# DSPT for PCNs: who submits, the network or the lead practice

> A PCN only completes its own Data Security and Protection Toolkit if it is a separate organisation. Otherwise its processing goes in a practice's return.

- Published: 2 Jun 2026
- Type: Tip
- Topic: Digital and cyber
- For: Practice managers, PCN leads
- Applies to: England
- Review: Reviewed by the Abtrace team
- Web page: https://ontherecord.abtrace.com/posts/dspt-pcn-who-submits/

## What's changed

- Nothing new. NHS England describes the DSPT as a mandatory annual self-assessment against the National Data Guardian's 10 data security standards.
- The DSPT FAQs say a PCN should complete its own DSPT only if it is a separate organisation that processes health data and takes legal responsibility for that processing.
- Where a member practice, such as the lead practice, takes that responsibility, that practice should include the PCN's processing in its own submission.

## Who it affects

PCN managers and clinical directors in England, and the practice manager of whichever practice holds the PCN's data responsibilities.

## What to do

- Write down which organisation is legally responsible for the PCN's data processing, using your network agreement and data sharing arrangements.
- If it is a member practice, make sure that practice's DSPT covers PCN activity, such as shared staff and network-wide services.
- If the PCN is a separate body, register it in its own right. The FAQs say PCNs should choose the sector "Other (including charities and NHS Business Partners)".
- Check that everyone working for the network, including staff shared across practices, has completed data security training, as NHS England expects for all staff with access to personal data.

## Sources

- [DSPT: Frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions)
- [NHS England: Information governance and data protection](https://www.england.nhs.uk/long-read/information-governance-and-data-protection/)

Published by Abtrace on On the Record (https://ontherecord.abtrace.com/). Summaries only; always check the linked source.