Data Regulatory Sandbox
Start ServiceTarget Audience
Government Entities, Private Entities
Service Duration
60 days
Service Cost
Free of charge
About the Sandbox
The Data Regulatory Sandbox enables participating entities to test data-related products or services under a regulatory supervision, within a defined scope, timeframe, and set of requirements, before scaling their implementation.
The Sandbox is built on direct engagement between the regulatory authority and participating entities, ensuring appropriate support and enhancing their understanding of applicable regulatory requirements throughout the testing stages.
Testing involves applying the relevant regulatory requirements to the product or service and documenting the resulting outcomes, challenges, and observations. This enables the assessment of alignment with such requirements and the practical impact of their application.
Testing outcomes contribute to enhancing regulatory clarity, examining challenges and potential approaches to addressing them, and generating practical evidence to support the development of relevant regulatory instruments. This helps achieve a balance between regulatory compliance and enabling the responsible and sustainable use of data.
The Sandbox includes specialized tracks, including Personal Data Protection and Data Monetization, each with a defined scope, eligibility criteria, and specific requirements.
Main Tracks
The Sandbox comprises two main tracks, each targeting a specific category of participating entities based on its respective scope and requirements.
Personal Data Protection Track
Application Opening Date: October 2026
The track aims to support private entities in testing products or services involving the processing of personal data, assessing the effectiveness of the organizational, administrative, and technical measures implemented to protect personal data, and determining their alignment with the provisions of the Personal Data Protection Law (PDPL), its Implementing Regulations, and other applicable regulatory requirements. It also assesses the impact of such requirements on the product or service under testing, thereby contributing to the protection of data subjects’ rights and strengthening compliance with the provisions of the PDPL.
Bioinformatics
Sub-Track: Supports entities in testing bioinformatics products and services within the scope of the main tracks, with the aim of informing the development of governance frameworks for biological data.
Data Monetization Track
Application Opening Date: January 2027
The track aims to support entities in assessing the economic value of data, identifying priority use cases, and testing appropriate models for generating revenue from data products and services. This includes products and services developed or provided by government or private entities based on government data. The track assesses the effectiveness of these models and their alignment with applicable regulatory requirements, contributing to maximizing the value derived from data and fostering the development of the data market.
Bioinformatics Sub-Track: Supports entities in testing bioinformatics products and services within the scope of the main tracks, with the aim of informing the development of governance frameworks for biological data.
Benefits and Advantages
The Data Regulatory Sandbox is designed to provide participants with a range of benefits and advantages, including the following:
Benefits of Participation in the Sandbox
- Facilitating the understanding of regulatory requirements and the mechanisms for achieving compliance in a manner appropriate to the nature of the product or service offered.
- Enhancing customer confidence in products and services that have successfully fulfilled the requirements of the Data Regulatory Sandbox.
- Reducing the risks associated with innovation and experimentation through structured supervision and continuous oversight during the testing phase within the Sandbox.
Advantages Provided to Sandbox Participants
- Access to guidance and consultations, at no cost, from experts and specialists in relevant technical and regulatory fields.
- Participation in workshops specifically designed for Sandbox participants, covering topics related to the product or service and the corresponding regulatory requirements, controls, and operational measures.
- Receiving a digital badge upon successful completion of the Data Regulatory Sandbox under the designated track, thereby enhancing the credibility of the product or service and demonstrating its successful completion of the Sandbox testing requirements.
- Publication of the list of Sandbox graduates, along with information about their products or services, on the National Data Governance Platform.
- Receiving exclusive invitations to participate in, or share their success stories at, forums and conferences organized by or involving SDAIA.
Participant Journey
Participating entities follow a structured journey that begins with application and extends to post-exit monitoring of the product or service.
Application Submit an application to the appropriate track and provide the required information and documentation relating to the entity and the product or service to be tested.
- Assessment and Admission TThe application is reviewed to assess the readiness of the product or service and its suitability for the scope of the relevant track and participation requirements.
- Testing Plan Development Define the scope and objectives of testing, applicable requirements, measurement indicators, and intended outcomes, and develop a testing plan tailored to the nature of the product or service.
- Testing and Supervision Implement the testing plan, assess the effectiveness of the product or service and its alignment with applicable requirements, and measure the impact of applying those requirements. Specialized guidance and follow-up are provided throughout this stage, while outcomes and challenges are documented.
- Assessment and Completion of Requirements Analyze testing outcomes, assess whether the specified requirements have been met, address observations and challenges, where applicable, and complete the exit requirements.
- Graduation and Exit Approve the testing outcomes, complete the Sandbox requirements, receive the Completion Certificate, and include the entity and its product or service in the Sandbox Graduates List.
- Post-Exit Monitoring Monitor the product or service following exit from the Sandbox to verify the continued application of relevant requirements, track its development and implementation outcomes, and assess the impact achieved after completion of the testing stage.
Authorization Steps:
- Authorize the entity’s representative through the Add Authorization service on the Saudi Business Center platform.
- Create a new authorization and select the entity’s Commercial Registration.
- Select the Saudi Data & AI Authority (SDAIA) when adding services.
- Select the “Representation and Registration on the National Data Governance Platform and Completion of Procedures” service.
- Access the National Data Governance Platform and select the “Data Regulatory Sandbox” service.
- Complete the application and attach the required information and documentation.
- Submit the application for assessment.
Application Process:
Once applications open, entities seeking to participate may submit their applications through the National Data Governance Platform, subject to the eligibility requirements specified for each track.
Application Requirements:
SDAIA Data Regulatory Sandbox Guidelines
Download File
Graduates List
Explore the entities that have successfully completed the requirements of the Data Regulatory Sandbox, along with the product or service they tested during their participation
Codata is a B2B Software-as-a-Service (SaaS) platform that enables government and private organizations to mask and analyze sensitive data while supporting compliance with the Saudi Personal Data Protection Law (PDPL). The platform uses Privacy-Enhancing Technologies (PETs), including anonymization, pseudonymization, differential privacy, federated learning, and homomorphic encryption. Data is processed and encrypted locally, with only aggregated analytical outputs being shared to strengthen privacy protection during data analysis.
Hojjah, developed by Istinbat Information Technology, is an AI-powered legal technology platform serving both B2B and B2C markets. It analyzes legal documents and cases, identifies relevant laws, regulations, and judicial precedents, and helps legal professionals conduct more efficient and accurate legal research. The platform supports the protection of data subjects’ rights, applies security controls and encryption during data transmission, and maintains updated documentation to support compliance with the Saudi Personal Data Protection Law (PDPL).
Medical Circles is a secure Software-as-a-Service (SaaS) platform designed to improve communication, coordination, and collaboration within healthcare organizations. It provides a secure internal network for messaging, voice communication, collaborative tasks, staff scheduling, organizational announcements, and operational insights. The platform integrates with Electronic Health Record (EHR) systems and supports configurable access controls, enabling authorized users to securely access patient information and clinical updates. Through encryption and privacy-focused controls, it helps protect patient information, strengthen regulatory compliance, improve internal coordination, and reduce reliance on general-purpose communication applications.
Sahl AI provides Business-to-Business (B2B) healthcare solutions for hospitals and healthcare providers. The platform offers patient de-identification services and AI-powered Arabic medical transcription tools through an institutional subscription model. It de-identifies patient data and compares it with a reference medical database to generate clinical insights while preserving patient privacy. In addition, its AI-powered Arabic transcription solution improves transcription accuracy and enhances operational efficiency across healthcare organizations.
Smart Reach is one of the smart solutions developed by T2, a leading Saudi company in digital transformation and innovation. It is an AI-powered marketing orchestration platform that builds a unified understanding of customers to support targeted marketing, enhancing operational efficiency, reliability, and innovation. The platform consolidates customer data from multiple sources into a single customer profile, enabling organizations to design automated, personalized campaigns across multiple channels and deliver the right message to the right person at the right time while expanding reach without compromising targeting accuracy, thereby maintaining the protection of customers’ personal data.
WAKI is a Saudi-based platform providing cashless payment solutions for family-focused institutions through both B2B and B2C models. It serves institutions, parents, and students through a single integrated system. Parents can manage all institution-related payments and fund digital wallets for their family members, who pay at cafeterias and stores using AI-powered biometric authentication (face recognition), wristbands, cards, or QR codes, eliminating cash transactions on-site. The platform processes children’s biometric data while applying access controls and data deletion procedures to strengthen privacy protection and support secure digital transformation in educational environments.
Frequently Asked Questions
The Sandbox enables participating entities to test the effectiveness of a data-related product or service within a supervised scope, assess its alignment with applicable regulatory requirements, and measure the impact of applying those requirements.
For the Personal Data Protection Track: private entities within the Kingdom, as well as entities outside the Kingdom that process Personal Data related to individuals residing in the Kingdom. For the Data Monetization Track: Government Entities and Private Entities that handle Government Entities’ data, in accordance with the scope of application of the Data Monetization Policy. Applications are subject to the eligibility criteria specified for each track.
Yes. Participation in the Sandbox is free of charge and includes guidance, consultations, and workshops provided to participating entities.
The duration of participation varies depending on the track and the nature of the product or service and is determined based on the scope and approved testing plan for each participating entity.
The participating entity receives a Sandbox Completion Certificate. Its name and information about its product or service will also be published in the Sandbox Graduates List on the National Data Governance Platform. Participating entities may also receive invitations to relevant forums and conferences.
Yes. The participant journey includes a post-exit monitoring stage to track the development of the business model, verify the continued application of relevant requirements, and assess the impact achieved following completion of the testing stage.
Entities may begin by Submitting an Interest through the National Data Governance Platform to receive alerts and notifications when applications open. Once applications for the relevant track are announced, entities may complete the applicable requirements and submit their application through the Platform.
Important Links
Privacy Impact Assessment Personal Data Breach Notification Reports and Complaints Regulatory Sandbox Program AI Service Provider Accreditation Request for Legal Opinion Clarification Request for Approval of Data Sharing MethodGet in Touch
- ${title}${badge}