Client Portal


The Data Security and Protection Toolkit is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards.

All organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly.

The Data Security and Protection Toolkit replaced the previous Information Governance toolkit from April 2018. The requirements are based on 10 Security Standards which are clustered under three leadership obligations; People; Process and Technology.


We can assist you with the requirements of the DSP toolkit and we’ll help ensure that your organisation is structured how it needs to be for the assessment.

We offer the following services:

Audit Service

Submission Service

Security Testing Service


The NHS DSP toolkit is an annual requirement for any organisation both within and outside of the NHS if they want to have (or retain) access to NHS patient data. If you are working in the biotech industry, creating medical devices, or you are creating technical or third party solutions that you want to sell to the NHS, or have NHS patient services using, then you need to be compliant with the DSP toolkit. The toolkit will also give you access to NHS.net (NHS email).

Large scale organisations such as big NHS Trusts, multiple hospitals and multiple sites may be required to complete the toolkit twice a year in order to retain compliance.

Organisations that sit within the requirements of the DSP toolkit will fall into one of the following categories:

  • Category 1 – NHS trusts
  • Category 2 – Arm’s length bodies, Clinical Commissioning Groups (CCGs) and Commissioning Support Units (CSUs)
  • Category 3 – All other sectors
  • Category 4 – GP practices


The NHS DSP (Data Security and Protection) Toolkit requirements are based on the National Data Guardian’s Data Security Standards. The 10 National Data Guardian’s data security standards are clustered under three leadership obligations to address people, process and technology issues and covers the following areas:


Handling, transmission and storage of confidential data

All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes.

Staff accountability and responsibilities

All staff understand their responsibilities under the National Data Guardian’s Data Security Standards including their obligation to to handle information responsibly and their personal accountability for deliberate or avoidable breaches.

Staff data security training and testing

All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit


Access controls

Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access data to personal confidential data on IT systems can be attributed to individuals.

Annual process reviews

Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.

Cyber attack, identification, resistance and response

Cyber attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.

Continuity and incident response planning

A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.


Unsupported operating systems, applications or browsers

No unsupported operating systems, software or internet browsers are used within the IT estate.

Implementation of a suitable strategy or framework to protect IT systems

A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.

Contractual accountability for IT suppliers

IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standards.


The deadline for completing the DSP toolkit is 31st March, but it can be submitted at any point in the year. (If you are an organisation that is required to complete it twice a year, deadlines will be 31st March and 31st October). It is recommended that you get the DSP toolkit submitted as soon as you have the information ready rather than wait for the deadline to avoid unnecessary rush and potential shortcomings.

Our Services

Contact Us

Drop Us a line

Contact Us

  • This field is for validation purposes and should be left unchanged.