DSP Toolkit 2025 – Build Your Evidence Calendar

The Data Security and Protection Toolkit (DSPT) sets expectations for how practices handle information risk. A quarter by quarter calendar spreads the workload, keeps key people engaged, and highlights when deeper premium resources are worth adopting.

Map the year in quarters

• April to June: confirm roles and responsibilities, review high level policies, and capture leadership minutes approving the approach.
• July to September: refresh workforce assurance by checking training compliance, agency coverage, and onboarding records.
• October to December: run incident response exercises, verify business continuity plans, and review supplier assurances.
• January to March: complete internal evidence audits, upload documentation to the DSPT portal, and prepare the management statement.

Build a shared evidence index

• Create one spreadsheet or workspace with every DSPT assertion, evidence owner, due date, and storage path.
• Use traffic light colours to signal green (ready), amber (needs attention), and red (outstanding) items.
• Note where evidence relates to premium material so colleagues know support is available without revealing paid content.

Keep people accountable

• Assign clear owners for each evidence set, such as the DPO for information governance, the IT lead for technical controls, and the practice manager for workforce elements.
• Schedule monthly checkpoints to resolve blockers early and document decisions in meeting notes.
• Encourage owners to record lessons learned after incidents or exercises, feeding updates into the next cycle.

Focus on high impact assurance

• Capture proof of completion for staff training, access reviews, patching schedules, and backup testing.
• Store signed supplier assurances, due diligence notes, and contract addendums that relate to data processing.
• Log outcomes of data protection impact assessments and link them to the relevant DSPT requirements.

Test your readiness

Run a mini internal review each quarter. Select three DSPT assertions at random, locate the evidence within five minutes, and check it reflects current practice. Use any gaps to make the case for premium checklists, policy packs, or incident playbooks that can support a smoother annual submission.

Disclaimer

This guidance is for general information. It is not a substitute for legal, clinical, or specialist advice. Always seek professional support tailored to your practice.