diff --git a/spec/components/create_log_actions_component_spec.rb b/spec/components/create_log_actions_component_spec.rb
index 8444b939e..b1caa1443 100644
--- a/spec/components/create_log_actions_component_spec.rb
+++ b/spec/components/create_log_actions_component_spec.rb
@@ -66,7 +66,7 @@ RSpec.describe CreateLogActionsComponent, type: :component do
 
     context "when not support user" do
       context "without data sharing agreement" do
-        let(:user) { create(:user, organisation: create(:organisation, :without_dpc)) }
+        let(:user) { create(:user, organisation: create(:organisation, :without_dpc), with_dsa: false) }
 
         it "does not render actions" do
           expect(component).not_to be_display_actions
diff --git a/spec/components/data_protection_confirmation_banner_component_spec.rb b/spec/components/data_protection_confirmation_banner_component_spec.rb
index 3064a1b8e..608628093 100644
--- a/spec/components/data_protection_confirmation_banner_component_spec.rb
+++ b/spec/components/data_protection_confirmation_banner_component_spec.rb
@@ -5,11 +5,11 @@ RSpec.describe DataProtectionConfirmationBannerComponent, type: :component do
 
   let(:component) { described_class.new(user:, organisation:) }
   let(:render) { render_inline(component) }
-  let(:user) { create(:user) }
+  let(:user) { create(:user, with_dsa: false) }
   let(:organisation) { user.organisation }
 
   context "when user is support and organisation is blank" do
-    let(:user) { create(:user, :support) }
+    let(:user) { create(:user, :support, with_dsa: false) }
     let(:organisation) { nil }
 
     it "does not display banner" do
@@ -37,8 +37,8 @@ RSpec.describe DataProtectionConfirmationBannerComponent, type: :component do
     context "when org does not have a signed data sharing agreement" do
       context "when user is not a DPO" do
         let(:organisation) { create(:organisation, :without_dpc) }
-        let(:user) { create(:user, organisation:) }
-        let!(:dpo) { create(:user, :data_protection_officer, organisation:) }
+        let(:user) { create(:user, organisation:, with_dsa: false) }
+        let!(:dpo) { create(:user, :data_protection_officer, organisation:, with_dsa: false) }
 
         it "displays the banner and shows DPOs" do
           expect(component.display_banner?).to eq(true)
@@ -50,7 +50,7 @@ RSpec.describe DataProtectionConfirmationBannerComponent, type: :component do
 
       context "when user is a DPO" do
         let(:organisation) { create(:organisation, :without_dpc) }
-        let(:user) { create(:user, :data_protection_officer, organisation:) }
+        let(:user) { create(:user, :data_protection_officer, organisation:, with_dsa: false) }
 
         it "displays the banner and asks to sign" do
           expect(component.display_banner?).to eq(true)
@@ -141,8 +141,8 @@ RSpec.describe DataProtectionConfirmationBannerComponent, type: :component do
       context "when org does not have a signed data sharing agreement" do
         context "when user is not a DPO" do
           let(:organisation) { create(:organisation, :without_dpc) }
-          let(:user) { create(:user, organisation:) }
-          let!(:dpo) { create(:user, :data_protection_officer, organisation:) }
+          let(:user) { create(:user, organisation:, with_dsa: false) }
+          let!(:dpo) { create(:user, :data_protection_officer, organisation:, with_dsa: false) }
 
           it "displays the banner and shows DPOs" do
             expect(component.display_banner?).to eq(true)
@@ -168,7 +168,7 @@ RSpec.describe DataProtectionConfirmationBannerComponent, type: :component do
 
         context "when user is a DPO" do
           let(:organisation) { create(:organisation, :without_dpc) }
-          let(:user) { create(:user, :data_protection_officer, organisation:) }
+          let(:user) { create(:user, :data_protection_officer, organisation:, with_dsa: false) }
 
           it "displays the banner and asks to sign" do
             expect(component.display_banner?).to eq(true)
diff --git a/spec/factories/organisation.rb b/spec/factories/organisation.rb
index c42a9d6a2..f498632cd 100644
--- a/spec/factories/organisation.rb
+++ b/spec/factories/organisation.rb
@@ -25,11 +25,11 @@ FactoryBot.define do
     end
 
     after(:create) do |org, evaluator|
-      if evaluator.with_dsa
+      if evaluator.with_dsa && !org.data_protection_confirmed?
         create(
           :data_protection_confirmation,
           organisation: org,
-          data_protection_officer: org.users.any? ? org.users.first : create(:user, :data_protection_officer, organisation: org),
+          data_protection_officer: org.users.any? ? org.users.first : create(:user, :data_protection_officer, organisation: org, with_dsa: false),
         )
       end
     end
diff --git a/spec/factories/user.rb b/spec/factories/user.rb
index 0626cccd1..956d88332 100644
--- a/spec/factories/user.rb
+++ b/spec/factories/user.rb
@@ -27,8 +27,12 @@ FactoryBot.define do
       old_user_id { SecureRandom.uuid }
     end
 
-    after(:create) do |user, _evaluator|
-      unless user.organisation.data_protection_confirmed?
+    transient do
+      with_dsa { true }
+    end
+
+    after(:create) do |user, evaluator|
+      if evaluator.with_dsa && !user.organisation.data_protection_confirmed?
         create(
           :data_protection_confirmation,
           organisation: user.organisation,
diff --git a/spec/policies/user_policy_spec.rb b/spec/policies/user_policy_spec.rb
index e35e078e4..e2266cb48 100644
--- a/spec/policies/user_policy_spec.rb
+++ b/spec/policies/user_policy_spec.rb
@@ -201,7 +201,7 @@ RSpec.describe UserPolicy do
       end
 
       context "and user is the DPO that hasn't signed the agreement" do
-        let(:user) { create(:user, active: false, is_dpo: true) }
+        let(:user) { create(:user, active: false, is_dpo: true, with_dsa: false) }
 
         it "does not allow deleting a user as a provider" do
           expect(policy).not_to permit(data_provider, user)
diff --git a/spec/requests/bulk_upload_lettings_logs_controller_spec.rb b/spec/requests/bulk_upload_lettings_logs_controller_spec.rb
index d9a9a508d..18b208e74 100644
--- a/spec/requests/bulk_upload_lettings_logs_controller_spec.rb
+++ b/spec/requests/bulk_upload_lettings_logs_controller_spec.rb
@@ -13,7 +13,7 @@ RSpec.describe BulkUploadLettingsLogsController, type: :request do
   describe "GET /lettings-logs/bulk-upload-logs/start" do
     context "when data protection confirmation not signed" do
       let(:organisation) { create(:organisation, :without_dpc) }
-      let(:user) { create(:user, organisation:) }
+      let(:user) { create(:user, organisation:, with_dsa: false) }
 
       it "redirects to lettings index page" do
         get "/lettings-logs/bulk-upload-logs/start", params: {}
diff --git a/spec/requests/bulk_upload_sales_logs_controller_spec.rb b/spec/requests/bulk_upload_sales_logs_controller_spec.rb
index 6fcf7c15d..7cd6d4be8 100644
--- a/spec/requests/bulk_upload_sales_logs_controller_spec.rb
+++ b/spec/requests/bulk_upload_sales_logs_controller_spec.rb
@@ -13,7 +13,7 @@ RSpec.describe BulkUploadSalesLogsController, type: :request do
   describe "GET /sales-logs/bulk-upload-logs/start" do
     context "when data protection confirmation not signed" do
       let(:organisation) { create(:organisation, :without_dpc) }
-      let(:user) { create(:user, organisation:) }
+      let(:user) { create(:user, organisation:, with_dsa: false) }
 
       it "redirects to sales index page" do
         get "/sales-logs/bulk-upload-logs/start", params: {}
diff --git a/spec/requests/organisations_controller_spec.rb b/spec/requests/organisations_controller_spec.rb
index a41db9791..e6fb20ac7 100644
--- a/spec/requests/organisations_controller_spec.rb
+++ b/spec/requests/organisations_controller_spec.rb
@@ -2145,7 +2145,7 @@ RSpec.describe OrganisationsController, type: :request do
             Timecop.unfreeze
           end
 
-          let(:user) { create(:user, is_dpo: true, organisation:) }
+          let(:user) { create(:user, is_dpo: true, organisation:, with_dsa: false) }
 
           it "returns redirects to details page" do
             post "/organisations/#{organisation.id}/data-sharing-agreement", headers: headers
diff --git a/spec/views/logs/_create_for_org_actions.html.erb_spec.rb b/spec/views/logs/_create_for_org_actions.html.erb_spec.rb
index 1f2918218..e82cb8d27 100644
--- a/spec/views/logs/_create_for_org_actions.html.erb_spec.rb
+++ b/spec/views/logs/_create_for_org_actions.html.erb_spec.rb
@@ -20,7 +20,7 @@ RSpec.describe "logs/_create_for_org_actions.html.erb" do
   end
 
   context "without data sharing agreement" do
-    let(:user) { create(:user, organisation: create(:organisation, :without_dpc)) }
+    let(:user) { create(:user, organisation: create(:organisation, :without_dpc), with_dsa: false) }
 
     it "does not include create log buttons" do
       render
diff --git a/spec/views/organisations/data_sharing_agreement.html.erb_spec.rb b/spec/views/organisations/data_sharing_agreement.html.erb_spec.rb
index 3c57dcf8a..8bcb29c9d 100644
--- a/spec/views/organisations/data_sharing_agreement.html.erb_spec.rb
+++ b/spec/views/organisations/data_sharing_agreement.html.erb_spec.rb
@@ -17,7 +17,7 @@ RSpec.describe "organisations/data_sharing_agreement.html.erb", :aggregate_failu
   let(:data_protection_confirmation) { nil }
 
   context "when dpo" do
-    let(:user) { create(:user, is_dpo: true, organisation: create(:organisation, :without_dpc)) }
+    let(:user) { create(:user, is_dpo: true, organisation: create(:organisation, :without_dpc), with_dsa: false) }
 
     it "renders dynamic content" do
       render
diff --git a/spec/views/organisations/show.html.erb_spec.rb b/spec/views/organisations/show.html.erb_spec.rb
index 4314360dc..6c9990317 100644
--- a/spec/views/organisations/show.html.erb_spec.rb
+++ b/spec/views/organisations/show.html.erb_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe "organisations/show.html.erb" do
   let(:organisation_with_dsa) { create(:organisation) }
 
   context "when dpo" do
-    let(:user) { create(:user, is_dpo: true, organisation: organisation_without_dpc) }
+    let(:user) { create(:user, is_dpo: true, organisation: organisation_without_dpc, with_dsa: false) }
 
     it "includes data sharing agreement row" do
       render
@@ -32,7 +32,7 @@ RSpec.describe "organisations/show.html.erb" do
     end
 
     context "when accepted" do
-      let(:user) { create(:user, organisation: organisation_with_dsa) }
+      let(:user) { create(:user, organisation: organisation_with_dsa, with_dsa: false) }
 
       it "includes data sharing agreement row" do
         render
@@ -55,7 +55,7 @@ RSpec.describe "organisations/show.html.erb" do
   end
 
   context "when support user" do
-    let(:user) { create(:user, :support, organisation: organisation_without_dpc) }
+    let(:user) { create(:user, :support, organisation: organisation_without_dpc, with_dsa: false) }
 
     it "includes data sharing agreement row" do
       render
@@ -82,7 +82,7 @@ RSpec.describe "organisations/show.html.erb" do
     end
 
     context "when accepted" do
-      let(:user) { create(:user, :support, organisation: organisation_with_dsa) }
+      let(:user) { create(:user, :support, organisation: organisation_with_dsa, with_dsa: false) }
 
       it "includes data sharing agreement row" do
         render
@@ -125,7 +125,7 @@ RSpec.describe "organisations/show.html.erb" do
   end
 
   context "when not dpo" do
-    let(:user) { create(:user, organisation: organisation_without_dpc) }
+    let(:user) { create(:user, organisation: organisation_without_dpc, with_dsa: false) }
 
     it "includes data sharing agreement row" do
       render
@@ -149,7 +149,7 @@ RSpec.describe "organisations/show.html.erb" do
     end
 
     context "when accepted" do
-      let(:user) { create(:user, organisation: organisation_with_dsa) }
+      let(:user) { create(:user, organisation: organisation_with_dsa, with_dsa: false) }
 
       it "includes data sharing agreement row" do
         render