A private clinic doesn't legally need Cyber Essentials. But if you access NHS patient data or systems, you must complete the NHS Data Security and Protection Toolkit every year, and much of what it asks overlaps with Cyber Essentials. NHS bodies buying services that involve personal data can also require Cyber Essentials from suppliers.
The NHS Data Security and Protection Toolkit
Organisations that access NHS patient data or systems, or deliver services under an NHS contract, must complete the Data Security and Protection Toolkit (DSPT) each year. For 2026/27, the baseline submission is due by 31 December 2026 and the final submission by 30 June 2027.
The toolkit draws on frameworks including Cyber Essentials. Holding Cyber Essentials doesn't exempt you from the toolkit, but the work you do for one counts towards the other.
When Cyber Essentials is required
Under the government's procurement rules (PPN 014), central government and NHS bodies must make sure suppliers meet the Cyber Essentials technical requirements when a contract involves citizens' personal information. Cyber Essentials or Cyber Essentials Plus is the quickest way to show it.
What matters most for clinics
- Individual logins with two-step verification on your practice or clinical system. One shared password exposes every patient.
- Secure sharing. Send patient information by secure email, such as NHSmail, or a secure portal, never ordinary email or messaging apps.
- Supported devices. Reception PCs and imaging computers running old versions of Windows are a common automatic fail.
- Locked screens. Computers in treatment rooms should lock automatically when left.
UK GDPR and health data
Health information is special category data under UK GDPR, which means stricter rules. You need a lawful basis and a condition for processing it, a privacy notice for patients, and a retention schedule that follows your professional body's guidance. Larger practices, or those starting new ways of using health data, may need a data protection impact assessment.
Common questions
Is Cyber Essentials mandatory for dentists?
No, not by law. But if you access NHS patient data or systems you must complete the Data Security and Protection Toolkit every year, and NHS bodies can require Cyber Essentials from suppliers handling personal information.
Does Cyber Essentials replace the DSPT?
No. There are no exemptions from the toolkit for organisations with Cyber Essentials, but much of the work overlaps.
Can we use WhatsApp to share patient photos?
It's best avoided. Use secure NHS email or an approved secure system, so patient information stays protected and is properly recorded.
Sources
- GRC Solutions: The NHS DSPT, what you need to know for 2026/27
- GOV.UK: PPN 014, Cyber Essentials scheme
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.