What a care home needs to do to be compliant with data and digital requirements
Every CQC-registered care provider in England completes the social care DSPT and republishes it by 30 June each year. Standards Met is what unlocks NHSmail, GP Connect and shared care records. Alongside it sit CQC's Regulation 17 duties and the annual ICO fee.
Reviewed 5 July 2026 · Neil Chandarana, founder, Highguard
Every requirement for a care home, in plain English.
The social care DSPT, every year
- Required for all CQC-registered adult social care providers
- Republish annually by 30 June
- Statuses: Approaching Standards, Standards Met
The DSPT is the official data security self-assessment for adult social care, and completion is required for all CQC-registered providers in England. The social care version uses plain-English statuses: providers work from Approaching Standards up to Standards Met, and republish annually by 30 June even if nothing has changed. It is written for care providers, not hospitals, but it still takes real evidence: policies, training records, business continuity and supplier lists. Your status sits on a public register that local authorities and commissioners increasingly check.
Sources: Digital Care Hub · DSPT Toolkit
Standards Met is the gateway
- Unlocks NHSmail, GP Connect and shared records
- Enables proxy access to GP records
- Often a condition of digital funding
Standards Met is not a badge, it is access. It is the prerequisite for NHSmail, GP Connect, local shared care records, proxy access to GP records for medication ordering, and the National Care Records Service. A current DSPT was also a condition of the national Digital Social Care Records funding programme, which closed in March 2025; local funding schemes often carry the same condition.
Sources: Digital Care Hub
CQC Regulation 17 and the well-led question
- Regulation 17: good governance
- Data and cyber assessed under well-led
- DSPT is the recognised evidence
CQC's good governance regulation requires accurate, complete and secure records and effective information systems. Data and cyber now sit inside the well-led part of inspection, so a ransomware incident or a records failure is a CQC conversation, not just an IT one. The DSPT is the recognised way to evidence this.
Sources: CQC
ICO data protection fee
- Enforced by the ICO
- Renews annually
Care homes process health data about residents, which makes UK GDPR and the annual ICO fee unavoidable. The tier is set by size and turnover, it renews every year, and the ICO fines organisations that let it lapse.
Sources: ICO
Free support exists
- Delivered via Digital Care Hub
- Free DSPT guidance and support
The Better Security, Better Care programme, delivered through Digital Care Hub and local care associations, provides free guidance and one-to-one help with the DSPT. It is genuinely useful for a first publication. What it does not do is the ongoing work of keeping policies, training records and evidence current between deadlines.
Sources: Digital Care Hub
Care home compliance as you grow.
Single home
One DSPT publication to Standards Met, ICO fee, Regulation 17 basics: records, training, business continuity. Achievable, but it has to be redone every year.
Group of homes
DSPT publication per location, consistent policies across sites, and governance that survives staff turnover. This is where spreadsheet-based compliance starts breaking.
Nursing and NHS-commissioned care
NHS contracts bring data-security clauses that commissioners check, and a visible current DSPT becomes part of winning and keeping the work.
Care home compliance, asked and answered.
Is the DSPT mandatory for care homes?
Yes. All CQC-registered adult social care providers in England are required to complete the DSPT and republish it each year. CQC, local authorities and the NHS all recognise it as the standard evidence of good data security.
What does DSPT Standards Met actually get us?
Access. Standards Met is the prerequisite for NHSmail, GP Connect, local shared care records, proxy access for ordering residents' medication, and the National Care Records Service.
When is the social care DSPT deadline?
30 June each year. The 2025-26 republication was due by 30 June 2026, and the next is due by 30 June 2027.
Does CQC inspect data security?
Yes, through Regulation 17 on good governance, which covers accurate and secure records, and through the well-led question. A current DSPT is the recognised way to show you meet it.
Is there free help with the care home DSPT?
Yes. Better Security, Better Care, delivered through Digital Care Hub and local care associations, offers free guidance and one-to-one support. It helps you publish; keeping everything current in between is still on you.
Why this list keeps getting longer.
Somewhere along the way, compliance stopped being about security and became about admin. Portals, spreadsheets, evidence uploaded again and again, policy templates nobody reads.
The result is organisations that are certified but not secure. Teams that are busy but not protected.
It should not work like this. Compliance should be a side effect of good practice. Evidence of the work you already do, not a second job on top of it.
That is why Highguard exists. We are your compliance department. Specialists and AI agents do the work on this page, and you approve every word before anything is submitted.
Every engagement starts with an audit. In your first week you get a report of where you are compliant and where you are exposed, specific to your organisation.
Talk to us →Talk to us.
Book a 15-minute call. We'll show you where you stand and how fast we can get you certified.