Why the DSPT Isnt as Scary as You Think

If your organisation works with the NHS, chances are the Data Security and Protection Toolkit (DSPT) is something you look forward to about as much as a trip to the dentist. Every year, as the submission deadline approaches, we speak to organisations that are convinced it's going to be stressful and take up far more time than they have available.

---

We recently worked with a client who felt exactly the same. They'd built the DSPT up in their minds into this huge project and were worried they wouldn't have everything in place. Once we started working through it together, that changed quite quickly. Instead of looking at the toolkit as one enormous task, we broke it down into manageable sections. Before long, they realised they were already doing much more than they'd given themselves credit for.

What really stood out to us wasn't the toolkit. It was the documentation sitting behind it.

Many of the client's policies had become far more complicated than they needed to be. Some had clearly started life as generic templates. Others were filled with legal language that most people would never use in day-to-day work. We also found policies describing processes that simply weren't happening in practice.

It's something we come across surprisingly often. There's a perception that a longer policy somehow demonstrates stronger compliance, but that's rarely the case. If staff have to read the same paragraph three times just to work out what it means, the document isn't doing its job. Policies should support people, not confuse them.

---

Think of it like a food hygiene inspection. A café doesn't get a five-star rating because it has a 300-page manual explaining how to clean the kitchen. It earns that rating because good practices are part of everyday work and staff can show they're being followed. The DSPT works in much the same way. It's about demonstrating good information governance, not seeing who can produce the longest set of policies.

Once we simplified the client's policies, everything started to fall into place. The evidence reflected what people were actually doing, staff found the documents easier to understand, and the submission no longer felt as daunting. The toolkit hadn't changed.

Their approach had.

Now that this year's submission window has closed, it's actually a great opportunity to start thinking about the next one. Without a deadline hanging over you, you can make improvements at your own pace. Even a few small changes now can save a lot of time and stress when next year's submission comes around.

---

If reading this sounds a bit like your organisation, you're probably not as far away from DSPT compliance as you think. Sometimes it just takes someone to cut through the paperwork and make the process feel manageable. That's exactly what we help organisations do, and we'd be happy to help you too.

Contact us