ICO Innovation Services

The ICO is committed to supporting the UK in its ambition to be an innovative economy.

We aim to enable innovation and facilitate economic growth by supporting businesses to bring privacy respectful products and services to market more quickly, whilst protecting the public’s personal data.

Whether you’re a small fintech start-up or a large public sector organisation using personal data to improve health outcomes, if you’re running new and novel projects using personal data, our innovation services are here to support you.

• Innovation advice service
• Regulatory sandbox
• Data protection impact assessment (DPIA) advice
• Innovation Hub

Innovation advice service

This is a fast, direct service for organisations doing new or innovative things with personal data. We give advice to help solve the data protection issues holding up the progress of your new product, service, or business model.

Find out more or ask your question.

Regulatory sandbox

The Sandbox is for organisations who intend to or are in the process of developing innovative products and services using personal data in the public interest.

Please see Our key areas of focus for the Regulatory Sandbox, for further information about the kinds of innovative projects we are interested in working in the Sandbox this year.

We welcome Expressions of Interest from start-ups, small or medium organisations and large organisations, across private, public and voluntary sectors.

Participants have the opportunity to engage with our Sandbox team, to draw upon our wider ICO expertise and advice on mitigating risks and embedding ‘data protection by design’. The Sandbox tailors its support to each project, with each individual participant receiving a bespoke Sandbox plan.

If you are interested in working with the Sandbox please send any queries or questions to [email protected].

Data protection impact assessment (DPIA) advice

The ICO’s DPIA team offers advice to organisations who have assessed their proposal to process personal data and have identified a high risk that they cannot reduce.

Data protection law requires organisations planning to process personal data to complete a Data Protection Impact Assessment (DPIA) if their proposal is likely to result in high risk.

If the DPIA identifies a high risk that can’t be reduced, then organisations must consult the ICO for advice before launching their product or service.

The team will provide written advice (typically within eight weeks), to help organisations to reduce or avoid the identified risk before proceeding.

There are more details in our guidance and you can contact the team at [email protected].

Innovation Hub

The Innovation Hub advises pre-market innovators developing, testing and refining new products and services that use personal data in new or significantly adapted ways. We do this by collaborating with regulators and innovation bodies hosting innovation programmes such as Challenges, Catapults, Incubators and TechSprints.

The Hub provides free, tailored support on privacy by design and key areas of data protection compliance. This can include providing expert data protection advice, mentoring innovators, and supporting events where innovators aim to produce privacy respectful new products.

Innovators can access this support as a one-off session or benefit from continuous assistance throughout the innovation programme.

The Hub’s work provides regulatory certainty through inclusive and empathetic engagement with innovators, and supports the ICO’s enduring strategic objective to empower responsible innovation and support sustainable economic growth.

The Hub has offered data protection advice to programmes run by Innovate UK – the UK’s innovation agency, the Digital Catapult – the UK authority on advanced digital technology, Nesta – the innovation foundation, and the Financial Conduct Authority (FCA).

If you are interested in discussing collaboration opportunities with the Innovation Hub or if you have any queries, please email [email protected].

Current collaborations include:

• Working with DSIT, Home Office and GCHQ in the SafetyTech Innovation Challenges
• Collaborating with the FCA as data protection mentors during TechSprints and supporting innovators referred by the FCA's Innovation Services
• Collaborating with DSIT, Innovate UK and the Equality & Human Rights Commission (EHRC) on the Fairness Innovation Challenge
• Working with UK and US regulatory counterparts on the UK-US Privacy Enhancing Technologies Prize Challenges
• Working with the Digital Catapult Bridge AI cohorts