Innovating privacy by design, through regulatory sandboxes

Let’s begin with a question: what do we do when innovation moves faster than regulation?

Traditionally, the answer has been to slow things down; to wait; to assess the risk. But what if we could do better? What if we could create space for innovation to proceed safely: where new technologies can be tested, observed, and refined with regulators at the table?

This is the role of the regulatory sandbox.

A sandbox is a controlled environment where innovators and regulators can work together to trial new approaches, whether it’s a novel use of AI, a new biometric application, or a cutting-edge data-sharing platform. The goal is simple: to encourage innovation, without compromising privacy, security, or accountability.

We’ve seen excellent examples of this model around the world.

In the UK, the Information Commissioner’s Office (ICO) launched its Regulatory Sandbox in 2019, offering support to organizations seeking to deploy data-driven products that could benefit the public. One of their sandbox participants developed an AI-based recruitment tool and, with the ICO’s input, was able to enhance fairness and explainability while meeting data protection obligations.

In Singapore, the Infocomm Media Development Authority (IMDA) introduced the Data Regulatory Sandbox under its Digital Economy Framework. There, participants have piloted data trusts and federated learning models with strong oversight which showcased how you can experiment with data innovation while keeping individuals’ rights front and center.

In the Middle East, the Saudi Data & AI Authority (SDAIA) has emerged as a leading example in the region and globally. The SDAIA Regulatory Sandbox for AI and Data Use is exemplary, not just because of its governance rigor but because of its vision. It recognizes that responsible AI and data innovation are not necessarily contradictory; they are in fact complementary. The sandbox provides innovators with structured guidance, real-time feedback, and a pathway to deploy solutions that align with national priorities and global best practices.

In short, this is a place where privacy by design is not just encouraged; it’s expected.