What is the NHS Data Security Protection Toolkit (DSPT)

The NHS Data Security Protection Toolkit (DSPT) is a self-assessment framework required for all suppliers that handle identifiable data as part of their engagements with health or social care. It is mandatory for Integrated Care Boards (ICB’s), NHS Trusts, innovative technology companies and CQC registered service providers working with the NHS. Its intention is to illustrate compliance and alignment with the National Data Guardians 10 Data Security Standards as well as UK GDPR.  But it’s not easy..  After over 10-years of supporting organisations to address the requirements of the NHS DSPT, we have summarised 5 common mistakes made when submitting for the 1st or 10th time, especially with recent changes made to Version 6 of the toolkit.   

DSPT Category 1 or Category 3: Choosing the right category 

Until Version 6 of the DSPT, the majority of external companies working with the NHS were expected to submit a DSPT in line with Category 3 guidance, but this has now changed based on new guidance and expectations. This has caused some confusion in the submission process and led organisations to address enhanced requirements.  For the most part, innovative technology companies would make their submission under the   ‘Other’ sector definition of the DSPT following the Category 3 guidance. Now, if a technology or IT supplier meets the conditions of having over 50 staff and £10 million of revenue, they must complete a Category 1 submission. This is a much more detailed and comprehensive submission, focusing on both the expectations of the National Data Guardian and enhancing the technical and procedural controls in place.  Ensuring you choose the right category is essential for success in completing your submission, so if in doubt, get in touch.   

Registration with the Information Commissioner’s Office (ICO) 

The ICO is the data protection regulator in the UK and exists to ensure businesses handling personal and identifiable information take measures to protect its integrity. As a standard expectation for any business working in healthcare, whether through technology or services, they must be registered with the ICO.  This is a common gap in the knowledge base of businesses that are just starting out on their journey to complete DSPT for the first time and is an easy task that can be completed here. It’s essential that businesses have their ICO registration number in order to complete and submit the DSPT.   

Appointing a UK Representative

For International companies looking to begin operations in the UK, as an often forgotten principle of UK GDPR, they must appoint a UK Representative based in the UK if they are not registered as a private limited company (Ltd).  The UK Representative role is often aligned with the Data Protection Officer (DPO) and is responsible for ensuring your organisation upholds its obligations to meet UK GDPR. This role can be fulfilled by an individual or company for those without a registered entity (Ltd company) in the UK.  This role is an important tenet of DSPT and is often missed by businesses who are completing the submission for the first time. It’s also required as part of registration with the ICO ensuring the UK regulator can interact with an appointed representative incase of enforcement or investigation.   

Not Performing Internal Audits 

For organisations that have completed DSPT previously, it’s important to understand the importance of performing internal audits. The DSPT encompasses many essential business functions and processes and without stress testing policies and procedures, it can prove difficult to evidence their effectiveness which is important for subsequent submissions.  Successfully performing an internal audit does require a multi-stakeholder engagement ranging from the HR to Technology teams. Whilst perhaps considered a burden to busy teams, it lays the foundation for best practice in Information Security Management and instils a culture of Test, Evaluate, Adjust, Repeat which is the groundwork for international standards. By making this part of usual business practices, complying with standards like ISO 27001 will be less of a shock to internal teams going forward.   

Limited time to complete submission  

Compliance is often identified early and delivered hastily and this is a common mistake made with frameworks like the DSPT. As already summarised, completing the DSPT takes involvement from multiple stakeholders in your business and can often be held back by a failure to establish a clear project plan and controls to ensure the business practises what it preaches.  Each component requires a plan and evidence of its implementation. For instance, the Training Needs Analysis expects a clear set of principles applied to staff that may come into contact with identifiable or personal data and 95% of those staff having completed adequate training for their role. Without prior planning, this is often unattainable.   

DSPT as a ‘tick box’ exercise 

Following and adhering to the principles of the DSPT enables businesses working with the NHS to evidence their commitment to information security and safety. It can be considered the groundwork for many compliance initiatives in healthcare from HIPAA, to GDPR, to ISO 27001 and is worth investing time and energy in completing to a suitably high standard. It should not be considered a ‘tick box’ exercise, but rather a means of ensuring the business is following best practice and that policies and procedures still resonate in the organisation.  By following some of the recommendations for action made here, businesses can effectively complete DSPT year after year. If you’ve lost your way with DSPT and need help addressing the requirements – we’ve got your back. We offer a fully integrated Information Governance function that can help address and embed the DSPT year after year and support preparation and compliance with International Standards such as ISO 27001

Other Articles​

Loading...