What is the purpose of the assessment?
The DSPT provides a mechanism for organisations to demonstrate that they can be trusted to maintain the confidentiality and security of personal information. This in turn increases public confidence that ‘the NHS’ and its partners can be trusted with personal data. This will minimise the number of individuals who 'opt out' of the sharing of their personal identifiable data.
Who needs to complete an annual DSPT Assessment?
All organisations that have access to NHS patient data and systems must provide assurance that they are practising good data security and that personal information is handled correctly. Using the Data Security and Protection Toolkit to evidence and publish an annual assessments provides this assurance.
Checking an Organisation's Compliance
The current DSPT status of participating organisations is publicly available.
The NDG Data Security Standards
The Data Security and Protection Toolkit was introduced in April 2018 and is the successor framework to the IG Toolkit. The IG Toolkit assessed performance against three levels (1, 2 and 3); organisations were required to provide evidence of compliance with (at least) level 2 for all elements of their assessment. The DSPT does not include levels, instead it requires compliance with assertions and (mandatory) evidence items within the 10 NDG Data Security Standards (listed below). The classification of Toolkit that an Organisation is required to complete is determined by their Organisational Type i.e. 'Large', 'Small' or 'General Practice'.
- Personal Confidential Data
- Staff Responsibilities
- Managing Data Access
- Process Reviews
- Responding to Incidents
- Continuity Planning
- Unsupported Systems
- IT Protection
- Accountable Suppliers
Individual 'Big Picture' Guides for the 10 Data Security Standards.
The Overall Guide to the Data Security Standards.