What's inside
A focused, audit-defensible IT Asset Disposition pack for NHS organisations and any provider handling NHS patient data. Designed for SIROs, Caldicott Guardians, DPOs, IG Leads, IT Directors, and procurement teams who need a structured pathway from current state to DSPT-compliant operating practice.
31 pages of NHS-specific content covering:
Section 2: The NHS ITAD regulatory stack including DSPT 2025-26 version 8, the Caldicott Principles, NHS Records Management Code, HMG IS5, UK GDPR Article 9 special category data, and CQC inspection requirements
Section 3: 17-row scope identification matrix covering NHS Trusts, Foundation Trusts, ICBs, GP practices, dental clinics, private healthcare, community pharmacy, optometry, public health bodies, adult social care, Operators of Essential Services, and Genomics organisations
Section 4: NHS-specific glossary including SIRO, Caldicott Guardian, IG, IGL, special category data, DSPT submission statuses
Section A: Eight data categories specific to NHS ITAD with retention anchors and disposal standards mapped to each
Section B: DSPT 2025-26 v8 evidence requirements with twelve specific compliance checks
Section C: All eight Caldicott Principles mapped to ITAD operational requirements
Section D: Destruction standards including HMG IS5 vs NIST SP 800-88 reconciliation, with sensitivity-based selection matrix
Section E: NHS-specific asset categories including embedded clinical IT, multifunction devices (the most commonly overlooked data-bearing asset in healthcare), DECT phones, paging systems, and clinical storage media
Section F: Documentation pack for DSPT submission with named evidence files
- Section G: Multi-site and multi-tenant considerations including the realities of 12+ site Trust collections and ICB-coordinated GP networks
Section H: MHRA scope boundary, clearly defining what this pack does NOT cover and when specialist medical device disposal applies
Section 13: Seven common NHS ITAD failures with documented prevention steps
Section 14: 30-day implementation roadmap from standing start to DSPT-ready evidence pack
Appendix A: DSPT evidence file checklist organised by policy, operational, vendor, training, and risk categories
Appendix B: NHS ITAD procurement specification text across six subsections ready to copy into any RFP or ITT
Why this template
NHS ITAD sits in a unique regulatory position. Patient data is special category data under UK GDPR Article 9, requiring higher justification and rigorous safeguards than standard personal data. The annual DSPT submission means every disposal event is potentially auditable. The Caldicott Principles add an NHS-specific overlay that most generic ITAD guidance does not cover. And the practical reality of multi-site Trust operations, embedded clinical IT, and MHRA scope boundaries creates operational complexity that small business ITAD templates cannot address.
This Quickstart Pack is built specifically for NHS contexts using the current DSPT 2025-26 version 8 framework, not legacy guidance. It bridges the gap between the foundational ITAD templates (Tier 1) and the operational reality of NHS organisations. The 30-day roadmap and Appendix B procurement specification text make this pack immediately actionable.
The Appendix B procurement specification is the highest-value page in the document. Six subsections of ready-to-copy RFP text covering Mandatory Vendor Requirements, Service Delivery, NHS-Specific Requirements, Data Protection, Reporting, and Sustainability and ESG. Procurement teams can lift these directly into ITT or RFP documents.
Who it's for
SIROs, Caldicott Guardians, DPOs, IG Leads, IT Directors, IM&T teams, and procurement managers at NHS Trusts, Foundation Trusts, ICBs, GP practices, dental clinics, optometry practices, community pharmacy, private healthcare with NHS contracts, public health bodies, adult social care providers, Operators of Essential Services in health, and Genomics organisations.
Pairs with
The complete UK ITAD package: ITAD Policy (NS-TPL-001), Certificate of Data Destruction (NS-TPL-002), Data Retention and Destruction Policy (NS-TPL-003), IT Asset Inventory Tracker (NS-TPL-004), Chain of Custody Form (NS-TPL-005), ITAD Vendor Selection Checklist (NS-TPL-006), Pre-Disposition Asset Audit Checklist (NS-TPL-007), UK GDPR ITAD Compliance Checklist (NS-TPL-008), and UK WEEE Disposal Guide (NS-TPL-009). Together these ten templates form the complete UK NHS-ready ITAD methodology.
Format: Microsoft Word (.docx) | 31 pages | Last updated: May 2026