Data Regulatory Sandbox
Start ServiceTarget Audience
Government Entities, Private Entities, Entities outside the Kingdom, Non-Profit Entities
Service Duration
60 days
Service Cost
Free of charge
About the Sandbox
The Data Regulatory Sandbox enables participating entities to test data-related products or services under a regulatory supervision, within a defined scope, timeframe, and set of requirements, before scaling their implementation.
The Sandbox is built on direct engagement between the regulatory authority and participating entities, ensuring appropriate support and enhancing their understanding of applicable regulatory requirements throughout the testing stages.
Testing involves applying the relevant regulatory requirements to the product or service and documenting the resulting outcomes, challenges, and observations. This enables the assessment of alignment with such requirements and the practical impact of their application.
Testing outcomes contribute to enhancing regulatory clarity, examining challenges and potential approaches to addressing them, and generating practical evidence to support the development of relevant regulatory instruments. This helps achieve a balance between regulatory compliance and enabling the responsible and sustainable use of data.
The Sandbox includes specialized tracks, including Personal Data Protection and Data Monetization, each with a defined scope, eligibility criteria, and specific requirements.
Main Tracks
The Sandbox comprises two main tracks, each targeting a specific category of participating entities based on its respective scope and requirements.
Personal Data Protection Track
The track aims to support private entities in testing products or services involving the processing of personal data, assessing the effectiveness of the organizational, administrative, and technical measures implemented to protect personal data, and determining their alignment with the provisions of the Personal Data Protection Law (PDPL), its Implementing Regulations, and other applicable regulatory requirements. It also assesses the impact of such requirements on the product or service under testing, thereby contributing to the protection of data subjects’ rights and strengthening compliance with the provisions of the PDPL.
Data Monetization Track
The track aims to support entities in assessing the economic value of data, identifying priority use cases, and testing appropriate models for generating revenue from data products and services. This includes products and services developed or provided by government or private entities based on government data. The track assesses the effectiveness of these models and their alignment with applicable regulatory requirements, contributing to maximizing the value derived from data and fostering the development of the data market.
Benefits and Advantages
The Data Regulatory Sandbox is designed to provide participants with a range of benefits and advantages, including the following:
Benefits of Participating in the Data Regulatory Sandbox
- A clearer understanding of regulatory requirements and how to achieve compliance in a manner aligned with the nature of the proposed business model.
- Greater customer confidence in services and products that have successfully met the requirements of the Data Regulatory Sandbox.
- Reduced risks associated with innovation and experimentation through structured supervision and ongoing oversight during the testing phase.
Advantages Offered to Participants
- Complimentary guidance and consultation from experts and specialists in technical and regulatory fields.
- Access to workshops tailored specifically to participants and covering topics relevant to their business models.
- A certificate confirming completion of the SDAIA Regulatory Data Sandbox requirements.
- Publication of the list of graduates and information about their business models on the National Data Governance Platform.
- Exclusive invitations to participate in events and conferences organized by or involving SDAIA.
Participant Journey
Participating entities follow a structured journey that begins with application and extends to post-exit monitoring of the product or service.
Application Submit an application to the appropriate track and provide the required information and documentation relating to the entity and the product or service to be tested. tested.
- Assessment and Admission TThe application is reviewed to assess the readiness of the product or service and its suitability for the scope of the relevant track and participation requirements.
- Testing Plan Development Define the scope and objectives of testing, applicable requirements, measurement indicators, and intended outcomes, and develop a testing plan tailored to the nature of the product or service.
- Testing and Supervision Implement the testing plan, assess the effectiveness of the product or service and its alignment with applicable requirements, and measure the impact of applying those requirements. Specialized guidance and follow-up are provided throughout this stage, while outcomes and challenges are documented.
- Assessment and Completion of Requirements Analyze testing outcomes, assess whether the specified requirements have been met, address observations and challenges, where applicable, and complete the exit requirements.
- Graduation and Exit Approve the testing outcomes, complete the Sandbox requirements, receive the Completion Certificate, and include the entity and its product or service in the Sandbox Graduates List.
- Post-Exit Monitoring Monitor the product or service following exit from the Sandbox to verify the continued application of relevant requirements, track its development and implementation outcomes, and assess the impact achieved after completion of the testing stage.
Authorization Steps :
- Authorize the entity’s representative through the Add Authorization service on the Saudi Business Center platform.
- Create a new authorization and select the entity’s Commercial Registration.
- Select the Saudi Data & AI Authority (SDAIA) when adding services.
- Select the “Representation and Registration on the National Data Governance Platform and Completion of Procedures” service.
- Access the National Data Governance Platform and select the “Data Regulatory Sandbox” service.
- Complete the application and attach the required information and documentation.
- Submit the application for assessment.
Data Regulatory Sandbox Guidelines
Download FileGraduates List
Explore the entities that have successfully completed the requirements of the Data Regulatory Sandbox, along with the product or service they tested during their participation
Codata is a B2B Software-as-a-Service (SaaS) platform that enables government and private organizations to mask and analyze sensitive data while supporting compliance with the Saudi Personal Data Protection Law (PDPL). The platform uses Privacy-Enhancing Technologies (PETs), including anonymization, pseudonymization, differential privacy, federated learning, and homomorphic encryption. Data is processed and encrypted locally, with only aggregated analytical outputs being shared to strengthen privacy protection during data analysis.
Hojjah, developed by Istinbat Information Technology, is an AI-powered legal technology platform serving both B2B and B2C markets. It analyzes legal documents and cases, identifies relevant laws, regulations, and judicial precedents, and helps legal professionals conduct more efficient and accurate legal research. The platform supports the protection of data subjects’ rights, applies security controls and encryption during data transmission, and maintains updated documentation to support compliance with the Saudi Personal Data Protection Law (PDPL).
تقدّم ميديكال سيركلز (Medical Circles) منصة آمنة قائمة على نموذج البرمجيات كخدمة (SaaS) لتعزيز التواصل والتنسيق والتعاون داخل مؤسسات الرعاية الصحية. وتوفر المنصة شبكة داخلية آمنة تضم خدمات المراسلة النصية والاتصالات الصوتية، والمهام التعاونية، وإدارة المناوبات، والتعاميم المؤسسية، والرؤى التشغيلية. كما تتكامل مع أنظمة السجلات الطبية الإلكترونية (EHR) وتدعم إدارة صلاحيات الوصول، بما يمكّن المستخدمين المصرح لهم من الوصول إلى معلومات المرضى والتحديثات السريرية بصورة آمنة، مع تطبيق التشفير وضوابط حماية الخصوصية، بما يسهم في حماية بيانات المرضى، وتعزيز الامتثال للمتطلبات التنظيمية، والحد من الاعتماد على تطبيقات التواصل العامة.
تقدّم منصة سهل للذكاء الاصطناعي (Sahl AI) حلولاً للرعاية الصحية وفق نموذج التعاملات بين الشركات (B2B)، تستهدف المستشفيات ومقدمي الرعاية الصحية. وتشمل المنصة خدمات إخفاء البيانات المعرّفة لهوية المرضى وأدوات التفريغ النصي الطبي باللغة العربية المدعومة بالذكاء الاصطناعي، مع نموذج أعمال قائم على اشتراكات المؤسسات. وتعتمد المنصة على إخفاء هوية بيانات المرضى ومقارنتها بقاعدة بيانات طبية مرجعية لتوفير معطيات سريرية مع المحافظة على خصوصية المرضى، كما تسهم في تحسين دقة التفريغ النصي الطبي ورفع كفاءة العمليات في المنشآت الصحية.
Smart Reach is one of the smart solutions developed by T2, a leading Saudi company in digital transformation and innovation. It is an AI-powered marketing orchestration platform that builds a unified understanding of customers to support targeted marketing, enhancing operational efficiency, reliability, and innovation. The platform consolidates customer data from multiple sources into a single customer profile, enabling organizations to design automated, personalized campaigns across multiple channels and deliver the right message to the right person at the right time while expanding reach without compromising targeting accuracy, thereby maintaining the protection of customers’ personal data.
WAKI is a Saudi-based platform providing cashless payment solutions for family-focused institutions through both B2B and B2C models. It serves institutions, parents, and students through a single integrated system. Parents can manage all institution-related payments and fund digital wallets for their family members, who pay at cafeterias and stores using AI-powered biometric authentication (face recognition), wristbands, cards, or QR codes, eliminating cash transactions on-site. The platform processes children’s biometric data while applying access controls and data deletion procedures to strengthen privacy protection and support secure digital transformation in educational environments.
Frequently Asked Questions
The Sandbox enables participating entities to test the effectiveness of a data-related product or service within a supervised scope, assess its alignment with applicable regulatory requirements, and measure the impact of applying those requirements.
Important Links
Privacy Impact Assessment Personal Data Breach Notification Reports and Complaints Regulatory Sandbox Program AI Service Provider Accreditation Request for Legal Opinion Clarification Request for Approval of Data Sharing MethodGet in Touch
- ${title}${badge}