It’s about protecting your organisation, your staff, and the people you support.

Hopefully, you managed to publish your annual Data Security and Protection (DSPT) self-assessment in time for the 2025/26 toolkit year (V8) deadline 30 ^th June? You can check your DSPT publication history, log into your account or register here  - you’ll need your NHS ODS Code.

Deadlines aside, while mandatory compliance is crucial to fulfil your regulatory, contractual, and sector requirements, I think we need to remember that the DSPT is more than just a tick box exercise that you undertake just once a year, it’s a safeguard for your organisation.

To help you develop strong, effective policies and procedures, we’ve created a Policy Masterclass Workshop Series. These sessions provide a practical deep dive (and interactive templates you can download) into some of the most important elements of the DSPT, helping you move beyond compliance and strengthen your overall approach to information governance.

We’ll begin by exploring two of the most valuable documents, your Information Asset Register (IAR) and the Record of Processing Activities (RoPA).

Together, these documents provide the foundation for understanding, managing, and protecting the information your organisation holds, where it is stored, how it is used and who has access to it. This visibility is essential for managing risk, responding to incidents, and ensuring information is handled appropriately.

You could face regulatory scrutiny for example, if the ICO investigates a complaint or breach and finds that you cannot demonstrate accountability or maintain adequate records of processing, this may be viewed as a failure to meet your data protection obligations under UK GDPR.

Having a robust IAR and RoPA in place is not just about compliance; it's about understanding and protecting one of your organisation's most important assets: its information.