Data Security Protection Toolkit – Top Tips Presented by: John Hodson NHS Digital

Data Security and Protection Toolkit in numbers Active Users 35 development sprints completed 9,600+ 11,800 Registered organisations Integrated GDPR + NIS Incident notification for streamlined automated reporting Feedback items 500+% Care Homes 580 Uptake so far* 8 Bugs Takes in account other recognised Certifications and systems 430 GDPR Incidents Reported to ICO Reported and fixed

The thinking behind the old and new Toolkit The IGT was presented as prescribed framework It presented as number of steps you had to complete to finish the picture So painting by numbers The new toolkit is based upon outcomes But what does this mean?

Imagine………. A DSPT assertion or IGT requirement of … “To improve your health and well being by the use of a tree swing” How would this look in both toolkits?

IGT Tree Swing 1. Carry out survey of your grounds to ensure suitable site. Ensure the landowners permission has been given Perform a Health and Safety check prior to build. 2. Build the tree swing Build in accordance with tree build swing procedure ver.2.3 published 2003 Use material purchased under the national contract Tree-swing-national-contract-NT-fit-x0996-final v2. Test swing tree Go live 3. Assure tree swing Annual tree swing check report Independent verification of fit for purpose.

DSPT Tree Swing 1. How many times did you go on the tree swing last year?

Baseline Large NHS organisations (Acute, Ambulance Trust, Mental Health Trust, Community Trust) must publish a baseline by the end of October https://digital.nhs.uk/data-and-information/information-standards/information-standards-and-data-collections-including-extractions/publications-and-notifications/standards-and-collections/dcb0086-data-security-and-protection-toolkit-version-1-0 You won’t be able to publish a baseline if: you are not one of the above organisation types you have not completed your profile you have already published a full (standards met) assessment You can publish more than one baseline (but you don’t have to)* Deadline 31 October midnight.

Baselining – we need your help Honest and candid baselining is welcome It is not expected that organisations would have met the standard in October Baseline assessments WILL NOT be Used to judge organisations Publicly viewable or available through FOI. Baselines assessments WILL be Used to see how well the sector is adjusting to the new standards How we can help with improvements to FAQs, guidance, webinars, engagements and the site itself. Available in plenty of time for the deadline. There be a series of Webinars in October (2nd, 10th, 17th & 26th)

Baselining – why? Ensure organisations are engaged with DSPT Forewarned of orgs organisation change / restructure issues resourcing issues To see how organisations have progressed any common issues good practice that could potentially be shared.

Top Tips You can go back in and change any of the Org Profile questions right up to publication. Need to accept and submit any changes Only an administrator can publish a baseline You can add links to evidence rather than upload it.