Data protection - DSPT

Page updated 24th March 2021


Most extended primary eyecare services in England, such as MECS and CUES, are based on the ‘NHS standard contract’, and contractors who participate in these services may be asked to complete the Data Security and Protection Toolkit (DSPT). The AOP has advised us that practices which only hold a GOS contract are not required to complete the DSPT.


Work carried out in 2020 by LOCSU with NHSEI has generated improvements to the optical DSPT, to help with checklist completion before the 31st March deadline. The improvements include:

  • Advice on training resources
  • Clearer guidance on completing specific questions within the checklists
  • New templates and resources
  • Reduced duplication

LOCSU have worked with NHS Digital to integrate DSPT checklists into QiO, thereby removing the need for practices to navigate the NHS Digital website.

Requirements vary according to status as follows:

  • Contractors who participate in extended primary eyecare services (EPECs), including subcontractors to Primary Eyecare Companies (PECs), must complete the full optical DSPT checklist in QiO
  • Contractors who have or want NHS mail, and who do not participate in EPECs, usually complete the shorter DSPT mail checklist only, but this requirement has been waived until 1st July 2021. If the full optical checklist has been completed then there is no need to complete the DSPT mail checklist. Note that the shorter (mail) version will be withdrawn from QiO on 31st March 2021, and from NHS Digital on 30th June 2021, after which all those required to complete the DSPT must complete the full optical version.

The annual deadline for the completion of either checklist is 31st March.


Where can I get help when completing the DSPT?

Primary Eyecare Services has produced a tutorial video on completing the DSPT.


For further information and guidance go to the QiO website or contact LOCSU via