The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Gambling Commission

Whilst many people enjoy gambling without experiencing harm there is clear evidence this is not the case for all. As technology develops within the online space it has become apparent that new opportunities are emerging to significantly enhance protections for the public and players from gambling-related harm. A major opportunity has been identified by the Gambling Commission in the form of the development of a Single Customer View (SCV) for online players. The SCV will allow data which already exists around player behaviours to be aggregated in a safe, controlled manner to drive better decision making, actions and evaluation around player protection across all online gambling providers. The Commission recognises there is risk around any new form of data use and so is working with the ICO to ensure the SCV is delivered in a way which puts data security and the interests of the public and players as the absolute priority throughout.

Entered: November 2020

Global Cyber Alliance

The Global Cyber Alliance (GCA) have entered the Sandbox to explore the possible next steps in developing their DomainTrust concept and the potential benefits of processing personal data in the platform to help fight against cyber-criminals. DomainTrust is an intelligence platform that provides registries, registrars, and cyber protection agencies with high quality, large-scale sets of data on suspected malicious and criminal domains being used in phishing attempts, malware distribution, and command and control (C2) activities. This data provides intelligence upon which they can take further action: investigation, suspension, or disablement.

Entered: November 2020

CDD Services

SafeGuarden technology from CDD Services is redefining digital compliance by giving individuals control of their personal data. With increasing digital exposure, communities of people depend on a safe space to connect and communicate with a variety of stakeholders – from carers and support staff to friends and colleagues. These communities rely on, and expect, data privacy and security.

Hull4Heroes is a veteran charity, supporting ex-service men and women and their families. The codeless SafeGuarden platform is a dynamic xRM with a suite of configurable apps and digital tools to help individuals connect in a safe, simple and secure way. The platform is being piloted to support the Veteran’s Village project, and aims to be socially inclusive and useful, protect individual rights, and allow individuals, organisations and communities to work together as one.

SafeGuarden will enable personal data exchange and real-time consent control, allowing support givers to focus on those in need, accelerating onboarding and simplifying multi-agency referral and monitoring of individuals within their best interests.

Successfully being accepted into the Sandbox will enable CDD Services to work directly with the ICO to ensure that data protection by design is embedded in the platform and its data sharing processes, safeguarding identity management, security and privacy.

Entered: December 2020

Greater London Authority

In order to reduce levels of violence in London, the Mayor has set up a Violence Reduction Unit (VRU) which is taking a public health approach to this issue. As part of this work, the VRU needs to better understand how public health and social services can be managed to prevent and reduce crime, with a focus on early intervention. There is increasing interest from the VRU, the Mayor’s Office of Policing and Crime (MOPAC) and the Greater London Authority (GLA), for health, social and crime data to be looked at in an integrated and collaborative way.

Entered: July 2019

Novartis Pharmaceuticals UK Limited

Novartis is exploring the use of voice technology within healthcare. Through its Voice Enabled Solutions project, Novartis is working with healthcare professionals to design solutions to make patient care easier, and addressing the data privacy challenges posed by this emerging technology.

Joined: July 2019

The Ministry of Housing, Communities and Local Government

The Ministry of Housing, Communities and Local Government's project partners with Blackpool Council and the Department of Work and Pensions, and seeks to match personal information controlled by multiple parties in order to create a dataset that will allow MHCLG to understand more about the private rented sector in Blackpool, who lives there, and how we can help improve the quality of properties.

Entered: July 2019

Tonic Analytics

The Galileo Programme was launched in 2017 and is jointly sponsored by the National Police Chiefs’ Council and Highways England. Galileo’s primary focus is on the ethical use of innovative data analytics technology to improve road safety while also preventing and detecting crime.

Entered: July 2019 


This ICO Sandbox partnership will offer age appropriate child-centred content moderation, together with privacy information and accessible parental consent options at a global scale. Yoti’s identity platform, GoBubble’s child-content moderation SaaS (GoBubbleWrap) and others will:

  • extend Yoti age estimation for under 13 year olds without ID documents, where their face is analysed and the image instantly deleted..
  • use this technology to launch an age verified, content moderated esports membership platform for under 18s with parental consent options, including the use of age estimation for parental consent

The partnership will offer customisable solutions to help other platforms and content communities meet regulatory requirements to protect children from unwanted intrusions, inappropriate content and minimise the risk of grooming - offered on a software as a service basis.

Entered: November 2020


Seers provides a privacy and consent management platform to help companies become compliant with data privacy regulations worldwide, including GDPR, PECR, CCPA & LGPD. Seers is working with ICO Sandbox Team to enhance its Consent Management Platform (CMP) that provides child privacy consent management. The child privacy consent management platform enables children or parental/ guardian consent and allows age verification before a child can gain access to website content to enable companies to comply with the new age appropriate code of practice to protect children's privacy online. It is imperative to protect children's privacy since 1 in 5 internet users are now children and Seers is offering this CMP to help ensure Children’s ongoing safety when using the internet.

Entered: November 2020