A home care agency holds health information about every person it supports, and much of it now travels on carers' phones. The Data Security and Protection Toolkit (DSPT) is the online self-assessment where you show how that information is kept safe. It is free, it is run by NHS England, and for adult social care it is the evidence CQC, councils and the NHS look for.
This guide covers home care in England. Scotland, Wales and Northern Ireland have their own regulators, set out in home care compliance in the four UK nations. For hands-on help, the free Better Security, Better Care programme run by Digital Care Hub is the place to start.
What the DSPT is
NHS England's standards directory entry for the DSPT describes it as an online tool that lets organisations measure their performance against the data security and information governance requirements set by the Department of Health and Social Care, notably the National Data Guardian's 10 data security standards and the National Cyber Security Centre's Cyber Assessment Framework.
CQC's page on handling personal information summarises what those standards include: sharing data only for lawful and appropriate reasons, regular data security training for staff, access only for people who need it for their job, a plan for threats to data security, no unsupported software, a strategy for protecting IT systems, and contracts that hold IT suppliers to account.
It is a self-assessment. You answer the questions, upload or describe your evidence, and publish. Digital Care Hub's publishing guide says the only information made public is that you completed the toolkit on a particular date and the level you reached.
Does a home care agency have to complete it?
CQC's guidance on assessing digital record systems says it considers records under the well-led key question, in the quality statement on governance, management and sustainability, and that "we expect providers to demonstrate compliance with the Data Security and Protection Toolkit (DSPT) or equivalent. This should be completed annually."
CQC's principles for digital records say the same applies where you use a mix of digital and paper records. Moving to paper does not take you out of scope.
Providers that deliver care under the NHS Standard Contract must register with the toolkit. The DSPT also opens doors. Digital Care Hub's page for tech suppliers says a care provider must have reached at least Standards Met before it can use shared NHS systems such as GP Connect.
The 2026-27 toolkit at a glance
- Version and deadline. The DSPT team's version 9 announcement says the 2026-27 toolkit is version 9 and the deadline is 30 June 2027.
- Questions. Digital Care Hub's guide to answering the questions says Standards Met needs 45 mandatory questions, grouped under staffing and roles, policies and procedures, data security, and IT systems and devices.
- What is new. Digital Care Hub says version 9 adds no new questions for care providers. Some wording and tool tips have changed, and question 10.2.1 on IT suppliers has moved from a tick box to a written answer.
- How often. You must review and republish at least once a year. A toolkit that has not been republished cannot be used as evidence of your current arrangements.
Standards Met or Approaching Standards
All care providers should aim for Standards Met. If you are completing the DSPT for the first time and cannot answer all 45 questions yet, Digital Care Hub says you can publish at Approaching Standards by answering the 26 questions that are mandatory at that level, and the toolkit will generate an action plan for the rest.
There are two limits. Its before you start page says you can only publish at Approaching Standards once, and its publishing guide says a republished toolkit must be at least Standards Met. You do not have to wait for the next toolkit year to move up.
Providers that reach Standards Met or Standards Exceeded can download a certificate showing the level, the toolkit year and the publication date, which is worth keeping with your CQC evidence and sharing with commissioners.
Before you start: codes, registration and policies
Digital Care Hub's checklist says you need three things to register:
- An email address. It suggests a generic one rather than a personal address.
- Your ODS code. This is the organisation code CQC registration gives you. Its ODS code guide says a home care agency working from one office should normally register with its five-character site code, which usually starts with V. A group completing one toolkit for several branches should use its head office code, which usually starts with A or C.
- Your ICO registration number. Every organisation that processes personal data must register with the Information Commissioner's Office.
A new agency whose CQC registration is still pending will not have an ODS code yet, so the DSPT is a job for just after registration. Our CQC registration guide covers the steps before that.
The same checklist lists the policies and contracts needed for Standards Met. These include:
- a data protection policy and a privacy notice
- a record of processing activities and an information asset register
- record keeping (retention), data quality, data security and network security policies
- a smartphone policy, for either carers' own phones or phones the agency provides
- a training needs analysis and a data security audit checklist
- a digital asset register
- a business continuity plan for data and cyber security
- contracts covering third parties that process data for you and the secure disposal of personal data, a staff confidentiality clause, and a privileged access agreement for IT administrators
Digital Care Hub publishes free templates for these. Write them for how your agency actually works, then make sure staff have read them.
The questions home care agencies find hardest
Most of the toolkit is common sense written down. A few areas need more thought in home care, because the work happens in other people's homes on mobile devices.
Carers' phones
If carers use their own phones for the care app, the smartphone policy needs to say so and set the rules: a screen lock, keeping the phone's software updated, and what happens when a carer leaves or loses the phone. The carer app guide covers what to ask about the app itself, including offline records stored on the phone.
Who can see what
The National Data Guardian standards limit access to the people who need it for their job. In home care that usually means a carer sees the people they visit, office staff see what their role needs, and family members see only their own relative. Check that your systems can do this, and that leavers lose access on the day they leave.
Training
Staff need data security training, and the toolkit asks about it. Digital Care Hub offers free e-learning for care workers and data protection leads. Record it alongside the rest of each carer's training, as covered in our mandatory training guide.
When the system is down
CQC's digital records principles say you should have a plan for data breaches, loss and cyber-attacks, and contingency plans so essential information is available if the digital system cannot be reached. For a home care agency, the test is simple: if the care app stops working at 7am, do carers still know who to visit, which medicines are due and what the care plan says?
Question 10.2.1: assuring your IT suppliers
This is the question that changed most for 2026-27. Digital Care Hub's guide to the policies and procedures questions shows the new wording: "How does your organisation assure that your IT system suppliers have robust cyber security arrangements?"
Its tool tip lists certifications you can check:
- Cyber Essentials, ideally Cyber Essentials Plus, which you can confirm on the IASME website.
- ISO 27001, for which you can ask to see the certificate.
- The supplier's own DSPT, ideally Standards Exceeded, which you can search on the toolkit website.
Digital Care Hub's page on managing your suppliers adds that a digital social care record supplier on the NHS Assured Solutions List has been assured by NHS England. Where a supplier has no recognised certification, it suggests asking about where your data is held, access control and encryption, security testing, backups and how often they are tested, and what happens when something goes wrong. It also suggests writing minimum cyber security requirements into the contract.
Apply this to every system that holds personal data: the care planning and rostering software, payroll and HR, email, and your IT support company. Then write down what you checked. That written record is now your answer to 10.2.1.
The same applies to us. Our security page sets out where HomecareOS stores care records, how they are protected, and what we do not yet hold: HomecareOS is not yet certified to Cyber Essentials or ISO 27001 and has not yet had an independent penetration test. The hosting providers it runs on, Supabase and Vercel, hold ISO 27001 certification and SOC 2 Type 2 reports, which cover those providers rather than HomecareOS itself. We are happy to walk your data protection lead through it so you can complete 10.2.1 accurately.
A yearly routine that keeps the DSPT current
The toolkit is easier if it is not a June scramble. A simple pattern:
- When the new version opens (version 9 is the 2026-27 edition), read what changed and note any questions that need fresh evidence.
- Through the year, keep the asset register, supplier checks and training records up to date as things change, such as a new system, a new branch or a new phone policy.
- At least once a year, review every answer, update anything that has changed, and republish before 30 June.
- After publishing, download your certificate and your answers, and share them with managers so they know what the agency has said it does.
Remember that the DSPT records what you say you do. CQC will look at whether you do it: whether records are accurate, whether staff understand their responsibilities, and whether information is shared safely. The risk assessment guide and safeguarding guide cover two areas where data protection and day-to-day care meet.
Where HomecareOS helps
HomecareOS includes a policy and procedure library with a record-keeping and confidentiality policy covering UK GDPR duties. You can edit it in your own words, push it to staff and see who has acknowledged it, by name and date. In the app, carers see only the people they visit and family logins see only their own relative. Medication records cannot be edited or deleted by agency staff, and a correction to a care note keeps the reason and the original wording.
None of that completes the DSPT for you. It gives you evidence for several of its questions, in one place. Book a demo or call 01905 674704 to see it.
Sources
- Data Security and Protection Toolkit, the NHS England self-assessment site.
- DSPT 2026-27 version 9 announcement, for the version number and the 30 June 2027 deadline.
- NHS standards directory: Data Security and Protection Toolkit, for what the toolkit measures.
- CQC: assessing and inspecting digital record systems, for CQC's expectation that providers complete the DSPT or equivalent annually.
- CQC: principles for digital social care records, for mixed records, breach and cyber-attack plans and contingency.
- CQC: check the way you handle personal information, for the National Data Guardian standards and who must register.
- Digital Care Hub: Data Security and Protection Toolkit, for the free Better Security, Better Care support.
- Digital Care Hub: answer DSPT questions, for the 45 and 26 mandatory questions.
- Digital Care Hub: policies and procedures questions, for the wording and tool tip of question 10.2.1.
- Digital Care Hub: before you start, for registration needs and the list of required policies and contracts.
- Digital Care Hub: how to find your ODS code, for which code to register with.
- Digital Care Hub: publish or republish, for what is published, republishing rules and certificates.
- Digital Care Hub: manage your suppliers, for supplier due diligence.
- Digital Care Hub: tech suppliers and data protection, for the Standards Met requirement for shared NHS systems such as GP Connect.