The final submission deadline for the Data Security and Protection Toolkit (DSPT) is 30th June each year.
However, Category 1 and 2 organisations must also complete a baseline assessment by 31st December. This baseline submission demonstrates progress towards full compliance and helps identify areas for improvement ahead of the June deadline.
The baseline is not a full compliance declaration but rather a checkpoint that enables organisations to:
- Identify gaps in evidence or controls
- Develop an action plan for improvement
- Prepare for independent audit requirements (where applicable)
By completing the baseline early, organisations reduce last-minute compliance pressure and strengthen their data protection posture throughout the year.
