DSPT for software suppliers: who must complete it, Category 2 vs 3, the 30 June 2027 deadline, the IT Supplier audit and evidence. Updated for v9.
Short answer. The Data Security and Protection Toolkit (DSPT) is NHS England's annual online self-assessment against the National Data Guardian's 10 data security standards. If your software or your company has access to NHS patient data or NHS systems, you need a published DSPT status of Standards Met or Standards Exceeded, and NHS buyers check it during DTAC. The 2026-27 toolkit (version 9) is open now and the deadline is 30 June 2027. Most smaller software companies complete it as Category 3 ("Other"); companies with 50+ staff and £10m+ turnover that supply the NHS are IT Suppliers (Category 2) and need an independent audit every year.
This guide is for founders, CTOs and compliance leads at healthtech and software companies that sell to the NHS. It covers who needs the DSPT, which category you are in, what has changed for 2026-27, the evidence you will be asked for, how long it takes and how to build your product so the answers are easy.
Last checked: 2 November 2026.
This is a general guide for suppliers, not legal or regulatory advice. Magora is a software developer, not your regulatory advisor. NHS requirements change from time to time, so check the current version on the official pages linked below before you submit anything.
Who has to complete the DSPT?
NHS England's position is short: all organisations that have access to NHS patient data and systems must use this toolkit. Completing it is a requirement of the NHS Standard Contract, and it is needed to use national systems such as NHSmail and the e-Referral Service.
For a software supplier, the DSPT usually comes up in one of three ways:
- Through DTAC. NHS England's DTAC guidance says that for products with access to NHS systems or patient data, suppliers must complete and return the DSPT. The DTAC form asks for Standards Met or Exceeded for the current year. See our DTAC guide.
- Through the contract. The buyer's own DSPT asks it to check its suppliers, so procurement teams ask for your status and your DSPT organisation code.
- Through access to national services. Integrating with NHS systems often requires a published status first.
If your product never touches NHS patient data or NHS systems, for example a tool that only processes anonymous data, the DSPT may not apply. Write that position down and be ready to explain it to the buyer.
Category 2 or Category 3: which one is your company?
When you register you choose an organisation type, and that decides which version of the toolkit you see. For software companies the choice is between two categories:
| IT Supplier (Category 2) | Other (Category 3) | |
|---|---|---|
| Who | External organisations that supply digital goods or services to health and care and have 50+ staff and £10m+ turnover | Companies that do not meet all three criteria, including most startups and SME software suppliers |
| What you complete | Assertions and evidence items under the 10 data security standards | Assertions and evidence items under the 10 data security standards |
| Independent audit | Mandatory every year | Not mandated by the toolkit, though a buyer may ask for one |
| Scope | Only the health and care data you process, not the whole organisation | Only the health and care data you process, not the whole organisation |
Source: DSPT help page "Organisation types" for 2026-27. Large NHS bodies (Category 1) use a separate interface aligned to the NCSC Cyber Assessment Framework; suppliers keep the evidence-item view.
The scope point matters. You assess the systems, people and processes that handle health and care data, which for a product company usually means the product, its hosting, the team that supports it and the tools around it, not your whole business.
What changed for 2026-27?
- Version 9 is current. It was released on 1 September 2026 and the outcomes and evidence spreadsheets were published on 2 October 2026. The deadline is 30 June 2027. Version 8 (2025-26) closed on 30 June 2026.
- CAF alignment continues. Since September 2024 the toolkit has been based on the NCSC Cyber Assessment Framework for large NHS organisations; version 9 aligns to CAF 4.0. Suppliers still answer a list of controls, which NHS England maps to a CAF profile in the background.
- A products and services section. From October 2026 IT Suppliers see a new section about the products and services they supply, including a question about DTAC. The sector formerly called Supplier is now IT Supplier.
- A new audit scope for IT Suppliers, set out below.
The 2026-27 independent audit for IT Suppliers
If you are in Category 2, an independent auditor has to review a set of mandated assertions every year, using the toolkit's audit function. For 2026-27 NHS England lists these areas:
| Area | What the auditor looks at |
|---|---|
| 1.1 Data protection | Lawfulness, fairness and transparency of processing |
| 2.2 Staff contracts | Data security and confidentiality in staff contracts |
| 3.1 and 3.2 People | Staff understanding of data security, and an open and just culture for reporting |
| 4.1 Access | A record of staff roles and access |
| 6.2 Protection | Anti-virus and spam filtering |
| 7.1 Continuity | Incident response |
| 8.1 and 8.2 Technology | A survey of software and hardware, and no unsupported software |
| 9.2 Testing | A penetration test, properly scoped and carried out |
| 9.6 Network | Firewall configuration |
| 10.2 Suppliers | Due diligence on your own suppliers |
Source: DSPT news item on 2026-27 IT Supplier audit scope, 1 October 2026. ISO/IEC 27001 or Cyber Essentials Plus covering all health and care data you process reduces the audit to the items those certifications do not cover.
What evidence will you need?
Whatever your category, the questions follow the National Data Guardian's 10 standards: people, process and technology. In practice the evidence for a software product clusters into these groups:
| Group | Typical evidence for a software supplier |
|---|---|
| Governance | A named senior owner for data security and protection, policies, a record of the data you process and why, data protection impact assessments for the product |
| People | Confidentiality in contracts, data security training so that all staff understand their responsibilities (the old fixed 95% target was replaced in 2023-24), a way to report concerns |
| Access | Joiner, mover and leaver process, role-based access, multi-factor authentication for admin access, regular access reviews |
| Incidents | An incident response process, breach reporting through the DSPT within 72 hours where the ICO must be told, a tested continuity and backup plan |
| Technology | An asset list, patching, no unsupported software, anti-virus, firewall rules, a penetration test |
| Suppliers | A list of your own suppliers (hosting, email, support tools) with due diligence and contract terms |
NHS England publishes free templates for DPIAs, data sharing and processing agreements, information asset and data flow registers and privacy notices.
Standards Met, Exceeded, Not Met: what the statuses mean
| Status | What it means for a supplier |
|---|---|
| Standards Met | All mandatory evidence is in place. This is what DTAC and most buyers ask for. |
| Standards Exceeded | For organisations other than large NHS bodies: Standards Met plus a current Cyber Essentials Plus certificate recorded in the toolkit. |
| Approaching Standards | Used in specific cases where an organisation has an agreed improvement plan. Do not plan a sale around it. |
| Standards Not Met | Mandatory evidence is missing. Expect the buyer to pause the procurement. |
Source: DSPT help overview and FAQ. Certificates can be downloaded for Met and Exceeded.
We build patient-facing apps and clinical software with privacy and compliance designed in from the start. First release in 6–8 weeks; developers from £49/hour.
How to complete the DSPT for the first time
- Get an organisation code. Registration needs an email address and an ODS code for your organisation.
- Choose the right organisation type. Check the Category 2 criteria honestly. A wrong choice means the wrong questions.
- Define the scope. List the systems, data flows, people and suppliers that touch health and care data.
- Map evidence to each assertion. Use the version 9 spreadsheet for your category. Note gaps early, because some need time: a penetration test, Cyber Essentials, training records, a continuity test.
- Close the gaps. Most are policy and process, but some are engineering: access control, logging, patching, backups, encryption.
- Audit, if you are Category 2. Book the independent auditor early in the year, not in June.
- Publish and keep it current. Publish by 30 June, then republish whenever something material changes.
No official source gives a standard time for a first submission. In our experience the policy work is quick; the slow items are the ones that depend on other parties, such as a penetration test, certification and the audit, so start those first.
How to design your product so the DSPT is easy
Many DSPT answers are about how your product is built and run. If the architecture supports them from day one, the toolkit becomes paperwork rather than rework:
- Know your data. Keep an up-to-date map of every personal data field, where it is stored and who can see it.
- Least-privilege access with MFA for staff and admin users, and an audit trail on every patient record.
- Encryption at rest and in transit, with UK or EU hosting unless there is a documented reason otherwise.
- Patching and supported versions built into the release process, so "no unsupported software" stays true.
- Backups you have actually restored, and a continuity plan tested at least once a year.
- Penetration testing before launch and yearly after, on the same scope you declare in the toolkit.
At Magora we hold ISO/IEC 27001 certification and align hosting and access controls with the DSPT when we build health products. Your DSPT submission is still your own: it covers your organisation and your processing. We cover the wider picture of what NHS buyers ask for in NHS software compliance: DTAC, DCB0129 and DSPT.
What does it cost?
The DSPT pages do not list a fee to use the toolkit. The costs are in the work around it: staff time, a penetration test, Cyber Essentials or Cyber Essentials Plus if you choose it, an independent audit for Category 2, and any engineering needed to close gaps. Those third-party prices vary by provider, so get quotes rather than rely on averages.
If you are building a new NHS-facing product, the cheapest moment to make these decisions is Discovery. At Magora Discovery starts from £3,000 and a healthcare first release from £10,000; regulated, integration-heavy health platforms typically cost £80,000–£120,000 over 5–8 months. See how much healthcare software costs in the UK.
Building a product for the NHS? Send us a short brief: we will build a free working prototype of the core journey in 5–10 working days, and in Discovery map the data flows, hosting and controls your DSPT and DTAC answers depend on. More about our healthcare software development.
Frequently asked questions
What is the DSPT?
The Data Security and Protection Toolkit is NHS England's online self-assessment. Organisations use it to show they meet the National Data Guardian's 10 data security standards. All organisations with access to NHS patient data and systems must use it, and the result is published.
Do software suppliers need to complete the DSPT?
Yes, if the product or the company has access to NHS patient data or NHS systems. NHS England's DTAC guidance says suppliers of such products must also complete and return the DSPT, and DTAC asks for a status of Standards Met or Standards Exceeded.
When is the DSPT deadline?
Each organisation must publish at least one assessment by 30 June every year. The 2026-27 toolkit (version 9) was released on 1 September 2026 and its deadline is 30 June 2027.
Which DSPT category is a software company?
A company selects IT Supplier (Category 2) only if it has 50 or more staff, a turnover of £10 million or more, and supplies digital goods or services to health and care. A company that does not meet all three selects Other, which is Category 3.
Do IT suppliers need a DSPT audit?
IT Suppliers in Category 2 must complete an independent DSPT audit every year, using the toolkit's audit function. For 2026-27 the audit scope includes a penetration test, firewall, anti-virus, incident response, unsupported software and supplier due diligence. ISO 27001 or Cyber Essentials Plus can reduce the scope.
Is Cyber Essentials Plus mandatory for the DSPT?
No. It is not mandatory, but holding it exempts some questions, and for organisations other than large NHS bodies Standards Met plus a current Cyber Essentials Plus certificate gives the status Standards Exceeded.
What do the DSPT statuses mean?
Standards Met means the mandatory requirements are met. Standards Exceeded means more than that, for example Standards Met plus Cyber Essentials Plus for most organisations. Standards Not Met means mandatory items are missing. Approaching Standards is used in specific cases with an improvement plan.
Sources
- DSPT home page
- DSPT help: overview
- DSPT help: organisation types 2026-27
- DSPT news: 2026-27 version 9 spreadsheets (2 Oct 2026)
- DSPT news: IT Supplier audit scope 2026-27 (1 Oct 2026)
- DSPT news: changes and CAF alignment
- DSPT release notes
- DSPT FAQ
- NHS England: DTAC and other regulatory and assurance processes
Alexander Bessudnov
Alexander is an accomplished Chief Product Owner with a proven track record of leading successful product development initiatives at Magora. With a passion for innovation and a keen understanding of market trends, Alexander plays a pivotal role in shaping Magora's product strategy and ensuring the delivery of cutting-edge solutions to clients.
LinkedIn