NHS contractual deadlines below apply to England; Scotland, Wales and Northern Ireland run their own contractual calendars. GPhC and corporate deadlines apply across Great Britain. And a distinction worth internalising: some deadlines fall on fixed calendar dates for everyone, while others are anniversary-based and unique to your registration or incorporation date, which is why two well-run pharmacies can have different Aprils.
What are the fixed annual deadlines for a community pharmacy in England?
Five national deadlines anchor the compliance year, and every pharmacy owner should be able to recite them: the Data Security and Protection Toolkit by 30 June, the CPAF screening questionnaire in July, the PQS aspiration window in July, the annual complaints report in spring and vaccination service registration by the end of November. The 2026/27 dates, with sources, are below.
| Deadline | 2026/27 date | Recurrence | Who acts | Source |
|---|---|---|---|---|
| Data Security and Protection Toolkit (DSPT) submission | 30 June 2026 | Annual, end of June | IG lead or owner; HQ batch submission available for owners of three or more pharmacies | CPE DSPT hub; NHS Terms of Service |
| Annual patient complaints report | Spring window, closing end of May in the 2025/26 cycle | Annual, for the year ending 31 March | Owner or manager, via MYS | LPC deadline trackers; NHS complaints regulations |
| PQS 2026/27 scheme opens | 2 June 2026 | Annual scheme launch | Owner decides participation | CPE PQS hub |
| PQS aspiration payment claim window | 13 to 28 July 2026 | Annual, roughly two weeks in July | Owner, via MYS; payment made 1 September at 80% of intended points value | CPE PQS hub |
| CPAF screening questionnaire | 1 to 31 July 2026 | Annual, the month of July | Owner, via MYS; ten questions | CPE and NHSBSA CPAF pages |
| CPAF full questionnaire (selected pharmacies only) | October, 1 to 31 October in the last cycle | Annual, following screening | Owner, if selected by NHS England | NHSBSA CPAF pages |
| Seasonal vaccination services registration (COVID-19 and adult flu) | 23:59 on 30 November 2026 | Annual, via MYS | Owner; no registration means no service and no payment in 2026/27 | NHS England service specification 2026/27 |
| PQS evidence and scheme end | 31 March 2027 | Annual, end of contract year | Whole team; declaration period precedes it | CPE PQS hub |
Three of these deserve a practitioner's footnote. The DSPT is how a pharmacy makes its annual information governance declaration under the NHS Terms of Service, and the 2026 edition added a question on multi-factor authentication for clinical IT systems, so the honest preparation includes asking your PMR supplier for its assurance position rather than discovering the gap in the last week of June. CPAF's screening questionnaire takes twenty minutes, but its answers, alongside other intelligence, determine who gets a monitoring visit, so it deserves a senior pair of eyes rather than delegation to whoever is quietest on a Tuesday. And the PQS aspiration window is genuinely short: fifteen days in July to claim an advance worth 80% of your intended points value, paid on 1 September, which for a cash-strapped pharmacy is materially better than waiting for the final reconciliation.
The complaints report deserves its own honesty note. The obligation to report annually on complaints for the year ending 31 March is set by the NHS complaints regulations, and the collection runs through MYS in spring, with LPC deadline trackers showing the 2025/26 window closing at the end of May 2026. The precise window is announced each year rather than fixed in regulation, so treat the NHSBSA notification as authoritative and the calendar entry as "May, confirm exact date".
What changed in the 2026/27 compliance year?
The 2026/27 year rearranged several familiar deadlines, and calendars copied forward from last year will be wrong in places. The largest change is vaccination: from 1 April 2026 a single combined advanced service covers both COVID-19 and adult influenza vaccination, replacing the separate services, with one registration on MYS and one deadline of 30 November 2026. Owners can still provide flu alone, but providing COVID-19 requires providing flu too. Fees moved as well: the adult flu item of service fee rose from £9.58 to £10.06, and COVID-19 vaccination pays £8.70 during the flu campaign from 1 September 2026 to 31 January 2027 and £10.06 outside it. The campaign itself opens to pregnant women from 1 September 2026 and other adult cohorts from 1 October 2026, and the childhood flu pilot for two and three year olds was extended with a wider opportunistic cohort.
The PQS shrank and simplified: a £20 million scheme, fewer requirements than previous years, no clinical audits required in 2026/27 and the aspiration payment raised from 75% to 80%. The Pharmacy First budget was merged into the core contract sum, which removes the year-end clawback risk but not the monthly mechanics. And the item to watch rather than diarise yet: independent prescribing joins Pharmacy First and the Pharmacy Contraception Service from autumn 2026, which will bring its own registration process, a £500 set-up payment and £525 monthly infrastructure payment, and new clinical governance requirements whose detail NHS England had not published at the time of writing. When the go-live guidance lands, it will add dates to this calendar, and we will update this page accordingly.
The monthly rhythm
The monthly deadlines are the ones that never make a compliance plan because everyone assumes they are handled, and they are the ones that cost actual money when missed. The prescription bundle and FP34C submission go to the NHSBSA by the 5th of the month following dispensing; a late bundle is a delayed payment on your single largest income line. Pharmacy First and New Medicine Service claims currently operate on a one-month claim window, with the two-month late claim extension agreed in the 2026/27 settlement arriving later in 2026, so until the change is implemented the safe assumption remains that a consultation unclaimed by month end plus the window is income gone. The NHSBSA publishes Pharmacy First cap band assignments monthly, and a pharmacy that does not check its band is delivering consultations blind to whether they will be paid. The Drug Tariff changes on the 1st of each month, and price concession announcements land through the month, both of which move the economics of what you dispensed under your feet.
The operational fix is boring and effective: a standing month-end checklist owned by one named person, covering bundle submission, service claims, cap check and any locally commissioned service claims, executed on the same two days every month.
"The pharmacies that leak claim income are not careless; they are pharmacies where the task belongs to everyone and therefore no one."
The quarterly rhythm
One quarterly obligation matters and fails silently: verifying the pharmacy's NHS Profile Manager entry. The NHS Terms of Service require owners to verify and update opening hours, contact details, facilities and services each quarter, and the data flows to the NHS website, the Directory of Services, 111 telephony and 111 online. A stale profile is not a cosmetic problem: it is 111 sending a patient to a consultation room you no longer staff on Saturdays, and it is the kind of finding that surfaces in a CPAF visit precisely because it is checkable in thirty seconds. Distance selling pharmacies gained their own NHS website profiles in late 2024, so online-only operators now carry the same quarterly duty.
Quarterly is also the sensible rhythm for internal reviews that have no external deadline but generate the evidence external processes demand: controlled drugs balance checks against the register, fridge and cold chain record audits, standard operating procedure review-date sweeps and a check that the responsible pharmacist record is complete. None of these has a national date. All of them are what a GPhC inspector samples, and the April 2026 enforcement review showed inspection failures concentrating on exactly this layer of risk management and record keeping rather than on exotic breaches.
Event-driven deadlines: clocks that start when something changes
The deadlines that catch competent owners are not calendar dates at all; they are clocks that start when something changes. The table below covers the main triggers.
| Trigger | The clock | The obligation |
|---|---|---|
| Superintendent pharmacist stops or resigns | No later than 28 days after stopping | Notify the GPhC with evidence of the stop date; a legal requirement, and the pharmacy needs a governance answer for the gap |
| Change of pharmacy ownership | Before and at completion | Notify the GPhC; separately, NHS market-entry change of ownership applications run on their own track and are not automatic, as buyers have discovered when applications were refused |
| Ceasing the seasonal vaccination service | 30 days notice | Notify the commissioner via the specified route and update the National Booking Service and NHS Profile Manager |
| De-registering from Pharmacy First or the Contraception Service | Immediate consequences | PQS gateway eligibility is lost under the scheme rules, and re-registration is barred for a period, so a de-registration decision is a PQS decision too |
| Data breach involving personal data | 72 hours | Report notifiable breaches to the ICO; the DSPT expects the incident process to exist before the incident |
| Changes to services or premises | Varies | GPhC notification requirements apply to certain service changes; NHS hours changes carry their own notice periods under the pharmaceutical services regulations |
The pattern across all of these is that the clock starts whether or not anyone in the building notices, which is why change events, a resignation, a sale conversation, a service decision, should trigger a compliance check as a reflex, not as an afterthought once the commercial excitement settles.
The registration and professional layer
The registration layer runs on anniversaries rather than fixed dates, which is why it belongs in your calendar with your dates on it. Pharmacy premises registration renews annually with the GPhC, with renewal managed through myGPhC and a lapse meaning the premises cannot lawfully operate as a pharmacy. Pharmacists and pharmacy technicians renew individually each year, submitting revalidation records with renewal, and a superintendent whose own registration lapses takes the pharmacy's governance down with them, so the sensible owner diarises the superintendent's renewal as a business deadline, not a personal one. Professional indemnity arrangements are declared at renewal and should be checked against what the pharmacy actually now does: a pharmacy that added a private prescribing service mid-year may find its cover description no longer matches its risk.
Two more annual renewals live in this layer. The ICO data protection fee renews annually for almost every pharmacy as a data controller, and it is the cheapest compliance failure available to an enforcement letter. And any Patient Group Direction based private services, travel vaccination being the common one, carry PGD expiry and training currency dates set by the PGD provider, which belong in the same anniversary calendar because an expired PGD converts a routine service into unlawful supply overnight.
The corporate calendar pharmacies forget
Pharmacy businesses are companies, and Companies House does not care that June was consumed by the DSPT. The confirmation statement is due annually within fourteen days of your review date. Private company accounts are due nine months after the financial year end, corporation tax is payable nine months and one day after the year end with the return due at twelve months, VAT returns and payments run one month and seven days after each quarter under Making Tax Digital, and PAYE settles monthly, by the 22nd when paying electronically. Workplace pension auto-enrolment re-enrolment falls every three years, with the re-declaration of compliance due within five months of the third anniversary of your staging or duties start date, a deadline whose five-month grace period lulls people into missing it entirely.
None of this is pharmacy-specific, which is exactly why it gets missed: the NHS calendar is loud, arrives by email and is discussed at LPC meetings, while the corporate calendar assumes you remembered. Insurance renewals, employer's liability, premises, cyber if you hold it, complete the set. The practical fix is to run one calendar, not two, so the confirmation statement sits next to CPAF and neither relies on a different person's memory.
How to actually run this calendar
The mechanics of running a compliance calendar matter more than the calendar itself, and three habits do most of the work.
- Every deadline gets one named owner, because the GPhC's own inspection evidence shows that shared obligations are unmet obligations: the failure patterns in the regulator's published findings are overwhelmingly missing risk assessments, lapsed review dates and incomplete records, which are ownership failures before they are knowledge failures.
- Schedule the work, not the deadline: the DSPT entry in your calendar should be a two-hour working session in May, not a red flag on 30 June.
- Verify dates annually against the sources, because as the 2026/27 changes above show, copied-forward calendars rot; the recurrence patterns in this guide are stable, but windows move by days each year and occasionally a whole service is restructured.
On tooling, be honest about what you need. A shared team calendar with named owners handles the date layer perfectly well. What a calendar cannot do is generate the evidence the deadlines exist to collect: the consultation records behind your claims, the risk assessments behind your CPAF answers, the audit trails behind your DSPT declaration. That evidence layer is a records infrastructure problem, and it is the same infrastructure a GPhC inspection samples, which is why building it once, properly, serves every deadline on this page at the same time.
Key takeaways
- The five anchor deadlines for 2026/27 are the DSPT by 30 June 2026, the CPAF screening questionnaire from 1 to 31 July 2026, the PQS aspiration window from 13 to 28 July 2026, the annual complaints report in the spring window and seasonal vaccination registration by 30 November 2026.
- From 1 April 2026 a single combined advanced service covers COVID-19 and adult flu vaccination, with one MYS registration, a flu fee of £10.06 and the campaign opening to pregnant women from 1 September 2026.
- The monthly layer, prescription bundles by the 5th, service claims within their windows and cap band checks, is where missed compliance directly becomes missed income.
- NHS Profile Manager verification is a quarterly Terms of Service requirement that fails silently and surfaces in CPAF monitoring.
- Event-driven clocks include 28 days to notify the GPhC of a superintendent stopping, 72 hours for notifiable data breaches and 30 days notice to cease the vaccination service.
- Anniversary-based deadlines, GPhC premises and registrant renewals, ICO fees, confirmation statements and accounts, are unique to each pharmacy and belong in the same single calendar as the national dates.
- Every deadline needs one named owner and a scheduled working session before it, because shared obligations are the ones that get missed.
FAQs
Calendars don’t create evidence.
The calendar tells you when the evidence is due; it cannot create the evidence. Dataforge PMR generates the records layer as your services run, from consultation and clinical assessment records through to audit trails and task ownership, so that when the DSPT, a CPAF visit or an inspection asks for proof, it already exists. See it against your own compliance year in 30 minutes.
Book a demo