FAQs

Frequently asked questions

Processing data in the Sandbox

• Will the ICO provide us with a hosted environment to conduct our work in?

• Will the ICO assist us to procure data?

• Will we be able to use real customer (live) data or can we use created/simulated (dummy) data for testing?

• Does the processing carried out by our product or service have to be processed solely within the UK?

• How does the ICO’s data protection impact assessment process link in with the Sandbox?

Costs and Resources

• Do organisations need to pay to participate in the Sandbox?

• Will the ICO be providing financial support as part of the Sandbox?

• Will we be expected to cover any costs incurred by the ICO during the Sandbox?

• Does our Data Protection Officer have to be involved in the application to the Sandbox?

• Will the ICO deal with other regulators on our behalf?

• What if we are not ready to participate in the Sandbox when we are accepted?

Who can enter the Sandbox?

• Can I enter the Sandbox with a product/service that is already processing personal data?

• Does my organisation have to be a data controller in order to apply to the Sandbox?

• Can joint controllers participate in the Sandbox?

• My organisation has already participated in the Sandbox in a previous year, can we apply again?

• Do we need sign-off by my organisation’s director to participate in the Sandbox?

Assessing applications to the Sandbox

• What is meant by ‘public benefit’?

• How will the ICO manage conflicts of interest?

During the Sandbox

• What happens if we encounter a breach of personal data whilst our product is in the Sandbox?

• What if a member of the Sandbox team discovers that we are not compliant in other areas of our organisation during the course of the Sandbox?

• How much does the ICO intend to publicise about our participation in the Sandbox?

• What will the ICO’s process be for handling freedom of information requests in respect of commercially sensitive information?

• In what circumstances could our participation in the Sandbox be terminated?

After the Sandbox

• After our exit, will we continue to have any contact with the Sandbox?