Unavoidably Secure helps NHS and mixed dental practices in England get their Data Security and Protection Toolkit (DSPT) submission to Standards Met. We start with a free external audit, then assemble and check the evidence the toolkit asks for. Fixed fees: full audit from £950, standards readiness with support through to submission from £1,500.
On this page
Who this is for
This service is for practice managers and owners of dental practices with NHS work, or that use NHS systems such as NHSmail. Those practices are expected to complete the DSPT every year. The 2026-27 toolkit is version 9, and the submission deadline is 30 June each year, so 30 June 2027 for this round.
Purely private practices do not have to complete the DSPT, but they still hold special category health data and still have UK GDPR and PECR obligations. The same audit works for them; we simply map the findings to data protection law rather than the toolkit, as in our GDPR audit for small organisations.
If you want the background first, our plain-English guide to the DSPT for dental practices explains the ten standards and what changed in version 9.
What DSPT support involves
The DSPT is a self-assessment. Your practice submits it, not us. What we do is find out where you really stand, gather the evidence the questions ask for, and check it is good enough before you press submit. The toolkit has asked for outcome-based evidence since version 8, which means showing that a control actually operates, not just that a policy exists.
Our audit covers four areas:
| Area | What we look at |
|---|---|
| External attack surface | Everything about the practice reachable from the internet, assessed without access to your systems: encryption and certificates, email impersonation (SPF, DKIM and DMARC), known-vulnerable software, and forgotten test or staging sites. |
| Cookies, trackers and consent | What your website does before a visitor agrees to anything, whether refusing is as easy as accepting, and whether your cookie policy matches what actually happens. |
| Governance documentation | Processing records, privacy notice, retention, supplier contracts, breach readiness, impact assessments, and all ten DSPT standards. |
| Internal systems | Firewall, device encryption, patching, access control and multi-factor authentication, and backup isolation, assessed on evidence your IT provider produces. |
In total that is 26 automated technical checks and 59 documentation review criteria, mapped to all ten National Data Guardian standards behind the DSPT and all five Cyber Essentials controls.
The evidence the toolkit wants for staff training records, the digital asset register, multi-factor authentication on remote access and cloud systems, unsupported software, and written contracts with the suppliers who handle patient data. Most practices already do much of this. The work is finding and organising the proof.
What it costs
All fees are fixed and quoted after a short scoping call, so you know the cost before any work starts.
Your public web and email surface, assessed without any access to your systems. Written report within five working days.
All four components, evidence pack, remediation plan, and a re-test at 60 days.
Everything in the full audit, plus DSPT or Cyber Essentials evidence assembly and support through to submission.
Continuous monitoring, quarterly re-assessment, evidence kept current, annual submission handled.
For most practices facing a DSPT submission, standards readiness (from £1,500) is the relevant package, because it includes evidence assembly and support through to submission. The full audit (from £950) suits practices that want an independent check and a remediation plan but will complete the toolkit themselves. Ongoing assurance (from £250 a month) keeps the evidence current through the year and handles the annual submission, so next June is a short review rather than a rush.
For a wider view of what audits cost, including the official Cyber Essentials fees, see how much a cyber security audit costs for a small UK business.
How it works, step by step
- Scoping call. Thirty minutes, no charge and no obligation. What you hold, who asks you to prove it, and what deadline you are working to.
- Free external audit. We assess your public web and email presence and send you a written report within five working days.
- Written authorisation. Before anything active happens, we agree in writing exactly what will be tested, when, and how to stop it.
- Full audit. Usually two to three weeks: technical assessment, documentation review and evidence assembly.
- Report and walkthrough. We talk you through the findings in plain terms, with your IT provider present if that helps.
- Re-test and upkeep. A re-test at 60 days, then optional ongoing assurance to keep evidence current.
Start with the free external audit
We assess your practice's public web and email setup and show you where you stand. No charge, no obligation, and no access to your systems.
Request your free auditOr email support@unavoidablysecure.com
What we do not do
We are independent, so we check and evidence rather than sell you hardware or software. Your IT provider carries out the technical fixes, and we are happy to work alongside them. We refer out physical security, in-depth manual penetration testing (we can introduce a CREST-registered partner), and legal advice or acting as your Data Protection Officer.
We are not a Cyber Essentials certification body, and no assessment certifies compliance with any standard. What we do is prepare you so the DSPT submission, or a Cyber Essentials certification with a certification body, goes through first time.
Common questions
Do you submit the DSPT for our practice?
No. Your practice submits the DSPT. We assess readiness, assemble the evidence and support you through to submission on the standards readiness package, which starts from £1,500.
How much does DSPT support for a dental practice cost?
The external audit is free. A full audit starts from £950, standards readiness with support through to submission starts from £1,500, and ongoing assurance starts from £250 a month. All fees are fixed and quoted after a scoping call.
When is the DSPT deadline for dental practices?
The toolkit deadline is 30 June every year. For the 2026-27 toolkit (version 9) that is 30 June 2027.
Do you need access to our systems?
Not for the free external audit, which only reviews what the public can see. Paid audits rely on evidence your IT provider produces, and no active testing happens without signed written authorisation.
How long does it take?
The free external audit report arrives within five working days. A full audit usually takes two to three weeks.
Can you help us reach Standards Exceeded?
The toolkit guidance says an organisation that reaches Standards Met and records a current Cyber Essentials Plus certificate can reach Standards Exceeded. We can prepare your evidence for both, but the Cyber Essentials Plus certificate itself is issued by a certification body, not by us.
This page is general information, accurate at the time of writing (October 2026), and is not legal advice. No assessment certifies compliance with any standard. Unavoidably Secure is not a Cyber Essentials certification body. Fees are fixed and quoted after a scoping call.