Source: TechTimes

The Information Commissioner’s Office (ICO) formally told government on July 30 that its eight-year voluntary sandbox cannot authorize AI developers to test on real personal data in ways that would contravene UK GDPR and the Data Protection Act 2018. The regulator’s sandbox, operational since 2018 and used by over a hundred organisations, can provide guidance and supervised environments but cannot grant legal permission to process personal data in ways the statute forbids. The report notes AI’s economic significance—an estimated contribution of £11.8 billion to UK GDP in 2025—and reports that nearly one-third of UK AI startup leaders are considering moving abroad due to regulatory complexity; it also records that the Data (Use and Access) Act 2025 did not resolve the gap for live-data testing.

The ICO’s research proposes a Statutory Regulatory Sandbox (SRS) that would give time-limited, supervised derogations authorizing otherwise-unlawful personal-data processing during defined testing windows under ICO oversight, but creating an SRS requires primary legislation and careful design. The report identifies two principal design challenges: protecting the regulator’s institutional independence and ensuring alternative accountability and governance mechanisms that safeguard individual data rights while a law is temporarily set aside. Public trust is framed as a prerequisite for any SRS, demand is described as real but narrow (targeting high-stakes edge cases), and the ICO warns of a structural enforcement conflict if it both grants derogations and enforces data protection rules. The report cites external critiques—such as an Open Rights Group May 2026 critique, a DSIT Select Committee finding, and an open letter from more than 70 experts—illustrating the independence question Parliament must resolve; meanwhile the ICO says it will improve its voluntary sandbox processes pending legislative action.