Data protection and DSPT for health and care providers

Other law requires

Health information is special-category personal data. A provider needs an appropriate Article 6 lawful basis and an Article 9 condition, together with any applicable domestic-law safeguards. Consent is not the only possible route, and a general audit purpose is not permission to share every patient record.

Criminal-offence information, including relevant recruitment material, has a separate Article 10 analysis. Do not treat a full DBS certificate as routine audit evidence where a proportionate verification record would answer the question.

Controller and processor roles follow the decisions each party actually makes. Record the purposes, instructions, access and retention responsibilities rather than choosing a label solely for convenience.

Regulation requires

Regulation 17 includes secure, accurate and contemporaneous care records and necessary employment and management records. Good governance therefore connects information quality with confidentiality, availability and appropriate access.

An audit should ask both whether information is protected and whether authorised staff can obtain the information they need to provide safe care.

The current DSPT routes

The Data Security and Protection Toolkit is an NHS assurance mechanism for organisations accessing NHS patient data and systems. The current edition is 2026/27, version 9, with a published submission deadline of 30 June 2027.

Category 1 organisations use the CAF-aligned route: NHS trusts, integrated care boards, commissioning support units, relevant arm's-length bodies, designated independent operators of essential services and nominated genomics organisations.

Social-care providers use category 3. GP practices use category 4. Suppliers must check the official size and service criteria: large digital suppliers use category 2, while smaller suppliers generally use the Other/category 3 route. NHS guidance expressly keeps suppliers on a non-CAF assessment for 2026/27.

What the toolkit does not establish

DSPT completion is not a universal statutory certification for every CQC registrant, and it does not prove compliance with every data-protection obligation. Use the organisation's actual activities, data access and contracts to establish the correct route.

Readiness and submission support also differ from a mandated independent-assurance engagement. Formal assurance has defined scope, evidence and competence expectations; the responsible organisation retains ownership of its submission.

Our recommendation: review the information journey

Follow a sample record from collection through use, sharing, storage and disposal. Identify unnecessary copies, broad permissions, insecure transfers and unclear retention. Test recovery arrangements as well as access restrictions.

For external audit, prefer synthetic material for demonstrations and anonymised or minimised samples where these can answer the question. Pseudonymisation can reduce exposure but does not automatically remove the information from data-protection law.

Complete a data protection impact assessment where the processing is likely to create high risk. For an evidence portal, define the data and access model before accepting real records; document any remaining risks and the safeguards required.

Keep the legal baseline current

ICO's June 2026 update confirms that the Data (Use and Access) Act's data-protection provisions are in force. Review current subject-access and complaints procedures rather than relying on an old policy pack.

An improvement plan should name owners, deadlines and evidence of effectiveness. Avoid claiming an organisation is compliant merely because a template has been adopted.

Evidence checklist

• Processing inventory, lawful-basis decisions and relevant Article 9 or 10 analysis.
• Controller/processor allocation and appropriate contractual arrangements.
• Access reviews, secure sharing, backup and recovery evidence.
• Retention schedule and documented disposal arrangements.
• Subject-access, complaints and incident-response procedures.
• DSPT organisation category, current version and applicable evidence requirements.
• DPIA screening and completed assessment where required.
• Minimised audit samples and secure access to identifiable information.

Common questions

Sources and review record

1. ico.org.uk — Special category data↗ (opens in a new tab)
2. ico.org.uk — What are the rules on criminal offence data↗ (opens in a new tab)
3. ico.org.uk — Contracts and liabilities between controllers and processors multi↗ (opens in a new tab)
4. legislation.gov.uk — Uksi · 2014 · 2936 · regulation · 17 · data.html↗ (opens in a new tab)
5. dsptoolkit.nhs.uk — 169↗ (opens in a new tab)
6. dsptoolkit.nhs.uk — 5↗ (opens in a new tab)
7. digital.nhs.uk — Introduction↗ (opens in a new tab)
8. dsptoolkit.nhs.uk — Official guidance↗ (opens in a new tab)
9. ico.org.uk — Introduction to anonymisation↗ (opens in a new tab)
10. ico.org.uk — When do we need to do a dpia↗ (opens in a new tab)
11. ico.org.uk — The data use and access act 2025 what does it mean for organisations↗ (opens in a new tab)

Content version: 1 November 2026 · Next scheduled content review 1 December 2026. This is a content review date, not a monitoring service or a guarantee that a source will remain unchanged.