DSPT 2026/27 version 9 published: submit by 30 June 2027
The 2026/27 Data Security and Protection Toolkit standard is out. GP practices have until 30 June 2027 to publish their assessment.
Topic
Digital and cyber
Digital and cyber security updates for GP practices: DSPT, online access, data security and NHS digital changes.
GP IT operating model update: practice servers to move to cloud
Version 6.02 of the GP digital services operating model says remaining practice servers should move to secure cloud services by 31 March 2027.
Data breaches: what to report, and when, within 72 hours
Reportable personal data breaches must reach the ICO within 72 hours of you becoming aware. Every breach needs recording, reported or not.
Subject access requests: how the one-month clock works
Patients can ask for their records verbally or in writing. Here is when the one-month response clock starts, pauses and can be extended.
Online record access: check each new entry before patients see it
Practices in England must give patients online access to new record entries. Staff need to know when and how to hide an entry.
DSPT for PCNs: who submits, the network or the lead practice
A PCN only completes its own Data Security and Protection Toolkit if it is a separate organisation. Otherwise its processing goes in a practice's return.