NHS DSPT submission season catches most suppliers off guard every single year — evidence gaps, missing policies, and a scramble before the 30 June deadline. This guide walks through exactly what you need before you open the toolkit and how to submit without last-minute panic.
Why this matters
An NHS DSPT submission isn't optional if you supply services to NHS organisations. Miss the deadline or submit with unmet standards and you risk losing contracts, tender eligibility, and data-sharing agreements overnight.
The toolkit assesses your organisation against 10 National Data Guardian standards covering data protection, staff training, IT infrastructure, and incident response. Every standard needs evidence - policies, screenshots, training logs, test results - not just a tick box.
Most suppliers that fail don't fail on security. They fail on evidence organisation. The controls exist, but nobody can produce proof fast enough when the assessor asks.
What you'll need
- Cyber Essentials or Cyber Essentials Plus certificate - many NHS DSPT tiers require this as a baseline, and Cyber Essentials Plus for NHS suppliers sets out exactly which tier applies to your contract type
- Data flow mapping showing where patient-identifiable or confidential data moves through your systems
- Staff training records for data security awareness, updated within the last 12 months
- Incident response plan with a documented test or tabletop run in the last year
- Access control policy covering starters, leavers, and privileged accounts
- A recent penetration test report or vulnerability scan - see penetration testing services for NHS suppliers if you haven't scoped one yet
- Time: budget 15-25 hours for a first-time submission, less for renewals
The steps
1. Confirm your DSPT tier
Your tier depends on the size of your organisation and the type of NHS data you touch. Standard tier applies to most SMEs; Small Organisation tier covers under 20 staff with limited data access.
Get this wrong and you'll either under-evidence a full submission or over-build for a tier you don't need. Check your current NHS contract or framework agreement - it usually states the required tier explicitly.
Common mistake: assuming last year's tier still applies after a headcount or contract change.
2. Map your data flows
Document every point where patient or confidential data enters, moves through, or leaves your systems. This includes third-party processors, cloud storage, and any subcontractors.
A data flow map isn't a diagram for its own sake - assessors use it to check your access controls match your actual data exposure. Build it in a spreadsheet or diagram tool; either works if it's accurate and dated.
Expected outcome: a single document you can hand to an auditor with zero explanation needed.
3. Gather your Cyber Essentials evidence
Most DSPT tiers require a valid Cyber Essentials or Cyber Essentials Plus certificate dated within the last 12 months. If yours has lapsed, renewal takes 2-4 weeks depending on your certification body's backlog.
Check how to renew Cyber Essentials certification each year if your certificate expires before your DSPT deadline - timing these two renewals together saves a repeat audit cycle next year.
Common mistake: submitting DSPT evidence with an expired certificate, which triggers an automatic non-compliance flag.
4. Run or refresh your penetration test
Many NHS contracts specify an annual external penetration test as evidence for the technical standards. If your last test is over 12 months old, book a new one now - good testing firms book out 3-4 weeks in advance during Q1 and Q2, exactly when most DSPT deadlines land.
Scope it against your live environment, not a staging copy. Assessors check the scope statement against your actual infrastructure.
Expected outcome: a dated report showing critical and high findings remediated, or a documented remediation plan with dates.
5. Update staff training records
Every member of staff with system access needs documented data security awareness training within the last 12 months. This includes contractors and temporary staff with any data access.
For remote or hybrid teams, security awareness training for remote teams covers how to keep training current without chasing signatures across time zones.
Common mistake: training completed but not logged with names, dates, and content covered - undocumented training doesn't count as evidence.
6. Test your incident response plan
DSPT requires proof that your incident response plan has been exercised, not just written. A tabletop exercise - walking through a simulated breach scenario with your team - satisfies this.
Run it, document who attended, what scenario you tested, and what changed afterward. A one-page summary with a date is enough.
Expected outcome: evidence that ties directly to the standard asking for tested incident response, not a policy sitting unread in a drawer.
7. Complete the self-assessment in the toolkit
Log into the DSPT portal and work through each of the 10 standards, uploading evidence against each assertion. Answer honestly - marking "standards met" without evidence gets flagged in spot-checks and creates bigger problems than an honest "approaching standards" answer.
Double-check every uploaded file is dated within the assessment period. Old evidence from two cycles ago gets rejected.
Common mistake: rushing the final submit button before a second person reviews the full set of answers.
8. Submit before 30 June and keep a copy
Submit with time to spare - the portal can slow under load close to the deadline every year. Keep a full copy of your submission and every evidence file offline, because you'll need the same evidence base for next year's renewal and for any procurement questionnaire that follows.
Handling procurement follow-up questions gets faster once your evidence is centralised - see how to respond to security questionnaires faster for reusing DSPT evidence across multiple buyer requests.
Automate your DSPT evidence collection
OneClickComply pulls evidence automatically so your next submission takes hours, not weeks.
Troubleshooting
Problem: Cyber Essentials certificate expires mid-submission. Renew it immediately through your certification body and note the renewal date on your DSPT evidence upload. A submission with a renewal in progress is stronger than one with a lapsed certificate.
Problem: Penetration test findings are still open. Document a remediation plan with dates and owners. Assessors accept open findings with a credible fix timeline far more readily than no test at all.
Problem: Staff training records are incomplete. Run a short refresher session immediately and log attendance. A late but documented session beats a training gap on the record.
Problem: Data flow map is out of date. Update it before submission, even if the changes are minor. An outdated map is treated as inaccurate evidence, not partial evidence.
Problem: Portal times out near the deadline. Submit at least 3-5 working days early. The DSPT portal sees heavy traffic every June as suppliers rush the deadline.
Tools and resources
- Cyber Essentials Plus for NHS suppliers - confirms which certification tier your contract requires
- Penetration testing services for NHS suppliers - scoping guidance for the annual test most tiers require
- Security awareness training for remote teams - keeping training records current across distributed staff
- How to respond to security questionnaires faster - reusing DSPT evidence for procurement follow-up
- The DSPT self-assessment portal itself, where all evidence gets uploaded and submitted
What to do next
Once your first DSPT submission is filed, shift focus to picking the right ongoing framework rather than treating each cycle as a one-off scramble. How to choose the right compliance framework for your business walks through which certifications stack on top of DSPT depending on your NHS contract scope.
Frequently asked questions
One last thing
The suppliers who breeze through DSPT every year aren't the ones with the strongest security controls - they're the ones who stopped treating evidence collection as a June fire drill. Build a rolling evidence folder in July, right after this year's submission, and next year's deadline becomes a formality instead of a crisis.