NHS Data Security and Protection Toolkit

Who this service is for

For NHS organisations, care providers and suppliers that need support with their applicable DSPT assessment and information governance arrangements.

Common challenges companies face

• Teams select guidance for the wrong organisation category or assessment cycle.
• Evidence is spread across HR, IT, clinical operations and information governance with no clear owner.
• Training, access reviews and supplier assurance are recorded inconsistently.
• Annual submission work becomes a last-minute exercise rather than an ongoing control process.

Technical scope

• Identify the applicable organisation category, cycle, guidance and CAF-aligned requirements where relevant.
• Review data flows, information assets, access controls, staff responsibilities and training evidence.
• Examine incident handling, continuity, supplier assurance and relevant data protection processes.
• Evaluate the consistency of assessment responses against records of actual control operation.

How Poleis supports you

• Agree responsibility across information governance, security, IT and operational teams.
• Build an evidence index and review selected records, identifying unsupported or conflicting claims.
• Develop corrective actions and a sustainable evidence collection schedule before submission.

What you receive

• Category-specific gap assessment and assessment response review.
• Evidence index with owners, review dates and outstanding requests.
• Remediation plan and management briefing for informed submission decisions.

Engagement scope

The organisation retains responsibility for its submission. Independent assurance requirements and any separately commissioned audit are confirmed against the applicable guidance.

Official guidance