DSPT software for NHS IT and data suppliers.
Your NHS customers can see your Data Security and Protection Toolkit (DSPT) status, and the date you published it, on a public register without asking you. Naq keeps the controls and evidence behind that status in one record and flags what is slipping between submissions.
.png)
.png)
A toolkit result that keeps NHS customers sharing data.
The problem
Once a year the toolkit submission is assembled from scratch. Whatever lapsed in between, a policy past its review date or an expired course, comes to light at the deadline, when there is least time to fix it.
The outcome
By submission time, each control shows whether its evidence is current, with an activity timeline on every record behind it.
How Naq helps
Expired evidence on your list
Evidence checks run on a schedule. When evidence expires, its control drops back to needs review and the expiry joins your to-do list.
Courses that expire
Courses expire and prompt a retake, and each completion is kept as evidence for your controls. Staff see their courses and the documents they need to read and sign in the Employee Portal.
Your DPO in the record
Register your Data Protection Officer as a named role. They review and advise inside your Naq record, whether your own or from Naq's partner network.
Access to each supplier
Track your suppliers and who has access to each one.
Next up, your to-do list and every approval waiting on you
Your dashboard shows how many controls are in place and what still needs work. Next up picks out the three things that most need you, and your to-do list collects approvals, reviews and expiries in priority order. Items clear themselves once the work is done.
Policies drafted from templates, approved and acknowledged
Start from a template already mapped to your frameworks. Your organisation’s details fill in, you submit it for approval, and the approved version goes to everyone who must read and acknowledge it. Naq reopens it on its review date.
Staff, training and devices kept as evidence
Register staff, teams and named roles such as Data Protection Officer. Assign courses that expire and prompt a retake. Every device has a custodian and a status from purchase to disposal, and each record counts as evidence for your controls.
Suppliers, risks, incidents and corrective actions
Track suppliers and who has access to each one. Score every risk before and after treatment and set its review date. Log incidents with what happened, then follow each corrective action through to closed.
Policies, leavers, devices and incidents in one record.
The records behind your status change through the year.
Virtual compliance partnerThe frameworks for an NHS IT supplier.
NHS DSPT
Published on a public register, with statuses including Standards Met, Approaching Standards and Standards Not Met.
UK and EU GDPR
Your record of processing activities, with DPIAs drafted from it and a DSAR register for access requests.
NHS DTAC
The assessment criteria for any digital product entering the NHS.
Naq AI analyses and suggests. Your team decides.
Nothing is written to your compliance record without a person approving it. Every suggestion is reviewed, confirmed by a named team member and timestamped, so your audit trail stays yours.
OverviewFrameworksPoliciesProcessing recordPeopleYour own DPO and CSO, or a named expert from Naq's partner network.
Some decisions need a person with their name on them: a Clinical Safety Officer signing off a hazard log, a DPO reviewing a transfer clause. Whoever holds the role records their review or sign-off inside your Naq record, so every decision stays in the audit trail.
Bring your existing DPO or CSO into Naq
Invite your in-house or outsourced specialist as a user and assign them the named role. Naq routes the reviews and approvals that need them, and their review or sign-off is recorded against the record.
Access Naq's partner network
Naq partners with specialist firms who take on the named role for you. Meet them before you commit. They work inside your Naq workspace, alongside your team.
ISO 27001, DTAC and DSPT, achieved and kept with Naq.
“Maintaining and demonstrating our credentials in the past has been onerous. The Naq platform makes the whole process remarkably seamless.”
Dr Taz Aldawoud, Founder & CEO, Doc Abode
“Naq has been instrumental in obtaining ISO 27001 certification and shortening our sales cycle by easily demonstrating our compliance to enterprise customers.”
Arnold Bouwman, Co-founder, Vormats
“Naq helped us complete our Cyber Essentials and DSPT toolkit applications. I already know next year’s DSPT Toolkit will be easy with Naq.”
Otesa, NHS supplierStart from your status on the register.
Expired evidence on your to-do list is the first thing we show.
