Data protection - DSPT

Most community services in England, such as MECS and CUES, are based on the ‘NHS standard contract’, and practices which participate in these services may be asked to complete the Data Security and Protection Toolkit (DSPT). The AOP has advised us that practices which only hold a GOS contract are not required to complete the DSPT.


29th October 2020 - Recent work carried out by LOCSU with NHSEI has generated improvements to the optical DSPT, to help with checklist completion before the 31st March deadline. The improvements include:

  • Advice on training resources
  • Clearer guidance on completing specific questions within the checklists
  • New templates and resources
  • Reduced duplication

Practices need to be aware of the deadline of 31st March 2021 to complete the relevant checklist. LOCSU have worked with NHS Digital to integrate DSPT checklists into QiO, thereby removing the need for practices to navigate the NHS Digital website.

Requirements vary according to status as follows:

  • Subcontractors to Primary Eyecare Companies (PECs) must complete the full optical DSPT checklist in QiO
  • Practices who have or want NHS mail, who are not subcontractors to PECs, must complete the shorter DSPT mail checklist only. If the full optical checklist has been completed then there is no need to complete the DSPT mail checklist.

The deadline for the completion of either checklist is 31st March 2021.


Where can I get help when completing the DSPT?

Primary Eyecare Services has produced a tutorial video on completing the DSPT.


For further information and guidance go to the QiO website or contact LOCSU via