Information Governance Training: What the DSPT Actually Requires

"The Data Security and Protection Toolkit requires 95 per cent of staff to be trained annually." You will read that everywhere. It is right for social care and wrong for NHS trusts, because the Toolkit now runs on two separate tracks with completely different training requirements.

Information governance is one of the eleven Core Skills Training Framework statutory and mandatory subjects, and it is the one where the requirement is most often stated incorrectly. Here is what each type of organisation actually has to do.

The two tracks

In September 2024 the Toolkit adopted the National Cyber Security Centre's Cyber Assessment Framework as the basis for its assurance. The health and care version has 47 contributing outcomes: the 39 CAF outcomes plus 8 custom ones on using and sharing information appropriately.

But not everyone moved across. The CAF-aligned track covers NHS trusts and foundation trusts, integrated care boards, commissioning support units, Department of Health and Social Care arm's-length bodies, independent health organisations designated as operators of essential services under the Network and Information Systems Regulations 2018, and genomics organisations nominated by DHSC.

Everyone else stays on the prescriptive-controls interface: social care, GPs, pharmacy, dentists, opticians, local authorities, universities and IT suppliers.

Those two tracks ask for different things on training, and conflating them is the most common error in this area.

If you are on the non-CAF track — social care, GPs, pharmacy, dentistry

Your training requirements are evidence items, and three of them are mandatory to meet the standard.

Item 3.1.1, mandatory: "Has a training needs analysis covering data security and protection, and cyber security, been completed in the last twelve months?"

Item 3.2.1, mandatory, and this is the 95 per cent everyone quotes: "Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?"

Item 3.4.1, mandatory: "Have the people with responsibility for data security and protection received training suitable for their role?"

Three things worth noticing in that wording. It says staff, directors, trustees and volunteers — so your board and your volunteers are in the count, which catches a lot of providers out. It says in the last twelve months, so this is one of the few places in mandatory training where an annual interval genuinely is the requirement rather than a convention. And the threshold is 95 per cent rather than 100, with the Toolkit's own explanation being that everyone with access to personal data must complete appropriate training every year, and that your training needs analysis should identify the level each person needs.

That last point is the one to act on. The 95 per cent is a completion figure, but item 3.1.1 asks for the needs analysis that decides what each group completes. A provider with 97 per cent completion and no training needs analysis fails a mandatory item.

If you are on the CAF-aligned track — NHS trusts and ICBs

There is no percentage. Training sits under Principle B6, staff awareness and training, at outcomes B6.a and B6.b, and the assessment is outcome-based rather than a completion count.

What matters more for 2026-27 is that both B6.a and B6.b are mandated audit areas. Eleven outcomes are mandated for audit for trusts, ICBs, arm's-length bodies, commissioning support units, operators of essential services and genomics organisations — A1.b, A3.a, B2.c, B2.d, B3.a, B4.c, B6.a, B6.b, C1.e, D1.c and E4.a — plus one optional outcome of the organisation's own choosing.

Two of the eleven compulsory audit areas are training. If you are preparing for a Toolkit audit, staff awareness and training is not a line item you can leave to the learning and development team.

One governance detail: the Senior Information Risk Owner must approve both the scoping of essential functions and the final submission.

The deadline, and the version

The current assessment year is 2026-27, Toolkit version 9, aligned to CAF version 4.0, with a deadline of 30 June 2027.

The Toolkit's legal footing is worth knowing because it is stronger than people assume. It is published as an information standard under section 250 of the Health and Social Care Act 2012, as amended by the Health and Care Act 2022, and under the NHS Standard Contract. Organisations subject to it must comply where it is relevant, and bodies that do not submit a return may be subject to enforcement action under the 2012 Act's powers, which may include fines.

For the submission mechanics and what each grading means, see our guide to the DSPT deadline.

What training actually satisfies it

The default route is Data Security Awareness Level 1, currently version 3.0, hosted on the e-Learning for Healthcare portal. Staff can self-register, organisations can request a SCORM package for their own learning management system, and some access it through the Electronic Staff Record.

Two specifics that matter for evidencing. The pass mark is 80 per cent for each of the four modules — not an overall 80 per cent. And annual completion covers all staff including non-permanent staff with access to personal confidential information: locums, temporary staff, students and contracted staff are explicitly named. Agency and bank staff are where completion percentages quietly fall below 95.

You do not have to use the national e-learning. Local or alternative training is accepted if it covers the same learning objectives, but it must be signed off by the Senior Information Risk Owner or the Caldicott Guardian, and staff must still achieve the 80 per cent pass mark. If you are commissioning IG training from a provider, that sign-off is the thing to have on file.

Social care: what is confirmed and what is not

This is where we are going to be careful, because the position is layered and widely overstated.

Confirmed. The Toolkit's scope expressly names "social care providers delivering care under the NHS Standard Contract" — for those providers it is a contractual and information-standard obligation. "Social care" is a named Category 3 organisation type in the 2026-27 workbook, with the 95 per cent item flagged mandatory. And the workbook carries a dedicated column for CQC market oversight providers, meaning the Toolkit separately profiles large registered social care providers, for whom items 3.1.1 and 3.2.1 are also mandatory.

Not confirmed. That CQC requires every registered adult social care provider to complete the Toolkit. We could not find a CQC primary source saying so, and we are not going to assert it. If you are a small registered provider with no NHS Standard Contract, check your own contractual position rather than assuming the Toolkit applies.

What does apply to every registered provider is Regulation 17, good governance, which requires systems or processes operated effectively, and in particular the ability to "maintain securely an accurate, complete and contemporaneous record" in respect of each service user. That is the regulation your records handling is actually inspected against.

For the cyber security side of the same obligation in care settings, see our guide to Cyber Essentials and data security in care homes.

Why this subject is different from the rest of mandatory training

Most mandatory training intervals are convention rather than law — the statutory wording is only that training be "repeated periodically where appropriate", which we unpack in our guide to how often mandatory training is actually required.

Information governance is the exception. On the non-CAF track the twelve-month window is written into the evidence item, the threshold is a stated number, and the consequence of missing it is a failed mandatory assertion rather than a judgement call. If you are deciding where to spend first on a training matrix, this is the subject where the requirement is hardest and clearest.

What to do

Establish which track you are on, because it determines everything else. If you are non-CAF: run the training needs analysis, count directors, trustees and volunteers in your denominator, chase agency and bank staff specifically, and keep the SIRO or Caldicott Guardian sign-off if you use anything other than the national e-learning. If you are CAF-aligned: treat B6.a and B6.b as audit-ready evidence rather than completion data, because both are compulsory audit areas this year.

Either way, the training needs analysis is the document that does the most work. It is a mandatory item in its own right on one track, and it is the basis of an outcome judgement on the other.