Guidance for LLR Community Pharmacy Contractors

Community Pharmacy England (CPE) has published new guidance to support community pharmacy owners and teams to complete the Data Security and Protection Toolkit (DSPTK) 2026.

The Toolkit is used to make your pharmacy’s information governance (IG) declaration and must be completed by Tuesday 30 June 2026.

Community Pharmacy England has collaborated with the NHS DSPTK team to help keep the workload associated with Toolkit completion manageable, while maintaining appropriate data security protections.

Key Updates in the DSPTK 2026

This year’s Toolkit includes:

• A new question asking whether you are using multi-factor authentication (MFA) with your clinical IT systems

• Improvements to the Toolkit layout

• Clearer question wording and pharmacy-specific tips

• The Toolkit now shows your previous submission responses for a range of questions, allowing you to confirm they remain accurate or amend where needed

• The NHS Parent Organisation Code (POC) “HQ batch submission” feature continues, allowing pharmacy owners with three or more pharmacies to complete a single submission for all premises

What LLR Contractors Need to Do Now

We recommend that pharmacy teams:

1. Log in to the DSPTK as soon as possible

2. Start with the CPE guidance “Toolkit completion: Overview – Five steps guide”

3. If time allows, begin completing the Toolkit rather than leaving this close to the deadline

4. Ensure your team plans this annual requirement into workload and staffing arrangements

Mandatory Questions – Contractual Requirement

Please note:

All questions marked mandatory within the Toolkit must be completed as part of a pharmacy’s NHS Terms of Service, to meet minimum information governance requirements.

Practical Tip: Using the GDPR Workbook (“see GDPR WB”)

As in previous years, most pharmacy teams should already have access to the information needed for the more technical questions.

Pharmacy teams who have refreshed and updated templates in the CPE GDPR Workbook may be able to complete around half of the Toolkit questions by typing or pasting: “see GDPR WB” into the relevant fields (where appropriate).

Owners with 3+ Pharmacies: Check Your POC (HQ) List Early

If you own three or more pharmacies, we strongly recommend you:

• Check the list of pharmacies associated with your NHS Parent Organisation Code (POC)

• Ensure it is accurate as early as possible

• Rectify any issues promptly to avoid delays close to the submission deadline

Please refer to CPE’s batch submission guidance for more information.

Community Pharmacy England Guidance (Links)

Please refer to the following CPE materials to support completion of DSPTK 2026:

• Toolkit completion: Overview – Five steps guide

• Toolkit completion: Question-by-question guidance (mandatory questions)

• Toolkit completion: Using the NHS Parent Org Code (HQ) batch submission (3+ pharmacies)

CPE has produced further information and resource which can be accessed HERE

Additional Support from IT Suppliers

Please note that IT suppliers may provide additional guidance to help pharmacy teams complete the updated technical questions within the Toolkit. We recommend monitoring supplier communications for updates.