The three steps you MUST follow to correctly fill in the mandatory NHS DSP Tool Kit.

Step 1:

You must appoint a qualified Data Protection Officer (DPO) who will advise you on how to protect the medical data you are holding. This can be an independent DPO or an internal DPO who has no conflict of interests and can work as a DPO independently. The person appointed MUST be fully trained and expert in GDPR.

Step 2:

Update your Data Controller certificate giving the ICO the name and contact details of your appointed DPO. Please use this link https://ico.org.uk/for-organisations/data-protection-fee/change/ You will need your ICO Registration reference and Security number.
Important: The person appointed and registered with the ICO MUST be fully trained and expert in GDPR. There can be serious consequence if they are not trained and expert in GDPR compliance. You should also add the DPO’s name and contact details onto the bottom of your privacy policy.

Step 3:

Amend your NHS DSP Tool Kit. If you have filled out the NHS DSP Tool Kit without following these three steps then you are breach of your NHS contract. However once you have appointed a qualified DPO and registered them with the ICO you can amend your NHS DSP Tool Kit by adding the name of your appointed DPO into the fields on Question 1.1.5 To amend the DSP Tool Kit just login and amend point 1.1.5 and press update. You are now fully compliant with the NHS mandatory requirement for public authorities!

Steps 1 and 2

1. Appoint a Qualified DPO 2. Register the DPO with the ICO with your Data Controller Certificate

Appoint a trained DPO and then amend your Data Controller Certificate.

Your Amended Data Controller Certificate issued by the ICO

  • If you have not appointed a trained DPO then you are breach of your NHS contract and can be reported to the NHS through the Quality Care Commission (QCC).

Step 3

Amend your NHS
DSP Tool Kit

The NHS DSP Tool Kit

These are the two sections of the NHS DSP Tool Kit Question 1.1.5 you must amend once you have appointed and trained the in-house DPO
  • Section 1.1.5 "Whilst data security and protection is everybody’s business, someone within your organisation must take overall senior responsibility for it. There must be at least one named person who leads on data security and protection. Their responsibility is to provide leadership and guidance from a senior level.
  • In the text box, write the name(s) of the person or people within your organisation with overall responsibility for data security and protection. Then, for each person, describe how this responsibility has been formally assigned to them. For instance, this responsibility could form part of their job description, or be noted in the minutes of a management meeting, or be in an email from the appropriate director in your organisation. Your organisation may also have additional specialised roles, for example a Data Protection Officer (DPO). (As a public authority you must appoint and register a trained DPO and name them here).

If you have not followed the three steps above then you are in breach of your NHS contract. What can you do ?

You can employ an independent DPO and their certificate will now cover you and you can amend your NHS DSP Tool Kit and it will then become valid. This can be an expensive option.

Or

You can appoint an in-house DPO and after they have been trained in medical GDPR compliance they can be registered with the ICO using your Data Controller credentials. You then need to update section 1 1.5 of your DSP Tool Kit and you are now fully compliant.

Until you take one of these steps your current NHS V certificate is invalid and you are in breach of your NHS contract.

The most cost effective way to deal with this issue is to appoint and train an in-house DPO and have them trained up as a DPO

We have a special online and interactive DPO Training Course that will train you or a nominated member of staff to be the in-house DPO. This course is free to all members of the DPOA.

We will also guide you through the NHS DSP Tool Kit and be here to advise you on all GDPR compliance matters and ensuring that you are GDPR compliant. You will also receive all of the other benefits of membership including our GDPR help desk, online staff training videos and much more.

As a fully trained DPO you can then register with the ICO and receive the DPO certificate.

(Please note that registering as a DPO while not fully trained breaks GDPR compliance rules and you can incur substantial ICO fines).

The Online Data Protection Officers Course is only £249.95 + vat.

You will also receive a years membership of the DPOA with all of the additional training, training videos and GDPR updates along with our GDPR helpline to assist you in every aspect of GDPR compliance.

Please use this booking Link

 JOIN NOW

For more information about the course please press here.

We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits.
Accept Cookies
Reject Cookies