Learn what you need to have in place before you start your DSPT assessment for the very first time. This will help you to complete the questions quickly.
You can download and use our pre-DSPT checklist to help you prepare.
Before you register on the DSPT, check that you have:
- an email address (we suggest you use a generic one rather than a personal or individual address that is easily accessible by staff within the care business)
- your ODS Code. You can look this up by visiting the ODS portal
- your Information Commissioner’s Office (ICO) registration number. You must be registered with the Information Commissioner’s Office.
Before you complete your DSPT for the first time you need to have a series of mandatory policies in place.
ICO registration
Every sole trader, business or organisation that processes personal data must register with the Information Commissioner’s Office (“ICO“).
Visit the ICO website in order to:
- Check your ICO registration number
- Update your registration details (eg company name, address etc)
- Register with the ICO for the first time.
Policies and contracts
You must have some particular policies and contracts in place, whereas others are optional. We have provided template policies which you can adapt to suit your own organisation.
There is no set number of how many policies your organisation has to have on these topics as the different sizes and complexity of organisations means that some will have one all-encompassing policy, whilst others may have multiple policies. The important thing is that you have them – and that you follow them.
You may call your policies different things to what we have called them, for example you might call your data protection policy an information governance policy or GDPR policy.
Required policies and contracts
You must have the following in place in order to reach Standards Met on the DSPT.
- How to document your data processing, including template information asset register (IAR) and Record of Processing Activities (ROPA)*
- Privacy Notice Template*
- Data Protection Policy*
- Data Quality Policy – Template
- Record Keeping Policy – Template (Also known as a Data or Document Retention Policy)*
- Data Security Policy – Template*
- Network Security Policy – Template*
- Smart Phone Policy BYOD – Template OR Smart Phone Policy Template – Organisation Provided Phones*
- Training Needs Analysis
- Data Security Audit Checklist
- A Business Continuity Plan for Data and Cyber Security
- You must also have contracts in place covering:
*You must have these basic policies and contracts in place to reach at least Approaching Standards which is a stepping stone for care providers who cannot reach Standards Met the first time they use the DSPT. All care providers should aim for Standards Met. You can only publish at Approaching Standards once.
Recommended documentation
In addition to the required policies, we recommend that you consider having the following in place.
- Data Security Breach Incident Reporting Form – Template
- Mobile Devices Assignment Form – Template
- Template Suppliers List
Aim for Standards Met
You should complete the DSPT to Standards Met. This requires you answer 43 questions. You can see all 43 questions and tips on how to answer them here.
However, if this is not achievable the first time, you are able to publish at Approaching Standards. To complete Approaching Standards you just need to complete the 26 evidence items marked as ‘Mandatory’ on the Social Care Assessment page. You will then be asked to complete an action plan on how you will complete the remaining items before your next publication. The action plan is auto-generated. You do not need to wait until the next toolkit year to publish at Standards Met.
You can publish at any time throughout the year and so you can start work on the remaining 17 Standards Met questions as soon as you have published at Approaching Standards and publish as soon as you have completed the additional questions.
The toolkit does have to be published at least once every toolkit year (currently, the toolkit year runs from the 1st July to the 30th June).
If you have published at Approaching Standards for your first publication, you do not have the option to republish at Approaching Standards.
From your second publication onwards, you must achieve the Standards Met level. Your answers from your previous publication will have saved so you do not need to repeat the work you have completed, just check whether the answers you entered previously are still applicable to your current working practices.
Next steps
You can now register on the DSPT.
You can also access free support from the Better Security, Better Care programme – including free webinars, a national helpline, and direct support from 28 local support organisations across England.
