot reach Standards Met in time?
Care providers publishing for the first time can publish at Approaching Standards with an action plan, but only once. Some NHS organisation types can submit an improvement plan. Otherwise, publish what you can honestly confirm, fix the gaps and republish. Read our guide to the DSPT statuses for more.
Next, read what the DSPT statuses mean, how to complete the DSPT step by step and what changed in version 9.
How we can help
Unavoidably Secure reviews your controls, website and email security against what the DSPT asks for, and helps you get ready for Cyber Essentials. We do not certify, accredit or guarantee compliance: the DSPT is your organisation's own self-assessment, and Cyber Essentials certification comes from an IASME certification body. What we give you is a plain-English list of what to fix first, written for small teams.
This guide is general information, not legal advice. Facts were checked against the DSPT website, Digital Care Hub and Community Pharmacy England on 16 October 2026. For more practical guides, browse the blog.
Want to be ready well before June?
Book a free external audit. We will review your controls, website and email security against what the DSPT asks for and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.