30-second briefing
Digital assurance depends on the capacity to govern, as well as the technology a provider buys.
- Current DSPT assurance in Care Circle’s matched cohort rises from 69.5% among single-location providers to 98.2% among groups with 25 or more locations.
- The result describes published toolkit status. It does not prove whether an individual provider is cyber secure, compliant, resilient or safe.
- The supplier opportunity is to reduce the ongoing governance burden: clearer evidence, usable controls, accountable implementation and support between annual submissions.
Adult social care has made substantial digital progress. More services use digital records, rostering, medication systems and connected tools than only a few years ago. But adoption creates a second task that is easier to underestimate: governing those systems well, every day.
Care Circle Intelligence examined 25,093 active adult social care locations with an exact CQC ODS-code match to a Data Security and Protection Toolkit record. We treated a 2025/26 status of Standards Met or Standards Exceeded as current published assurance for this analysis.
A consistent gradient across provider scale
The difference is not confined to the smallest and largest organisations. Current assurance rises at every scale band in the matched cohort.
| Provider size | Current published assurance |
|---|---|
| Single location | 69.5% |
| 2–4 locations | 80.1% |
| 5–9 locations | 87.1% |
| 10–24 locations | 91.0% |
| 25+ locations | 98.2% |
+28.7 percentage points from single-location providers to groups with 25 or more locations. Percentages are location-based; raw scale-band counts are not yet published. See the method boundary below.
That gradient is strong enough to demand attention. It is not, on its own, evidence that scale causes stronger assurance. Larger groups may share specialists, policies, systems and oversight across many locations. Smaller organisations may rely on leaders who carry operational, regulatory and digital responsibilities at the same time.
The important divide may be less about willingness to improve and more about the organisational capacity to turn requirements into routine practice.
What this finding says, and what it does not
DSPT is a self-assessment framework against the National Data Guardian’s data security standards. A current published status is useful evidence of participation and declared alignment. It is not an independent penetration test, a certificate that suppliers are secure, or proof that controls work reliably throughout the year.
Equally, a provider without a current matching record must not be described as unsafe. Its position may reflect a prior-year submission, another toolkit status, a changed identifier, a matching limitation, non-publication or non-completion. The analysis does not measure care quality, data-protection compliance, cyber resilience or the safety of any named service.
Published status
Evidence that a matching toolkit record currently says Standards Met or Exceeded.
Not a safety score
No conclusion about the security, compliance or quality of an individual service.
A capacity signal
A sector-level question about the resources needed to govern digital care well.
Two divides are developing together
The first is an adoption divide. The 2025 DHSC provider technology survey reported higher use of digital social care records, financial accounting software and digital rostering among larger respondents than micro providers. The survey is voluntary and its size categories are not directly comparable with Care Circle’s location bands, so it provides context rather than validation of our result.
The second is an assurance divide. Each new system brings access control, device management, supplier oversight, business continuity, staff competence, incident response and evidence maintenance. Buying technology can happen once. Governing it is continuous.
Care Circle view
The market opportunity is not another dashboard. It is lower-friction assurance.
What responsible suppliers can do now
For suppliers, the divide is a route to purposeful market participation. The strongest proposition is not “we understand care” as a marketing claim. It is a product and service model that demonstrably removes work, uncertainty or exposure from the provider’s governance system.
Make ownership, configuration and escalation responsibilities unmistakable from implementation onward.
Generate useful, exportable evidence throughout the year instead of relying on a last-minute compliance pack.
Reduce administrative duplication and expose operational dependencies before they become failures.
Show control ownership, incident routes, continuity arrangements and material subcontracting clearly.
A supplier cannot become the provider’s governance system, and outsourcing technology does not outsource accountability. Good suppliers can, however, make responsible governance materially more achievable, particularly for the independent organisations that make up much of the provider market.
Questions boards and provider leaders should ask
- 01
Who is accountable between submissions? Name the people responsible for access, assets, suppliers, incidents and continuity.
- 02
Can we evidence operation, not just policy? Test whether controls are understood and performed at service level.
- 03
Where are our supplier dependencies? Make concentration risk, outage routes and data responsibilities visible.
- 04
What changes fastest? Review accounts, devices, software, integrations and threats more often than the annual compliance cycle.
Sources, method & limitations
How to read this analysis
Care Circle analysis: 25,093 active adult social care locations with an exact CQC ODS-code match to a DSPT record, using a snapshot taken on 9 August 2026. “Current published assurance” means a 2025/26 DSPT status of Standards Met or Standards Exceeded. Provider scale is based on location count.
Boundary: The analysis is descriptive and location-based. It does not publish raw denominators by band, confidence intervals or an adjusted causal model. Exact matching may introduce selection bias; shared DSPT records and group structures may affect independence. Care Circle will retain the finding as an observed association, not a provider-level judgement.
Editorial independence: Care Circle Intelligence supplies monitoring and analysis. Care Circle Network determines the editorial framing and publication. No supplier sponsored or approved this analysis.