The Regulatory Sandbox is a free service developed by the ICO, to support organisations who are creating products and services which utilise personal data in innovative and safe ways.
Participants will have the opportunity to engage with our Sandbox team, to draw upon our wider ICO expertise and advice on mitigating risks and embedding ‘data protection by design’.
The Sandbox provides a free, professional service for organisations, of varying types and sizes, across a number of sectors.
We are currently accepting expressions of interest to enter the Sandbox in 2024.
4 October-31 December 2023 – Expressions of Interest to be submitted to the ICO Sandbox.
2 January-7 February 2024 – The Regulatory Sandbox team will review submissions.
8 February 2024 onwards – We will invite selected organisations to submit formal applications.
What are the benefits of taking part in the Sandbox?
There are a number of benefits to your organisation participating in the Sandbox. These include:
- free access to ICO expertise and support;
- increased confidence in the compliance of your finished product or service;
- a better understanding of the data protection frameworks and how these affect your business;
- being seen as accountable and proactive in your approach to data protection, by customers, other organisations and the ICO, leading to increased consumer trust in your organisation;
- the opportunity to inform future ICO guidance;
- supporting the UK in its ambition to be an innovative economy; and
- contributing to the development of products and services that can be shown to be of value to the public.
How can I take part in the Sandbox?
We are interested in working with innovative projects using personal data.
For further information about the kinds of innovative projects we are interested in working with this year, please see our key areas of focus for the Regulatory Sandbox.
We will consider Expressions of interest against our criteria as they come in, and once our existing spaces are full, we may place successful applicants onto a waiting list as part of a ‘roll on roll off’ model.
Frequently asked questions
Will the ICO provide us with a hosted environment to conduct our work in?
No, we will not be hosting environments as part of the Sandbox. You will be responsible for providing your own IT infrastructure.
Will the ICO assist us to procure data?
No, we are unable to advise you about where or how to procure data. Nor are we able to provide any funding to assist you in procuring data. If you plan to carry out live testing on personal data in the Sandbox, you should consider how you will practically obtain that data in advance of submitting an Expression of Interest.
Will we be able to use real customer (live) data or can we use created/stimulated (dummy) data for testing?
You may use either live or dummy data to test your products so long as they are compliant with data protection law. Using dummy data may be preferable as it does not carry any risk to data subjects. If you are processing live data, you will need to complete a DPIA beforehand if it is likely to result in a high risk to the data subject. We will not be providing live or dummy data and expect you to source your own data for testing.
Will the ICO deal with other regulators on our behalf?
We will not deal with other regulators on your behalf. However, if your proposed product or service is subject to other regulations, we ask that you notify us about this in your final application. We may ask you to provide evidence about how the product or service complies with these other regulations and we may contact other regulators to confirm this is the case.Will the ICO be providing financial support as part of the Sandbox?