The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Betting and Gaming Council

As the largest UK operators, Betting and Gaming Council (BGC) members Entain, William Hill, 888, Gamesys, bet365 and Flutter have agreed to trial a solution for the sharing of data sets from participating gambling operators. The BGC are committed to driving change and raising standards to prevent the impact of problem gambling which can have a significant impact on those affected.

The aim of the trial is to facilitate fast, proactive intervention and to prevent incidents of problem gambling. The proposed mechanism will ensure that if customers have multiple accounts with different operators, then the operators will be able to compliantly share data. This will allow them to identify and help manage problem gambling behaviour.

BGC will work with the ICO, with close engagement from the Gambling Commission on regulatory considerations, to understand the data protection considerations for a viable solution. They will look to identify the appropriate lawful basis for processing data and the safeguards required, particularly where that data is special category. BGC and participating operators are committed to ensuring the personal data of customers is used in a proportionate and appropriate way to identify harm and welcomes the opportunity to explore these issues with the expert steer of the ICO.

Entered: March 2022


The global pandemic has necessitated the widespread sharing of sensitive health information in order to travel, which has created novel challenges and increased privacy risks. Inaccuracies in data management cost airlines both in terms of government fines for incorrectly documented passengers, as well as being banned from destinations. Zamna wants to make it easier for people to travel for business and personal reasons, whilst still maintaining high levels of privacy and security.                     

Zamna utilises novel cryptography, decentralisation principles and blockchain technology to deliver an inclusive, privacy-preserving solution for pre-airport, seamless health status verification for the purpose of secure travel. Zamna’s solution requires no mobile apps, no document uploads or scans, no new infrastructure and no new processes. Instead it leverages existing airline technologies, standards and processes.

In the ICO Sandbox, Zamna will look to improve its technology processes and develop product enhancements to strengthen its privacy protective practices. The aim is to ensure Zamna’s service is best in class in facilitating the secure and compliant management of the whole lifecycle of the data within the travel industry.

Participation in the ICO Sandbox will clarify and evaluate the effectiveness of the anonymisation practices used by the Zamna; detailing the nature of the data in the hands of different stakeholders involved in the process of international travel. This will further clarify the role of infrastructure and technology providers when only processing anonymous data which will be beneficial for other providers in similar situations.

With the support of the ICO Sandbox, Zamna intends to set out the role and data protection responsibilities of health providers and airlines in the context of the Zamna service and the secure transmission of health data to facilitate seamless travel. This will ensure any processing of personal data is carried out in a way that ensures the rights of data subjects whilst also recognising the benefits and novel data protection aspects of the blockchain.

Entered: March 2022

Financial Institutions - facilitated by the Home Office and UK Finance

While current financial crime legislation means that Financial Institutions are able to share some information for the purpose of addressing financial crime risk, there are limitations. This can make it difficult to share data in some situations and difficult to address some specific money laundering typologies. The Participating Banks are currently exploring the legal framework and practicalities of sharing information, with the intention of sharing data on customers that pose the highest financial crime risk. This provides other Participating Banks with the ability to identify information relating to potential financial crime risk presented by their customers, or potential customers, that they would have otherwise not known.

The pilot is being facilitated by the Home Office and UK Finance, with a technology platform being provided by a secure third-party provider. Information sharing will be conducted by nine Participating Banks, however, the list of participants may change throughout the life of the pilot.

The participating organisations look forward to working with the ICO to explore how information sharing can be undertaken under UK GDPR, with appropriate data privacy mitigations. The overall effectiveness of such information sharing will also be assessed, and outcomes used to make recommendations for future implementation.

Entered: February 2022


Everybody should have a place to call home. Crisis’ Sandbox project looks to use system-wide real-time data. This is a fundamental shift from current practice that moves away from responding to homelessness and towards sustainably ending it. Achieving this change will be transformative.

Crisis, the national charity for homeless people, are working in partnership with local authorities across Oxfordshire; Oxford City Council, Cherwell District Council, South Oxfordshire District Council, Vale of White Horse District Council, West Oxfordshire District Council, Oxfordshire County Council and Oxfordshire Homelessness Alliance who provide homelessness services.

The consortia are developing effective county-wide data sharing to support the prevention and relief of homelessness. Crisis is leading the development of a By-Name List (BNL) which is a data capture and measurement tool that accounts for everyone experiencing homelessness in a place. It tracks the journey of each person, how they enter homelessness and then whether they leave the area or are housed and longer term whether they return to homelessness, to create a picture of the homelessness journey in a specific area. As the BNL is updated in real-time, it helps to address the issue that homelessness is transient, and therefore difficult to quantify. Using this data Crisis can then work with local areas to develop solutions to end homelessness there.

Crisis is pleased to be a part of the ICO Sandbox to explore whether consent is an appropriate lawful basis for the BNL and how the UK GDPR will apply to different organisations within the consortia and other partners involved in the data sharing ecosystem.

Entered: February 2022

Smart Data Foundry

Smart Data Foundry (previously known as Global Open Finance Centre of Excellence) is a collaboration between the University of Edinburgh, the Financial Data and Technology Association (FDATA) and FinTech Scotland. The aim is to build a data innovation organisation, serving the public, private and third sector. Its mission is to improve people’s lives by safely unlocking the potential of financial data to enable research, innovation and skills development in financial services and FinTechs.

In the Sandbox, Smart Data Foundry will work to develop a National Data Utility (NDU) to support data-driven research. Data will be maintained within a ‘safe-haven’ data infrastructure, based on a similar model utilised by Public Health Scotland (PHS). Alongside the NDU, Smart Data Foundry aims to develop an innovation environment to support innovation in data across a wide range of use cases. Both of these products will be made available for organisations to access in a controlled environment.

Smart Data Foundry is pleased to partner with the ICO Sandbox to examine how these two services could be connected to maximise social and economic benefits from data sharing for both research and innovation.

Entered: December 2021

Our Future Health

Our Future Health aims to be the UK’s largest ever health research programme. It is designed to help people live healthier lives for longer by giving researchers from universities, charities, the NHS and companies involved in health research an opportunity to discover and test more effective ways to predict, detect and treat common diseases such as dementia, cancer, diabetes, heart disease and stroke.

The aim is to recruit a cohort of five million adults that truly reflect the UK population to take part in Our Future Health. Participants will be asked to provide information about their health and lifestyles and small samples of their saliva and/or blood. Our Future Health will ask for permission to combine the information and samples that they give with existing information about them, including their health records. Researchers will use this information to make new discoveries about human health and diseases.

The safety and security of participant data is the most important consideration in the development of Our Future Health’s technology platforms. Being accepted into the Sandbox will allow Our Future Health to work with the ICO to make sure data protection, governance and privacy-by-design are at the heart of their work. They will be able to draw on ICO expertise and further develop data de-identification processes, data flows, data security and architecture, and data controllership.

Entered: October 2021

Good With

Young adults and financially disadvantaged people suffer an unfair “poverty premium” when trying to access the same credit and basic services as people who are better off. According to Fair By Design, this affects around 14 million people in the UK.

Good With’s objective is to help young people access affordable financial services by enabling them to demonstrate financial readiness with the help of an AI-driven smartphone companion they can talk to, develop their financial education and seek advice – in a way that fits into their lives.

Good With is pleased to partner with the ICO Sandbox to ensure its unique combination of data, cloud technology, risk modelling and sophisticated AI meets the highest standards and evolving regulations for transparency, safety, fairness and ethics.

By sharing its findings, Good With’s ambition is to raise the bar across industry for design that engages and empowers young people, trustworthy data-driven services, and business models that respect your privacy.

Entered: July 2021


FlyingBinary is a company that creates deep technology to unlock the talents of GenZ and Gen Alpha by delivering inclusive services online. Their mission is to design and deliver enabling technology, which leaves no-one behind online. They have developed secured and accredited Advisory AI services, which are used to support the clinical assessment of acute mental health care pathways.

As a next phase of development for these clinical AI services, FlyingBinary intend to utilise the Age Appropriate Design Code provisions, with the support of the ICO Sandbox, to design a new service to be used by the patient to support their own clinical assessment. The neural network we will use has been trained on 4 billion data points online to understand 20 of the 27 human emotions. This AI service will present to the patient the likely human response for any online content which they are requesting, prior to it being consumed.

Entered: February 2021

CDD Services

SafeGuarden technology from CDD Services is redefining digital compliance by giving individuals control of their personal data. With increasing digital exposure, communities of people depend on a safe space to connect and communicate with a variety of stakeholders – from carers and support staff to friends and colleagues. These communities rely on, and expect, data privacy and security.

Hull4Heroes is a veteran charity, supporting ex-service men and women and their families. The codeless SafeGuarden platform is a dynamic xRM with a suite of configurable apps and digital tools to help individuals connect in a safe, simple and secure way. The platform is being piloted to support the Veteran’s Village project, and aims to be socially inclusive and useful, protect individual rights, and allow individuals, organisations and communities to work together as one.

SafeGuarden will enable personal data exchange and real-time consent control, allowing support givers to focus on those in need, accelerating onboarding and simplifying multi-agency referral and monitoring of individuals within their best interests.

Successfully being accepted into the Sandbox will enable CDD Services to work directly with the ICO to ensure that data protection by design is embedded in the platform and its data sharing processes, safeguarding identity management, security and privacy.

Entered: December 2020