Standards and assurance
NHS DSPT Standards Exceeded
Built for the organisations that keep the NHS running
The DSPT is the NHS’s annual assessment against the National Data Guardian’s 10 data security standards. Each year, organisations working with NHS data and systems must review and publish how they meet those standards, covering everything from staff training and access controls to incident response and supplier management. For NHS trusts, integrated care boards and health partners, our status removes a step from supplier due diligence and gives confidence that our security operations meet the expectations of the health and care system.
"We protect organisations that deliver vital health and care services, so we hold ourselves to the NHS’s own standards. Reaching Standards Exceeded every year we publish shows that data security isn’t a box we tick. It’s how we operate.”
- Andy Kays, CEO, Socura
What the DSPT assesses
- People: Making sure everyone who handles data understands their responsibilities, with annual data security training and clear accountability for keeping personal information confidential.
- Process: Controlling who can access data, reviewing processes regularly so issues are identified and fixed, and having tested plans to respond to incidents and keep services running.
- Technology: Removing unsupported systems, protecting IT systems against cyber threats, and holding the IT suppliers we rely on accountable for their own security.
A track record you can check
We have published at Standards Exceeded in every DSPT assessment we’ve submitted since 2020, most recently for 2025-26. The assessment is renewed every year, and the NHS register shows our full publication history. Our DSPT status sits alongside our ISO 27001 and Cyber Essentials Plus certifications, giving NHS and public sector buyers one clear view of how we protect their data. Maintaining Standards Exceeded is also one of our commitments as a signatory of the NHS Cyber Security Charter.
