REGULATORY SANDBOX

Welcome to the Information Commissioner’s Regulatory Sandbox (the “Sandbox”) page.

The Sandbox offers organisations a controlled environment to test innovative products, services, or data uses, while receiving regulatory guidance to ensure compliance with Gibraltar’s privacy and data protection laws before full-scale deployment.

The Sandbox aims to reduce uncertainty and provide regulatory assurance by offering a collaborative space for organisations to innovate with confidence, promoting the development of compliant solutions in emerging sectors and technologies.

Who the Sandbox is for?

The Sandbox is open to organisations of all sizes, including start-ups, small to medium-sized enterprises, large enterprises, public bodies, and non-profits. Participation is intended for activities, services, or models that will involve the processing of personal data under Gibraltar’s privacy and data protection laws.

How does the Sandbox operate?

The Sandbox provides advisory regulatory mechanisms, which may include –

• in-person or virtual workshops to inform early thinking;

• phased or iterative informal steers and guidance throughout the project lifecycle;

• step-by-step walkthroughs of proposed processing activities leading to informal guidance; and

• informal supervision and monitoring of product or service testing.

Sandbox model

The Sandbox is currently in a “beta phase”, meaning its structure, processes, and governance may change as the GRA learns from experience and participant feedback.

Participation in the Sandbox follows a phased intake model, beginning with an “expression of interest” stage followed by a full application process for selected organisations. From these applications, a single Sandbox project will be selected for participation at any given time to ensure appropriate oversight, engagement, and regulatory support.

How to apply

Before submitting an expression of interest, organisations must review the Guidance Note, which explains the eligibility criteria, the application process, participation conditions, and the phases of the Sandbox.

Once you have reviewed the Guidance Note, you may complete the Expression of Interest Form and send this to: dpsandbox@gra.gi 

If you have any questions after reviewing the Guidance Note, please email: dpsandbox@gra.gi.