Can I enter the Sandbox with a product/service that is already processing personal information?
No. We can only provide support to innovators that are still undergoing product development. This could be at the early research phase or right up to preparation-to-launch on the market. As long as you have not yet started processing personal information you can apply for the Sandbox.
Does my organisation have to be a data controller in order to apply to the Sandbox?
No, not necessarily. We welcome applications from controllers, processors or where you will have no data protection role in the eventual processing. For example, you may be looking to develop a product or service which is then used by another organisation in their processing of personal data. We consider data protection by design to be a responsibility of all organisations involved in a supply chain.
Can joint controllers participate in the Sandbox?
For ease of communication and in order to manage the relationships, we expect there to be a single point of contact that the Sandbox engages with on a regular basis. We will ask you to appoint a lead organisation to take responsibility for managing the input of the other organisations and their compliance with the terms and conditions. We will have no formal relationship with the other organisations.
My organisation has already participated in the Sandbox in a previous year, can we apply again?
We select projects based on how innovative their use of data is, so organisations are free to apply whether or not they have been previously involved. If your project is not significantly different to any which have previously been in the Sandbox, it is unlikely that we would progress your application as it would be of limited public benefit.
Do we need sign-off by my organisation’s director to participate in the Sandbox?
Yes, we ask for confirmation of authority to submit from a member of staff with sufficient seniority at application stage, e.g. a Data Protection Officer, a SIRO, a CEO or Director.