Costs and Resources

Do organisations need to pay to participate in the Sandbox?

The Regulatory Sandbox is a free service. Organisations receive access to ICO expertise and support as they develop new services. This supports the UK in its ambition to be an innovative economy and helps to inform future ICO guidance.

Will the ICO be providing financial support as part of the Sandbox?

We are unable to provide any financial support if you wish to apply to the Sandbox.

We ask that applicants take note of the ‘data protection by design and default' requirements, which specify that you must consider the costs of implementation of any safeguards or measures needed to protect the rights and freedoms of any data subjects affected by processing.

In the Sandbox, we may recommend that you implement certain controls in respect of high risk processing, and therefore we ask that you consider this possibility prior to applying to the Sandbox.

Will we be expected to cover any costs incurred by the ICO during the Sandbox?

No, we do not expect you to cover any of the ICO’s expenses incurred in the Sandbox.

Does our Data Protection Officer have to be involved in the application to the Sandbox?

If you have a DPO we expect that this member of staff will have sufficient knowledge of data protection to be a useful point of contact for us to engage with alongside other members of staff, for example, development teams. As a minimum, we expect that your DPO will be aware of your involvement in the Sandbox.

Will the ICO deal with other regulators on our behalf?

We will not deal with other regulators on your behalf. However, if your proposed product or service is subject to other regulations, we ask that you notify us about this in your final application. We may ask you to provide evidence about how the product or service complies with these other regulations and we may contact other regulators to confirm this is the case.

What if we are not ready to participate in the Sandbox when we are accepted?

Your organisation does not need to be ready to participate immediately, for example if you are waiting on internal or external dependencies. We operate a ‘roll on-roll off’ model which means when one organisation exits the Sandbox we can invite a new one in from our pool of successful applicants. We ask that you provide us with a good estimated date of when your organisation will be ready to commence work in the Sandbox within your Expression of Interest. We will also discuss this timing with you and agree a possible entry date for your participation in an engagement call.

You will be assigned a dedicated ICO Senior Policy Officer, who will contact you around two weeks prior to the agreed entry date to ensure your organisation’s readiness.