Deadline · Digital and cyber · 2 Oct 2026 · 1 min read

DSPT 2026/27 version 9 published: submit by 30 June 2027

The 2026/27 Data Security and Protection Toolkit standard is out. GP practices have until 30 June 2027 to publish their assessment.

Deadline 30 Jun 2027

01 / What's changed

The DSPT standard for 2026/27 (version 9) was published on 2 Oct 2026.
GP practices are category 4 organisations. Their requirements are in the assertions and evidence spreadsheet for categories 2, 3 and 4, now at v1.1.
Version 1.1 updates requirement 10.2.1 for category 3 and 4 organisations.

Every GP practice in England that completes the DSPT, and PCN leads who support practices with information governance.

Download the version 9 assertions and evidence spreadsheet for categories 2 to 4 and read the change log against version 8.
Check what requirement 10.2.1 now asks for, and who in the practice will provide the evidence.
Book your data security lead onto a DSPT webinar. Sessions for GPs and other smaller organisations run on Tuesdays from 20 Oct 2026 to 15 June 2027, 12:30 to 13:15.
Set an internal target date well before the deadline so evidence can be gathered without a rush in June.

The 2026/27 toolkit must be published by 30 June 2027.