Skip to content
the autism kit
Guide

What is DTAC, and what does a digital tool need for NHS use?

The Digital Technology Assessment Criteria, the 2026 update, and related checks like DSPT, Cyber Essentials and DPIAs.

By The Autism Kit teamUpdated Sep 27, 2026 · 1 min read
Listen to this articleAbout 1 min
Read aloud · speed
A laptop on a table showing a security lock icon
Photo: Dan Nelson on Pexels
The short answer

DTAC (Digital Technology Assessment Criteria) is the NHS baseline for assessing digital health technologies, like apps and platforms, before pilots or procurement. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. An updated DTAC form replaced the previous version from 6 April 2026. NHS buyers may also ask about the DSPT, Cyber Essentials and a data protection impact assessment.

Key takeaways
  • DTAC is the NHS baseline for assessing digital health technologies.
  • It covers clinical safety, data protection, security, interoperability and usability.
  • An updated form replaced the old one from 6 April 2026.
  • Buyers may also ask for DSPT, Cyber Essentials and a DPIA.

What is DTAC?

The Digital Technology Assessment Criteria bring together legislation and good practice into a baseline that NHS organisations use when assessing digital health technologies.1 The core areas are:

  • Clinical safety
  • Data protection
  • Technical security
  • Interoperability
  • Usability and accessibility

What changed in 2026?

An updated DTAC form and guidance replaced the previous version from 6 April 2026, with clearer guidance on scope, pilots and multi-organisation procurements.1

What related checks might buyers ask for?

Common NHS assurance checks
CheckWhat it is
DSPTThe Data Security and Protection Toolkit, an online self-assessment of data security
Cyber EssentialsA UK government-backed scheme covering basic cyber security controls
DPIAA data protection impact assessment under UK GDPR for higher-risk processing
Clinical safety (DCB0129/DCB0160)Clinical risk management standards for health IT

Sources: NHS DSPT, NCSC and ICO.234

What can we do next?

0 of 3 done

Talk to us about your organisation: For schools and services

Common questions

NHS guidance describes DTAC as the baseline before pilots as well as before full procurement, and explains how to apply it in different situations.

Sources

  1. NHS AI and Digital Regulations Service: Using the Digital Technology Assessment Criteria (DTAC). digitalregulations.innovation.nhs.uk
  2. NHS Data Security and Protection Toolkit. dsptoolkit.nhs.uk
  3. National Cyber Security Centre: Cyber Essentials. ncsc.gov.uk
  4. Information Commissioner's Office: Data protection impact assessments. ico.org.uk

This guide shares general information and our team's perspective, based on the sources above. Rules and services differ by country, region and school, so always check your local guidance and your organisation's policies. How we write our guides.

Was this guide helpful?
Share this guide with someone who'd find it useful
Listen

Keep reading

All guides and stories →

One small, useful tip a week

Practical ideas built on evidence-based practices, plus a free printable to start. Unsubscribe anytime.

We never sell or share your email.