This quick guide is for local authorities in England who run their own inhouse adult social care services. It provides links and key information to ensure councils’ inhouse services are covered by a Data Security and Protection Toolkit (DSPT).
For information on local authorities’ responsibilities as a commissioner, please see Commissioners and the DSPT.
The DSPT needs to be completed every year. The deadline is 30 June.
Local authorities need to decide which DSPT route is most appropriate for them:
- Option A – Complete one DSPT as a local authority and extend it to cover all your inhouse adult social care services
- Option B – Complete the DSPT for your local authority. And all inhouse adult social care services complete their own individual DSPT as well.
Option A – Extend local authority DSPT to cover all inhouse services
Consider the following questions:
- Are the same data and cyber security induction and training arrangements followed?
- Are policies and procedures the same in the local authority and in all services?
- Are there the same data security and data breach arrangements?
- Are the IT arrangements the same in the local authority and for each service?
If the answers to all 4 questions are yes (or very similar) – then all services would have the same responses to the questions in the Toolkit and you can complete one DSPT to cover the local authority and its in-house services
Advantages of Option A
- Simple process
- Central control of the responses to questions
- Less impact on services’ time
Questions to consider
- Do additional policies and procedures exist with the services?
- Are there record keeping systems – either paper or electronic – in addition to what’s on the Information Assets Register (IAR)?
- How does the service share data with its partners including families? Is this covered by the ROPA?
- How engaged are leaders within in-house services in this agenda? Consider how you communicate with them.
- What is the culture amongst leaders and staff?
Actions for councils
Complete your DSPT as usual. Once you have submitted contact the DSPT team at [email protected] and ask them to extend your submission to cover your sites. You will need to provide the ODS code of your services and these will then show up on reports.
Option B – Complete DSPT for local authority, and separate DSPTs for each inhouse service
If your services have different policies and procedures to each other and the local authority, then they should each complete a site level DSPT themselves. It would be helpful to explore how you can support them with this, for example, by providing access to IT and IG teams as required.
Advantages of option B
- Supports detailed review of arrangements for data and cyber security
- Supports engagement of service managers in this agenda
- Impact on culture and staffing group
- Supports improvements in the safety of data
Questions to consider
- Can adult social care senior leads support service managers in terms of time to complete the questions?
- Can IG assist services e.g. can the council DPO help?
- Can central IT support services to answer the questions about council wide technology?
Actions for inhouse services
If inhouse services are completing their own DSPTs, they will need to register and complete, or review and republish their toolkit entry. As a council, you can support them to do this – and the Better Security, Better Care programme provides free detailed guidance and direct support as well.
Your inhouse services should:
- Check if the service is already registered or published on the DSPT
Log in and carry out an organisational search using ODS code or name to find out if your organisation is already registered https://www.dsptoolkit.nhs.uk/OrganisationSearch.
If the service is registered, but they cannot remember the log in details for their DSPT account, contact the DSPT team [email protected] Tel: 0300 303 4034
- Register on the DSPT
If the service is not registered, they will need to register on the DSPT with their ODS code (V code for individual sites). If you have this code, you should provide it to them. If not, please see our guidance on finding ODS codes.
Once they have completed the initial phase of registration, the service will receive a confirmation email with an activation link. They need to use this within 24 hours of registration otherwise it expires, and they will have to start again.
- Complete the DSPT
If the service had previously completed the DSPT, their previous answers will be available. They can simply review, update, reconfirm and republish. See our guidance.
If they are completing for the first time, they should aim to reach Standards Met (by completing 42 mandatory questions). If they can’t, they can get to Approaching Standards by completing 26 questions and producing an Action Plan outlining how they will reach Standards Met next time. See our guidance.
They cannot complete at Approaching Standards more than once. And Entry Level is no longer a standard on the DSPT.
Free DSPT support: Better Security, Better Care
The Better Security, Better Care programme is a national and local support programme – funded by the NHS – to help care providers complete the DSPT.
If you, as a local authority, are completing the DSPT on behalf of all your inhouse services, and you need advice, please contact our national team.
If you or your inhouse services need help with ODS codes, or other technical issues with using the DSPT, contact the DSPT team directly at [email protected] Tel: 0300 303 4034
