DSPT 2026-27 deadline: 30 June 2027

What has been published

On 2 October 2026, the DSPT site published the outcomes, assertions and evidence items for the 2026-27 toolkit, version 9. There are separate downloads for:

IT suppliers (category 2);
category 3 organisations, which include social care, local authorities, dentists, opticians, pharmacies, universities and others;
category 4 (GP practices);
larger NHS and other bodies, which use a version aligned to the National Cyber Security Centre's Cyber Assessment Framework (CAF) version 4.0.

A change log comparing version 8 (2025-26) with version 9 (2026-27) is included. An update to version 1.1 of the documents changes requirement 10.2.1 for category 3 and 4 organisations. Care providers should check the change log rather than assume last year's answers still fit.

The DSPT site also lists mandatory audit areas for 2026-27, but these apply to NHS trusts, integrated care boards and similar bodies, not to social care providers.

Where the sector stands

At the 30 June 2026 deadline, almost 76.5% of CQC-registered adult social care services in England had an up-to-date DSPT, according to figures from Digital Care Hub reported by Care Management Matters. That was 22,429 services: 12,887 care homes and 9,562 home care services. The same report put the figure at just 15% in 2021, and said almost 14,500 services had published a toolkit for at least three years in a row.

That leaves roughly one in four services without an up-to-date toolkit.

Why it matters

The DSPT is how health and care organisations show they handle data and IT securely. Digital Care Hub describes it as "widely recognised by CQC, local authorities and the NHS", and it gives you a structured, once-a-year way to check your own data protection and cyber security.

Recent alerts show why the basics matter. On 22 October 2026, Digital Care Hub warned care providers about a critical security issue affecting PHP, which runs many websites. Patch management, supplier checks and staff awareness are all things the toolkit asks about.

Help available

Digital Care Hub updated its free data protection e-learning for social care on 14 October 2026. There is a course for all staff and another for data protection leads. The new version covers areas such as phishing, passkeys and two-step verification, approved AI tools, and supplier checks. Digital Care Hub says the courses can help providers meet the DSPT's training requirements.

What this means for your service

Download the category 3 version 9 documents and the version 8 to 9 change log from the DSPT site, and note what has changed.
Diary the deadline: 30 June 2027. Aim to finish well before the deadline rather than in the final weeks.
Re-check last year's evidence. Don't roll forward answers without checking they are still true, especially staff training, backups, user accounts and who has admin access.
Talk to your IT and software suppliers. Ask how they support your toolkit answers, and how quickly they apply security patches.
Train staff. Free e-learning is available for staff and data protection leads.
If you didn't publish last year, start now: a first submission takes longer.

Sources

NHS England, DSPT news: Outcomes, Assertions and Evidence items for the Data Security and Protection Toolkit 2026-27 version 9 (2 Oct 2026): https://www.dsptoolkit.nhs.uk/News/169 (checked 27 Oct 2026)
NHS England, Data Security and Protection Toolkit news page: https://www.dsptoolkit.nhs.uk/News (checked 27 Oct 2026)
Care Management Matters, Record number of Data Security and Protection Toolkits in place (2 Jul 2026, figures from Digital Care Hub): https://www.caremanagementmatters.co.uk/record-number-of-data-security-and-protection-toolkits-in-place/ (checked 27 Oct 2026; second source)
Digital Care Hub, Fully updated: free data protection elearning for social care (14 Oct 2026): https://www.digitalcarehub.co.uk/fully-updated-free-data-protection-elearning-updated-for-social-care/ (checked 27 Oct 2026)
Digital Care Hub, Data Security and Protection Toolkit guidance page: https://www.digitalcarehub.co.uk/data-and-cyber-security/data-security-and-protection-toolkit/ (checked 27 Oct 2026)
Digital Care Hub, Alert: Critical security issue (22 Oct 2026): https://www.digitalcarehub.co.uk/alert-critical-security-issue/ (checked 27 Oct 2026)

How we report: our editorial standards · corrections