Information governance training: what the DSPT 2026-27 asks of your staff

Item 3.2.1 asks: “Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?”

• Appropriate training, at the level you set. The help text asks everyone with access to personal data to complete appropriate data security and protection, and cyber security, training every year, at the level your training needs analysis sets, using “a range of training and awareness methods to reach all staff effectively”.
• A free course for adult social care. The toolkit says Digital Care Hub’s free Data Security and Protection eLearning course “meets this requirement for staff working in adult social care”.
• The NHS course. NHS e-learning (e-LfH) runs its own course, Data Security Awareness.
• Directors, trustees and volunteers count. So does everyone else with access to personal data.
• Twelve months, counted back from publishing. A person counts only if they trained in the twelve months before you publish your assessment.
• Why the target is 95%. The toolkit accepts that illness, maternity or paternity leave, people leaving and other reasons can stop some people training each year.

For what UK GDPR and the ICO expect of staff training, see our GDPR training guide.

For care, pharmacy, dental and GP providers, no item in the 2026-27 toolkit asks for a phishing test. The only mention is an optional item for category 3 (6.2.6): the “Number of phishing emails reported by staff per month”. The toolkit’s tip says to take it from your service desk system or service. GP practices don’t answer it, and organisations on NHSmail are exempt.

What the evidence says works:

• Make reporting quick. The NCSC asks for a way to report suspicious emails that’s “clear, simple and quick”. In a study of 14,733 staff at one company over 15 months, staff with a report button flagged test emails fast: about 10% of reports came in within 5 minutes.
• Warn people about suspicious emails. In the same study, warnings on suspicious emails cut clicks.
• Don’t punish clicks. The NCSC advises against reprimands and says “punishing people for clicking on emails you’ve sent starts to resemble entrapment”. In the same study, staff who got a training page after falling for a test email clicked more than those who didn’t.

In a randomised study of about 19,500 staff at a US hospital system over eight months, how recently people had done their annual training made no difference to whether they fell for a test email.

• Your training needs analysis (category 3), from the last twelve months, with the sign-off of the person with overall responsibility for data security and protection. Upload a copy, or record where you keep it.
• A training record for everyone with access to personal data, directors, trustees and volunteers included, with the date each person last trained, so you can show at least 95% trained in the twelve months before you publish.
• Your monthly count of reported phishing emails, if you answer the optional item, from your service desk system or service.

• People missing from the count. Directors, trustees and volunteers with access to personal data count towards the 95%.
• An analysis more than a year old. Category 3 providers need a training needs analysis from the last twelve months, which the person responsible reviews or approves every year.
• Training dates outside the window. Training from more than twelve months before you publish doesn’t count.
• Treating the 95% rule as gone. The toolkit’s training page says a new approach replaced it from 2023-24. That change covers category 1 only: care, pharmacy, dental and GP providers still answer the question in 2026-27.