The DSPT is the NHS data security self-assessment, and most care homes and home care providers in England should complete it every year. It is mandatory if you deliver services under an NHS contract or access NHS patient data, and it unlocks secure NHS email and shared care records. To reach Standards Met in 2026-27, a care provider answers 45 mandatory questions. A first-time provider can publish at Approaching Standards by completing 26 mandatory items and an action plan.
Why does a care home need the DSPT?
- NHS contracts: reaching Standards Met is mandatory if you deliver services under an NHS contract or access NHS patient data.
- Shared systems: a published DSPT opens up access to secure NHS email and shared care records, so you can exchange information with GPs, hospitals and pharmacists safely.
- Local authority contracts: councils are increasingly asking for a published DSPT when they commission care.
- CQC: it gives you clear evidence for questions about how you keep people's information safe.
- Families: your status is public, and it reassures the people you support, their families and your staff.
The levels for care providers
| Level | What it takes | What it means |
|---|---|---|
| Approaching Standards | The 26 mandatory items, plus an action plan for the rest. | Meeting minimum legal standards. A temporary step, available for your first publication only. |
| Standards Met | All 45 mandatory questions. | The level every care provider should aim for, and the one you need from your second publication onwards. |
| Standards Exceeded | Standards Met, plus Cyber Essentials Plus certification. | You have gone beyond the required standard. |
For more detail on each status, read DSPT statuses explained.
What to have ready before you start
- ICO registration. You need to be registered with the Information Commissioner's Office before you register for the DSPT.
- Your ODS code. The NHS organisation code for your service.
- A shared email address for the toolkit account, rather than one person's inbox, so access does not depend on one member of staff.
- Your core policies: data protection, data security, network security, record keeping, business continuity, and a training needs analysis.
- Your key contracts: agreements with suppliers who process data for you, secure disposal, staff confidentiality and privileged access.
Where care homes usually get stuck
- Training every member of staff, including night, bank and agency staff, and keeping a record of it.
- Shared logins on tablets and care planning systems. Each person should have their own account.
- Supplier contracts with your digital care records, eMAR, rota and payroll providers.
- Devices and accounts: old tablets that no longer get updates, and email accounts without multi-factor authentication.
- Email security. In our October 2026 check of 289 Yorkshire care homes, 73% could have convincing fake email sent in their name, because nothing tells email providers to block it. Families are the people most likely to be targeted, often with a request to pay fees to "new bank details". Read how care homes can protect families from fake emails.
Free help for care providers
Adult social care providers in England can get free, expert support through the Better Security, Better Care programme, run with local support organisations across the country. Its Digital Care Hub website has templates, guidance on each question and training. Use it. It is good, and it is free.
Where we fit: we check and evidence. We look at your website, email and controls from the outside, review your documents against what the toolkit asks for, and give you a plain-English list of what to fix first. Your IT provider makes the changes, and the DSPT remains your organisation's own self-assessment.
Home care providers
Everything above applies to home care agencies too. In our benchmark, 83% of the 404 Yorkshire home care agencies we checked could be impersonated by email, a higher share than care homes. Staff working remotely on phones also make account security and device updates more important.
Frequently asked questions
Do all care homes have to complete the DSPT?
Reaching Standards Met is mandatory if you deliver services under an NHS contract or access NHS patient data, and you need a published DSPT for secure NHS email and shared care records. Local authorities increasingly ask for it too. In practice, most care homes and home care providers in England should complete it every year.
How many questions are in the DSPT for care homes?
For 2026-27, care providers answer 45 mandatory questions to reach Standards Met. First-time providers can publish at Approaching Standards by completing 26 mandatory items with an action plan.
Is the DSPT free for care providers?
Yes. Completing the toolkit is free, and adult social care providers in England can get free support through the Better Security, Better Care programme and its local support organisations.
Does Cyber Essentials replace the DSPT?
No. Cyber Essentials is a separate certification. Holding Cyber Essentials Plus on top of Standards Met gives the Standards Exceeded status, and it can help with some technical questions, but you still need to complete and publish the DSPT.
Next, read when the 2026-27 DSPT is due, DSPT and Cyber Essentials for care providers and how to complete the DSPT step by step.
How we can help
Unavoidably Secure reviews your controls, website and email security against what the DSPT asks for, and helps you get ready for Cyber Essentials. We do not certify, accredit or guarantee compliance: the DSPT is your organisation's own self-assessment, and Cyber Essentials certification comes from an IASME certification body. What we give you is a plain-English list of what to fix first, written for small teams.
This guide is general information, not legal advice. Facts were checked against Digital Care Hub and the DSPT website on 16 October 2026. For more practical guides, browse the blog.
Want a second pair of eyes before you publish?
Book a free external audit. We will check your website, email security and controls against what the DSPT asks for and tell you plainly what to fix.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.