How to Meet DTAC Requirements? Essential Guide & Checklist [2025]
The Digital Technology Assessment Criteria (DTAC) emerged in 2021 as the national baseline standard for digital health technologies entering the NHS and social care sectors. This framework ensures that staff, patients, and citizens can trust the digital health tools they use meet essential safety and security standards.
What does DTAC compliance involve? You'll need to meet requirements across five core areas: Clinical Safety, Data Protection, Technical Security, Interoperability, and Usability & Accessibility. Meeting these standards proves your digital health solution is ready for the NHS ecosystem.
The challenge lies in understanding and implementing these requirements effectively. DTAC assessment involves detailed documentation, specific certifications, and ongoing compliance management that many developers find overwhelming.
This guide breaks down each aspect of DTAC compliance, giving you a clear roadmap to bring your digital health technology to the NHS market successfully. We'll walk through the practical steps, common pitfalls, and essential preparations that separate successful submissions from those that get stuck in compliance complications.
What is NHS DTAC and Why It Matters
The NHS Digital Technology Assessment Criteria (DTAC) functions as the foundation of digital health technology evaluation across the UK healthcare system. Launched in 2021, this framework replaced the previous DAQ standards and established a unified approach for assessing digital solutions throughout the NHS and social care sectors.
Understanding the purpose of DTAC
DTAC operates as an evaluation framework specifically designed to identify and minimize risks associated with digital health technologies. The framework ensures that all digital tools used within NHS settings meet baseline standards across five critical areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility.
Rather than creating entirely new requirements, DTAC consolidates existing legislation and recognized good practices into a single, coherent assessment process. This consolidation provides clarity for both developers and NHS organizations, enabling healthcare providers to evaluate digital solutions consistently before adoption.
The framework also aims to accelerate beneficial technology deployment by establishing clear expectations. NHS England notes that "The intention is now to smooth the path between development and procurement so that the NHS and social care may realize the benefits that digital technologies can bring."
Who needs to comply with DTAC?
Organizations developing or supplying digital technologies for use within NHS and social care settings must demonstrate DTAC compliance. This requirement covers:
- Developers of patient-facing and staff-facing digital health technologies
- Suppliers of health apps and medical devices with associated apps
- Providers of systems, web-based portals, and any IT-enabled technology
All digital solutions require DTAC assessment regardless of the implementation stage—whether in the pilot phase or full procurement. If you offer multiple products, each solution needs its own separate DTAC assessment.
How DTAC fits into NHS procurement?
DTAC has become integral to NHS procurement processes. While technically "advisory" at a national level, digital health solutions now find it virtually impossible to secure NHS procurement without demonstrating compliance.
NHS organizations will ask you to complete the DTAC questionnaire and provide supporting evidence during procurement. This assessment typically occurs at the procurement point or as part of due diligence processes. The framework ensures consistent questions that are embedded within existing procurement workflows.
Understanding DTAC requirements early in your development process proves crucial. The assessment isn't static—each time you add new features to your digital health solution, you'll need to submit updated DTAC documentation to maintain compliance.
DTAC forms part of—not the entirety of—the procurement process. NHS organizations supplement DTAC with additional specifications related to policy and regulatory requirements specific to their needs.
Breaking Down the DTAC Core Criteria
Five essential criteria determine whether your digital health solution meets NHS standards. Each criterion addresses a specific risk area that could impact patient safety, data security, or system reliability.
Let's examine what each criterion requires and how to meet these standards effectively.
Clinical Safety and DCB 0129
Clinical safety assessment protects patients from potential harm caused by your technology. DCB 0129 compliance is mandatory for all health IT systems and operates on a strict pass/fail basis.
The standard requires you to establish a complete Clinical Risk Management System, which involves:
- Appointing a qualified Clinical Safety Officer (CSO) who must be a registered clinician with current professional status
- Completing a Clinical Safety Case Report that documents all potential hazards and their mitigations
- Maintaining a comprehensive Hazard Log throughout your product's lifecycle
- Developing a Clinical Risk Management Plan that outlines your ongoing safety processes
What makes this challenging? Your CSO must have appropriate clinical qualifications and experience relevant to your solution's use case. Many startups find they need to engage external clinical safety consultants to meet this requirement.
Data protection and UK-GDPR
Healthcare solutions handle some of the most sensitive personal data, making robust protection essential. The assessment covers several key areas:
- Registration with the Information Commissioner's Office (ICO) as a data controller
- Appointment of a Data Protection Officer (DPO) where required
- Completion of Data Protection Impact Assessments (DPIAs) for high-risk processing
- Compliance with the Data Security and Protection Toolkit if accessing NHS patient data
- Appropriate data storage location (UK, EU, or elsewhere with adequate safeguards)
The complexity here lies in understanding when specific requirements apply. For instance, DPO appointments aren't always mandatory, but public authority data processing often triggers this requirement.
Technical security and Cyber Essentials
Security requirements focus on protecting against cyber threats that could compromise patient data or system availability. Your solution must demonstrate:
- Current Cyber Essentials certification verified through the IASME database
- Recent vulnerability, load, and penetration testing (within the last 12 months)
- Resolution of priority security vulnerabilities identified during testing
- Consideration of ISO 27001 compliance for enhanced credibility with NHS procurement teams
Cyber Essentials certification involves technical testing of your infrastructure, not just documentation. The assessment verifies that basic security controls are properly implemented and maintained.
Interoperability with NHS systems
Your solution must exchange data accurately and securely with existing NHS infrastructure. This requires:
- Following NHS Open API best practices for system integration
- Using NHS Number for patient identification across all interactions
- Adopting recognized healthcare data standards (HL7/FHIR)
- Implementing secure interoperability standards (OAuth 2.0, TLS 1.2 minimum)
Interoperability isn't just about technical connectivity - it's about ensuring data flows seamlessly between systems while maintaining accuracy and security throughout the process.
Usability and accessibility standards
Unlike other criteria that use pass/fail assessment, usability receives a percentage score. The evaluation considers:
- User-centered design principles throughout your development process
- Accessibility features for users with additional needs
- Evidence of user journey mapping and user testing
- Compliance with NHS service standard requirements
This criterion recognizes that digital health tools must work for everyone, including users with disabilities, varying technical skills, and different access needs. The scoring approach allows for continuous improvement rather than binary compliance.
How to Prepare for a DTAC Assessment
Thorough preparation separates successful DTAC submissions from those that get rejected or delayed. The assessment demands meticulous documentation across multiple domains, and shortcuts here often lead to costly resubmissions later.
Gathering required documentation
Start collecting evidence early in your development process. DTAC preparation isn't something you can rush through in the final weeks before submission.
You'll need comprehensive documentation covering:
- Clinical safety documentation (DCB0129 compliance)
- Data protection evidence (UK-GDPR compliance)
- Technical security certification
- Interoperability standards documentation
Most requirements involve ongoing risk management rather than one-time certifications. This means you can't simply tick boxes - you need systems and processes that demonstrate continuous compliance throughout your product's lifecycle.
Working with a Clinical Safety Officer
Finding the right Clinical Safety Officer (CSO) proves critical for DTAC's success. Your CSO must hold current valid registration as a healthcare professional and have completed appropriate clinical risk management training.
Many organizations find it more effective to outsource this role to external specialists, particularly when they lack in-house clinical expertise. The CSO will author and sign off on your Clinical Risk Management System, Clinical Safety Case Report, and Hazard Log documentation.
Don't underestimate this appointment - the CSO's work forms the foundation of your clinical safety compliance. Their expertise directly impacts whether your submission passes or fails the clinical safety assessment.
Conducting a Data Protection Impact Assessment
Every healthcare technology processing substantial personal data requires a Data Protection Impact Assessment (DPIA). This isn't just a compliance box-ticking exercise. It's a strategic document that identifies potential data protection risks and necessary mitigations.
Your DPIA addresses several legal requirements simultaneously:
- Data protection by design principles
- Accountability under UK-GDPR
- Transparency in data handling
- Security measures adequacy
Treat your DPIA as a living document. Product changes often trigger the need for updates, so build review processes into your development workflow from the start.
Performing penetration testing and audits
Annual penetration testing represents a non-negotiable DTAC requirement. This technical security assessment simulates real-world cyber attacks to identify exploitable vulnerabilities across all critical system components.
The testing must follow a structured five-stage process and cover your entire solution architecture. When selecting a penetration testing provider, prioritize those with CREST approval, qualified testers, and ISO 27001/9001 certification.
Your test results should reference recognized standards like CVSS and OWASP Top 10 to demonstrate comprehensive security coverage. Remember, passing penetration testing isn't just about finding vulnerabilities - it's about demonstrating you can fix them promptly and maintain robust security practices.
Maintaining and Updating DTAC Compliance
DTAC compliance operates as an ongoing commitment rather than a one-time achievement. Your digital health solution needs continuous monitoring and systematic processes to maintain NHS standards throughout its lifecycle.
When to re-submit DTAC
The framework demands regular reassessment under specific circumstances. You must submit a new DTAC assessment every time you add a new feature to your digital health solution. This requirement ensures that all product iterations maintain the same rigorous standards as your original assessment.
Most NHS organizations also require annual reviews of your DTAC documentation. This regular cycle helps ensure your solution stays aligned with current standards even when no significant changes have occurred. Review timelines typically span one to three months, depending on your existing compliance with related frameworks.
What happens if you miss these deadlines? NHS procurement processes can stall, and existing implementations may face scrutiny. The assessment timeline isn't negotiable - planning ahead becomes essential for maintaining market access.
Tracking changes in your product
Effective change management forms the foundation of sustained DTAC compliance. You'll need to establish processes that capture:
- All product modifications, however minor they seem
- Updates to your Clinical Safety Case with risk reassessments for new features
- Revisions to your Data Protection Impact Assessment when data handling changes
- Security certification renewals before expiry dates
Smart diary systems can automate much of this tracking burden. These tools monitor renewal dates and send timely reminders for DSPT, Cyber Essentials, DPIAs, and security certification renewals. Without systematic tracking, compliance gaps become inevitable as your product evolves.
Staying aligned with NHS updates
The DTAC framework continues evolving as digital health standards mature. Industry experts note that "DTAC is not a static framework". Your development team must prepare to regularly update solutions incorporating:
- Legislative changes affecting healthcare technology
- Cybersecurity requirement developments
- Data protection standard evolution
- Clinical safety protocol updates
Some organizations find value in working with specialized consultancies that provide continuous support addressing evolving DTAC requirements and progress updates.
The key lies in viewing DTAC compliance as an integral part of your product development process rather than an external burden. Teams that embed compliance considerations into their regular workflows find maintaining standards significantly more manageable than those treating it as an afterthought.
Conclusion
DTAC compliance represents a critical gateway for digital health technologies entering the NHS ecosystem. The five core criteria - clinical safety, data protection, technical security, interoperability, and usability - create a framework that ensures patient safety while enabling innovation.
The preparation demands are substantial. Qualified Clinical Safety Officers, thorough Data Protection Impact Assessments, Cyber Essentials certification, and regular penetration testing all require careful planning and execution. Each element builds toward a comprehensive compliance picture that NHS organizations need to see.
DTAC operates as a continuous process rather than a single milestone. New features trigger fresh assessments, while annual reviews keep your documentation current. This ongoing nature means compliance becomes part of your product development rhythm, not an afterthought.
The benefits justify the effort involved. Compliant solutions earn the trust of NHS staff and patients who rely on proven safety standards. Procurement processes become smoother when your technology meets established criteria. Most importantly, you're delivering healthcare solutions that genuinely prioritize patient safety and data protection.
Digital health innovation flourishes when supported by robust compliance frameworks. DTAC provides that foundation, ensuring your technology contributes meaningfully to patient care while meeting the rigorous standards the NHS demands. The developers who embrace this approach position themselves for sustainable success in the UK healthcare market.
