DTAC Compliance Guide for UK Software Developers — NHS App Library (2025)

DTAC (Digital Technology Assessment Criteria) is the overall assessment framework for NHS App Library listing — covering 5 domains including Data Protection. The DSP Toolkit (Data Security and Protection Toolkit) is a specific self-assessment requirement within DTAC's Data Protection domain. Completing the DSP Toolkit to "Standards Met" is necessary but not sufficient for DTAC — you must also meet the other four domains.

If your digital health technology could influence clinical decision-making — including diagnostic support tools, medication management, patient monitoring, or mental health applications — you need a Clinical Safety Officer (CSO). The CSO must hold a relevant clinical qualification and be accountable for your clinical risk management system under DCB0129. For patient-facing wellness apps with no clinical decision support, the CSO requirement may not apply — but you should verify this with NHS Digital.

Yes. ClickMasters provides: DTAC gap assessment (identifying your current compliance status against all 5 domains), technical remediation for Domain 2 (Data Protection), Domain 3 (Technical Security), Domain 4 (Interoperability), and Domain 5 (Accessibility). For Domain 1 (Clinical Safety), we support the technical aspects but recommend engaging a specialist clinical safety consultancy for the clinical risk management elements. ClickMasters has remediated products that failed Domains 2, 3, and 5 and achieved DTAC approval on resubmission.

DTAC compliance costs vary significantly based on your starting point. For a well-prepared new product: Cyber Essentials Plus (£1,500–£5,000), CREST pen test (£4,000–£15,000), DSP Toolkit completion (internal resource), WCAG audit and remediation (£2,500–£8,000), clinical safety consultancy (£5,000–£20,000), total approximately £15,000–£50,000+ first year. ClickMasters provides a free DTAC gap assessment to give you an accurate remediation cost estimate before you commit.