DSPT for dental practices: a plain-English guide

If you run or manage a dental practice with any NHS work, the Data Security and Protection Toolkit is one of those jobs that arrives every year, feels bigger than it should, and usually lands on the person with the least spare time. This guide explains what it actually asks for, in plain terms, and what changed in the latest version that catches practices out.

What the DSPT is

The Data Security and Protection Toolkit, usually shortened to DSPT, is an annual online self-assessment run by NHS England. It asks your organisation to confirm, and evidence, that you are handling patient and staff data safely. It is built on the ten data security standards set out by the National Data Guardian, and it applies across health and care, not just to dental practices.

In practice it is a set of questions grouped under those ten standards. You answer each one, and for many of them you now have to attach or point to evidence that backs up your answer.

Which practices have to do it

The simplest way to think about it: if you touch NHS systems or hold an NHS contract, you are in scope.

Practice type	DSPT required?
NHS dental practice	Yes
Mixed NHS and private	Yes
Uses NHSmail	Yes
Purely private, no NHS systems	No DSPT, but UK GDPR and PECR still apply

Even where the DSPT itself does not apply, a private practice still processes special category health data and still has to meet UK data protection law. The DSPT is the NHS's way of checking it; the underlying obligations exist regardless.

The deadline

The annual submission deadline is 30 June, which for the 2026-27 toolkit means 30 June 2027. The toolkit reopens for the new assessment year in the autumn, so there is a long window to work in. The trap most practices fall into is leaving it until spring, when the evidence gathering collides with everything else and becomes a fortnight of evenings.

The ten standards

The DSPT is organised around the ten National Data Guardian standards. In plain terms:

#	Standard, in plain English
1	Personal confidential data is handled, stored and sent securely
2	Staff understand their responsibilities for data security
3	All staff complete appropriate data security training each year
4	You manage who has access to which systems, and remove leavers promptly
5	Processes are reviewed at least annually, and after any incident
6	You can detect, respond to and report a data security incident
7	You have a tested plan for continuing if IT systems go down
8	No unsupported software, operating systems or browsers are in use
9	Your IT is protected against cyber threats
10	Suppliers who handle your data are held to account by contract

What changed in version 9 (2026-27)

Version 9 is the 2026-27 edition of the toolkit. NHS England released it on 1 September 2026, and published the full list of outcomes, assertions and evidence items as a spreadsheet on 2 October 2026. For a dental practice it is a refinement rather than a rewrite.

The official release notes list these changes:

• Products and services: a new question asks whether your organisation provides products or services, with a page to view and manage them.
• Supplier wording: the term "IT supplier" has changed to "supplier" throughout the toolkit.
• Policy items: the MFA policy wording and template for outcome B2.a have been updated, and a mandatory Extended Detection and Response (XDR) policy has been added. These items sit in the Cyber Assessment Framework aligned version of the toolkit, so they may not appear in the standards-based assessment that most dental practices complete.
• CQC Market Oversight: added support for larger care providers in that scheme. This does not affect dental practices.

The release notes do not list any change aimed specifically at dental practices. If you submitted last year, most of your evidence carries over, but it still has to be current for 2026-27.

What still applies from version 8

Version 8, released in September 2025 and aligned to the National Cyber Security Centre's Cyber Assessment Framework, moved the DSPT to outcome-based evidence. That approach continues in version 9. You cannot simply assert that you have a policy; you have to show the control actually operates.

Version 8 also brought in, for Category 3 organisations (which includes dental practices), two things that trip people up in their first year, and both still apply:

• A digital asset register: a list of all the hardware and software you use. An existing information asset register can usually be extended rather than started from scratch.
• Multi-factor authentication: on remote access and on cloud systems that hold patient data. Most providers include this at no extra cost, but it has to be switched on and evidenced.

For the full list of version 9 changes, see our DSPT 2026-27 version 9 changes guide. If you want help with the evidence, see DSPT support for dental practices.

What happens if you do not do it

The consequences are concrete rather than theoretical:

• Practices that do not submit, or fail to meet the standard, can lose access to NHS systems including NHSmail.
• DSPT status is checked by CQC during inspections.
• It is increasingly expected by local commissioners and by anyone doing supplier due diligence on you.
• Failure to submit can attract enforcement action.

There is also a quieter benefit to getting it right: an organisation that can show a dated, evidenced record of its data security is in a far stronger position if it ever suffers a breach, because the Information Commissioner weighs demonstrable diligence when deciding how to respond.

How to reach Standards Met

The reassuring truth is that most practices already do six or seven of the ten standards in some form. The work is rarely putting new controls in place. It is finding and organising the evidence that the controls you already have actually operate, which is exactly what the toolkit has asked for since version 8.

A sensible order:

1. Build or update your digital asset register first, because several other answers depend on it.
2. Turn on and evidence multi-factor authentication, since it is mandatory and quick.
3. Gather your training records, named individual by named individual.
4. Check nothing unsupported is still running (old Windows versions are the usual culprit).
5. Confirm you have written contracts with the suppliers who touch your data.
6. Work through the remaining standards, attaching evidence as you go.

Common questions

This guide is general information, accurate at the time of writing, and is not legal advice. Requirements are set by NHS England and can change; always check the current guidance on the DSP Toolkit website for your organisation category.