Tip · Digital and cyber · 2 Jun 2026 · 1 min read

DSPT for PCNs: who submits, the network or the lead practice

A PCN only completes its own Data Security and Protection Toolkit if it is a separate organisation. Otherwise its processing goes in a practice's return.

Tip
Digital and cyber
Practice managers
PCN leads
England

01 / What's changed

Nothing new. NHS England describes the DSPT as a mandatory annual self-assessment against the National Data Guardian's 10 data security standards.
The DSPT FAQs say a PCN should complete its own DSPT only if it is a separate organisation that processes health data and takes legal responsibility for that processing.
Where a member practice, such as the lead practice, takes that responsibility, that practice should include the PCN's processing in its own submission.

02 / Who it affects

PCN managers and clinical directors in England, and the practice manager of whichever practice holds the PCN's data responsibilities.

03 / What to do

Write down which organisation is legally responsible for the PCN's data processing, using your network agreement and data sharing arrangements.
If it is a member practice, make sure that practice's DSPT covers PCN activity, such as shared staff and network-wide services.
If the PCN is a separate body, register it in its own right. The FAQs say PCNs should choose the sector "Other (including charities and NHS Business Partners)".
Check that everyone working for the network, including staff shared across practices, has completed data security training, as NHS England expects for all staff with access to personal data.

01 / What's changed

02 / Who it affects

03 / What to do

The week's updates. Every Tuesday.