Data Security and Protection Toolkit (DSPTK) 2026 Deadline Tuesday 30 June 2026

The Data Security and Protection Toolkit is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards. All organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly. This system is subject to ongoing development.

Community pharmacy owners are encouraged to complete the DSPTK as soon as possible. The deadline for completing the mandatory questions in the Toolkit 2026 is 30th June 2026.

The completion of the DSPTK is a contractual requirement under Regulation 18 of The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009 and in accordance with Schedule 4 Part 4 paragraph 35 (4) of the National Health Services (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013 and failure to complete the DSPTK within the deadline given, may lead to further contractual sanctions.

What’s new in the 2026 Toolkit

• A new question confirming whether multi‑factor authentication (MFA) is used with your clinical IT systems

• Improved layout for easier navigation

• Clearer question wording and enhanced pharmacy‑specific tips

• Previous year’s answers displayed for many questions, allowing teams to quickly confirm accuracy or update where needed

• Continued availability of the NHS Parent Organisation Code (POC) HQ batch submission feature, enabling owners of three or more pharmacies to complete a single submission for all premises

Community Pharmacy England has published updated guidance to support community pharmacy owners in completing the DSPTK 2026 the link is here: CPE DSPTK

Reminders

The NHS Digital Operations and Service Management team email all contractors when the yearly DSPTK assessment is released and ready for completing.  They also email again at the beginning of the year to remind contractors of the June deadline for completion. All NHS organisations receive the same number of notifications from The NHS Digital Operations and Service Management team.

The SW CCHub will send out reminders for contractors to submit their DSPTK. We advise you share with the wider team and record the dates in diaries. Please note the SW CCHub will not be chasing individual contractors for outstanding DSP Toolkit submissions