Quick answer: DSPT staff training means making sure everyone who handles personal data in your organisation understands data security, usually through the free national Data Security Awareness e-learning or an equivalent course. Train people when they join and then regularly, keep a dated record for each person, and be ready to show it in your toolkit submission.
Staff training is one of the DSPT items small organisations most often leave until the last minute, because it depends on other people finishing something. This guide explains what DSPT staff training is for, what counts, and how a dental practice, care provider or charity can record it simply. It is based on the Data Security and Protection Toolkit’s own pages, read on 31 October 2026.
What is DSPT staff training and who needs it?
DSPT staff training is the data security awareness training the toolkit expects every member of your team to have. The toolkit’s training guidance says that “all staff working in a health and care organisation need some understanding of information governance (IG) and cyber security”. Its help page on the national e-learning adds that this includes non-permanent staff with access to personal confidential information, such as locums, temporary staff and students.
In a small organisation that usually means everyone: clinicians, carers, receptionists, practice managers, office volunteers and anyone on a bank or agency contract who can open patient, resident or supporter records.
Which DSPT version and deadline apply now?
The 2026-27 toolkit is version 9, released on 1 September 2026 according to the toolkit’s release notes. The toolkit’s version 9 news item (2 October 2026) states that “the deadline for the Data Security and Protection Toolkit is 30th June 2027”. Our guide to the DSPT deadline for 2027 sets out a month-by-month plan.
What training counts for the DSPT?
The national option is the free Data Security Awareness Level 1 e-learning on e-Learning for Healthcare. The DSPT help page on the e-learning says the course is free, has five modules with an 80% pass mark for each, and issues a certificate once all five are passed.
You do not have to use it. The training guidance accepts a local equivalent and lists other formal options, such as in-house face-to-face training and external courses. What matters is that the training covers the same ground: handling personal data, keeping it confidential, spotting phishing and reporting incidents.
The help page on the e-learning describes the evidence as at least 95% of staff, including new starters, locums, temporary staff and students, completing annual training. The toolkit’s training guidance for the largest NHS organisations moved away from a fixed percentage in 2023 towards all staff having an “appropriate understanding” of information governance and cyber security. The safe plan for a small organisation is to train everyone, then check the exact wording of the training evidence item in your own version 9 assessment once you log in.
How often do staff need DSPT training?
For most small organisations, train people when they join and then once a year. The help page says organisations on the standard toolkit are “expected to train all their staff annually”, and the training guidance gives “on joining your organisation and annually thereafter” as an example. Annual training also fits neatly with the yearly submission, so one refresh each spring keeps everyone in date for June.
How should you record DSPT staff training?
Keep one simple training log that you could show to an auditor in two minutes. A spreadsheet is enough. For each person, record:
- Name and role
- Whether they are employed, bank, agency, a student or a volunteer
- Start date
- Course completed (national e-learning or your local course)
- Date completed and date due again
- Where the certificate or attendance record is kept
Save each e-learning certificate in one shared folder named by year, and add new starters on their first day so nobody slips through. When you complete the toolkit, the log becomes your evidence. Our DSPT step-by-step guide shows where it fits in the wider submission, and the DSPT guide for dental practices covers the sector specifics.
What if not everyone is trained in time?
Be honest in your submission and set a date to finish. An incomplete training item can mean your organisation is published as Approaching Standards with an improvement plan, rather than Standards Met. Our guide to Standards Met versus Approaching Standards explains the difference. The practical fix is to set your own internal deadline in April or May, not June.
How Unavoidably Secure can help
Unavoidably Secure, a product of Unavoidable Studio Ltd, offers a free external audit for dental practices, care providers and small charities. We review your website, email security and data basics and give you a plain-English list of what to fix first, which is useful material for training sessions because it shows staff the real risks to your own organisation. We do not certify, accredit or guarantee compliance; your DSPT submission remains your own.
FAQs
Is the NHS data security e-learning free?
Yes. The DSPT help pages confirm the national Data Security Awareness Level 1 e-learning is free. Staff complete it on e-Learning for Healthcare, which records the pass marks and issues a certificate once all five modules are passed.
Do volunteers and agency staff need DSPT training?
If they can see personal or confidential information, yes. The DSPT help pages say training covers non-permanent staff with access to that information, including locums, temporary staff and students. Add them to your training log the same way as employed staff.
Can we use our own training instead of the national e-learning?
Usually, yes. The toolkit accepts local equivalents, such as face-to-face sessions or an external course, as long as the training covers the same ground. Keep the course outline with your records so you can show what it covered.
What happens if some staff have not finished their training by the deadline?
Record the gap honestly and set a date to close it. Depending on the rest of your submission, an incomplete item can leave you at Approaching Standards with an improvement plan rather than Standards Met. It is far easier to fix in the spring than in the last week of June.
This article is general information, not legal advice. Facts come from the Data Security and Protection Toolkit’s training guidance, help pages, release notes and version 9 news item, read on 31 October 2026. Browse the blog for related guides.
Find your weak spots before the June deadline
Book a free external audit. We will review your website, email security and data basics, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day.