# Sandbox for encouraging innovation, etc

# Bare Act

# Section 40(1)

The Authority shall, for the purposes of encouraging innovation in artificialintelligence, machine-learning or any other emerging technology in public interest, create a Sandbox.

# Section 40(2)

Any data fiduciary whose privacy by design policy is certified by the Authorityunder sub-section (3) of section 22 shall be eligible to apply, in such manner as may be specified by regulations, for inclusion in the Sandbox created under sub-section (1).

# Section 40(3)

Any data fiduciary applying for inclusion in the Sandbox under sub-section (2)shall furnish the following information, namely:—

(a) the term for which it seeks to utilise the benefits of Sandbox, provided thatsuch term shall not exceed twelve months;

(b) the innovative use of technology and its beneficial uses;

(c) the data principals or categories of data principals participating under theproposed processing; and

(d) any other information as may be specified by regulations.

# Section 40(4)

The Authority shall, while including any data fiduciary in the Sandbox, specify—

(a) the term of the inclusion in the Sandbox, which may be renewed not morethan twice, subject to a total period of thirty-six months;

(b) the safeguards including terms and conditions in view of the obligationsunder clause (c) including the requirement of consent of data principals participatingunder any licensed activity, compensation to such data principals and penalties in relation to such safeguards; and

(c) that the following obligations shall not apply or apply with modified form tosuch data fiduciary, namely

(i) the obligation to specify clear and specific purposes under sections 4 and 5;

(ii) limitation on collection of personal data under section 6; and

(iii) any other obligation to the extent, it is directly depending on theobligations under sections 5 and 6; and

(iv) the restriction on retention of personal data under section 9.

Last Updated: 12 Dec 2019