DSPT support for care homes and domiciliary providers
Protect resident data, meet DSPT requirements and get a clearer view on what actually needs to be in place across your systems, staff and devices.
Protect your residents. Protect your service users. Meet DSPT with confidence.
The Data Security and Protection Toolkit (DSPT) is how care providers show they are handling sensitive information safely, securely and responsibly.
If your organisation handles NHS data, shares care records, or connects with health services, DSPT is not optional. It is an annual requirement that demonstrates you are meeting the National Data Guardian’s data security standards.
The challenge is not understanding what DSPT is. It is knowing whether your systems, staff and processes actually meet those expectations.
It is not just a form. It is evidence.
DSPT is a self-assessment that measures how well your organisation protects data across people, processes and technology.
It covers more than cyber security. It includes how information is handled, shared, stored and protected across your entire service.
Most organisations are closer than they think, but not quite there.
Policies exist, but are outdated
Documents are in place, but not aligned with how systems are actually used today.
Technical controls are partial
MFA might be enabled, but monitoring, backup or endpoint protection is unclear.
Evidence is missing
The work may be happening, but proving it for DSPT is the difficult part.
Shared accounts still exist
Common in care settings, but a known risk under DSPT requirements.
Staff under pressure
Phishing emails and mistakes happen in busy environments.
Last-minute submissions
DSPT becomes a scramble instead of a structured process.
In simple terms: review → fix → evidence → support.
- Review your current DSPT position and likely gaps
- Check systems, access, devices and backups
- Highlight what is missing or unclear
- Help fix the practical issues
- Support documentation and evidence
- Guide your DSPT submission
- Provide ongoing reviews and support
The 10 areas your organisation is expected to get right.
DSPT is based on the National Data Guardian’s 10 data security standards. In practice, that means showing that the way your organisation works is safe, controlled and accountable.
People and access
- Staff understand their responsibilities around data
- Access is based on roles, not shared logins
- Leavers and agency staff access is removed quickly
Data handling
- Care records are handled and shared securely
- Sensitive information is protected at all times
- Clear policies are in place and followed
Systems and devices
- Laptops, tablets and mobiles are protected
- Systems are kept up to date
- Care platforms are accessed securely
Email and communication
- Protection against phishing and impersonation
- Staff know how to recognise suspicious messages
- Processes exist for reporting issues quickly
Monitoring and response
- Unusual activity can be identified early
- There is a clear response process
- Incidents are managed and recorded properly
Backup and recovery
- Critical data is backed up
- Systems and records can be restored if needed
- Services can continue after an incident
Suppliers and third parties
- External providers are assessed and managed
- Data sharing is controlled
- Risks from third parties are understood
Policies and governance
- Policies reflect how the organisation actually works
- Responsibilities are clearly defined
- Leadership understands the risks
Training and awareness
- Staff receive regular training
- Awareness is practical, not just a tick-box
- Common risks are understood across the team
Evidence and accountability
- You can show what is in place, not just say it
- Records, logs and documentation support your answers
- DSPT submission reflects reality, not assumptions
Clear, practical protection across your organisation.
Most care providers are not starting from scratch. The goal is to move from “we think we’re okay” to “we can show this is in place”.
Access and accounts
- Named accounts instead of shared logins
- Multi-factor authentication in place
- Old staff and agency accounts removed promptly
Devices and systems
- Laptops, tablets and mobiles protected
- Care systems accessed securely
- Updates and patching managed properly
Email and communication
- Protection against phishing and impersonation
- Clear process for reporting suspicious messages
- Reduced risk of fake supplier or authority emails
Backup and recovery
- Microsoft 365 data backed up
- Care records recoverable if needed
- Confidence that services can continue after an incident
DSPT is about trust as much as compliance.
Resident and service user trust
People expect their information to be handled safely and securely.
Regulatory expectations
CQC, local authorities and NHS partners expect DSPT compliance.
Access to systems
DSPT supports access to NHSmail and shared care records.
Small gaps can turn into bigger problems.
Most issues we see are not caused by negligence. They are caused by busy teams, shared access, legacy setups and assumptions that “it’s probably fine”.
- Delayed or incomplete DSPT submissions
- Difficulty accessing NHS systems or shared records
- Cyber insurance questions that are hard to answer
- Unexpected issues during audits or reviews
- Disruption if systems or accounts are compromised
Get clarity on where you stand and what to fix next.
Whether you are starting DSPT, renewing it, or trying to make sense of the requirements, we can help you turn it into a clear, manageable process.
Questions care providers often ask about DSPT.
Do we actually need to complete DSPT?
If your organisation handles NHS data, uses NHSmail, accesses shared care records, or works with NHS or local authority partners, then yes, DSPT is usually required. Even where it is not mandatory, many organisations still use it to demonstrate good data security practice.
We completed DSPT last year. Do we need to do it again?
Yes. DSPT is an annual submission. Each year should reflect your current systems, processes and risks, not just a copy of the previous submission.
Is DSPT just about policies and paperwork?
No. Policies are part of it, but DSPT is about how your organisation actually operates. That includes systems, access, devices, staff awareness and how you respond to issues.
What happens if we get it wrong?
Incomplete or inaccurate submissions can lead to delays, questions from partners, or difficulty accessing certain systems. More importantly, it can highlight gaps that may affect how safely data is handled day to day.
We have IT support already. Do we still need help with DSPT?
Often, yes. IT providers typically keep systems running. DSPT requires a wider view across access, data handling, policies, evidence and cyber security controls. We can work alongside your IT provider to cover those areas.
How long does DSPT support take?
It depends on your starting point. Some organisations need a light review and a few fixes. Others need more structured support. We aim to make the process clear and manageable rather than overwhelming.
Can you help us understand what evidence we need?
Yes. A big part of DSPT is being able to show what is in place. We help translate your setup into clear, usable evidence that supports your submission.
Is this suitable for small care providers?
Yes. DSPT applies to organisations of all sizes. The approach can be scaled so smaller providers get the right level of support without overcomplicating things.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.