NHS DSPT

The NHS Data Security and Protection Toolkit (DSPT) is the mandatory annual self-assessment for any organisation that accesses NHS patient data. It covers the 10 National Data Guardian (NDG) standards for data security, plus additional assertion areas covering specific high-risk operations.

For AI agents in healthcare, three things matter:

Scope expansion. Any AI agent touching NHS data — and in 2026, many do, ranging from administrative chatbots in GP practices to diagnostic copilots in Trust radiology departments — inherits the deploying organisation’s DSPT obligations. The vendor doesn’t get to opt out by saying “we just provide the agent.” The NHS organisation deploying the agent is on the hook for DSPT submission; the vendor’s obligation is to provide evidence that supports the submission.

The 10 NDG standards.

1. Personal confidential data — agents must not leak NHS patient data to unauthorised recipients. The privacy plugin enforces.
2. Staff responsibilities — Principal claims must include accountability assertions; audit chain captures who did what.
3. Training — out of scope for the agent itself; the vendor’s training is the vendor’s submission.
4. IT systems — the agent’s IT-security posture; covered by identity expiry guard, kill switch, and overall control framework.
5. Process reviews — annual review of the data-handling processes the agent participates in; audit chain is the evidence.
6. Responses to data breaches — Standard 7 is the runtime response; Standard 6 is the human-process side.
7. Continuous improvement — kill-switch engagement events feed the post-incident-review process.
8. Assured systems — the agent runs on assured cloud (GCP UK regions); the Cyber Essentials / NHS DSPT third-party assurance covers the runtime substrate.
9. IT protection — operational cybersecurity; cross-references NIS2 + DORA where applicable.
10. Third-party assurance — LLM provider, GCP, GRC tools — each is a third party in the DSPT submission. Same shape as SS2/21.

Special considerations for AI in healthcare. The NHS’s expectations around AI tooling are stricter than general DSPT — model-risk considerations are explicit (cross-references PRA SS1/23 for NHS-finance hybrid systems), bias monitoring is expected (the audit chain’s fairness-delta alerts are the substrate), and clinical safety overlaps with DSPT (the DCB0129 standard for vendors and DCB0160 for deploying organisations apply separately).

The Regulus nhs-dspt profile encodes the runtime side. The DSPT submission itself is a documentary process — the DPO at the NHS organisation produces the submission, referencing the evidence Regulus emits. The Regulus DSPT evidence export (regulus dspt export) produces an evidence pack mapped to each of the 10 standards.

For NHS-finance hybrid scenarios (e.g. independent healthcare providers regulated by both FCA and DSPT), the profile composes naturally with fca-sysc and uk-gdpr.