# DSPT 2026/27 version 9 published: submit by 30 June 2027

> The 2026/27 Data Security and Protection Toolkit standard is out. GP practices have until 30 June 2027 to publish their assessment.

- Published: 2 Oct 2026
- Type: Deadline
- Topic: Digital and cyber
- For: Practice managers, PCN leads
- Applies to: England
- Deadline: 30 Jun 2027
- Review: Reviewed by the Abtrace team
- Web page: https://ontherecord.abtrace.com/posts/dspt-2026-27-version-9-published/

## What's changed

- The DSPT standard for 2026/27 (version 9) was published on 2 Oct 2026.
- GP practices are category 4 organisations. Their requirements are in the assertions and evidence spreadsheet for categories 2, 3 and 4, now at v1.1.
- Version 1.1 updates requirement 10.2.1 for category 3 and 4 organisations.

## Who it affects

Every GP practice in England that completes the DSPT, and PCN leads who support practices with information governance.

## What to do

- Download the version 9 assertions and evidence spreadsheet for categories 2 to 4 and read the change log against version 8.
- Check what requirement 10.2.1 now asks for, and who in the practice will provide the evidence.
- Book your data security lead onto a DSPT webinar. Sessions for GPs and other smaller organisations run on Tuesdays from 20 Oct 2026 to 15 June 2027, 12:30 to 13:15.
- Set an internal target date well before the deadline so evidence can be gathered without a rush in June.

## Deadline

The 2026/27 toolkit must be published by 30 June 2027.

## Sources

- [DSPT: Outcomes, Assertions and Evidence items for the Data Security and Protection Toolkit 2026-27 version 9](https://www.dsptoolkit.nhs.uk/News/169)
- [DSPT: DSPT webinars for 2026-7](https://www.dsptoolkit.nhs.uk/News/webinars-v9)

Published by Abtrace on On the Record (https://ontherecord.abtrace.com/). Summaries only; always check the linked source.