The UK Information Commissioner's Office (ICO) stated on July 30, 2026, that a data protection sandbox for testing AI and emerging technologies is feasible but requires primary legislation. This changes the existing regulatory framework for data protection and innovation. Companies testing AI and emerging technologies are affected, and a key practical consequence is the need for time-limited exemptions from data protection law. The ICO's statement clarifies the need for safeguards to protect its independence and individual rights.

Full News Breakdown

The ICO's reports published on July 30, 2026, highlighted the limitations of existing sandboxes in supporting live-data tests that push legal boundaries and addressing issues involving multiple regulators.

• The UK ICO said a data protection sandbox would require primary legislation and safeguards.

• Existing sandboxes are limited in supporting live-data tests and addressing issues involving multiple regulators.

• The ICO plans to speed up and clarify its existing sandboxes.

• The UK government must decide whether to legislate for the sandbox.

How Does This Affect You?

The ICO's statement clarifies that primary legislation is required for a data protection sandbox. This shift creates a compliance obligation for companies testing AI and emerging technologies, which may wish to consider the need for time-limited exemptions from data protection law. The ICO's plans to speed up and clarify its existing sandboxes may influence pending client matters and drafting changes.

For Lawyers & Advocates

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 will need to be considered in light of the ICO's statement on the need for primary legislation for a data protection sandbox. Lawyers advising clients on AI and emerging technologies may find it useful to consider the potential need for time-limited exemptions from data protection law. The ICO's plans to speed up and clarify its existing sandboxes may affect client matters, and lawyers may want to review drafting changes. Lawyers may also want to consider the potential risks and benefits of a data protection sandbox for their clients.

For Law Students

The ICO's statement provides an opportunity to examine the importance of data protection in the context of emerging technologies. The decision is particularly relevant for the study of Data Protection Law, AI and Emerging Technologies, Regulatory Frameworks, and Human Rights Law. Comparing this judgment to Schrems II (2020, CJEU) and Google Spain (2014, CJEU) teaches about the importance of data protection in the context of emerging technologies and the right to be forgotten.

For Businesses

Companies developing AI and emerging technologies may want to consider the potential need for time-limited exemptions from data protection law and the implications of the ICO's statement for their business models. Businesses may want to review their internal documentation and filing processes to take into account the ICO's existing sandboxes and potential future legislation. Companies may also want to decide whether to engage with the ICO's sandbox and how to balance the need for innovation with the need to protect individual rights.

Key Takeaways

• The legal principle established is the need for primary legislation to establish a data protection sandbox for AI and emerging technologies.

• The practice consequence is that lawyers may find it useful to consider the potential need for time-limited exemptions from data protection law when advising clients on AI and emerging technologies.

• The enforcement consequence is that the ICO can require companies to comply with data protection law, and may need to clarify its existing sandboxes and develop new guidance for emerging technologies.

• The UK government's decision on whether to legislate for a data protection sandbox and the ICO's development of new guidance for emerging technologies may influence the regulatory landscape.

• General Counsel may want to review internal documentation and filing processes before the establishment of a data protection sandbox.

Source: Sandbox to test AI uses is only feasible with new legislation, UK ICO says