Art.59

Article 59 – Further Processing of Personal Data for Developing Certain AI Systems in the Public Interest in the AI Regulatory Sandbox

Governance SME Relevant ~2 min read · 495 words

Article 59 addresses one of the most practical barriers to AI innovation: access to personal data for training and testing. Within the AI regulatory sandbox, organisations may process personal data originally collected for other purposes — subject to strict safeguards — enabling AI development that would otherwise be blocked by GDPR’s purpose limitation principle.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

A controlled GDPR exception for AI development in sandboxes

Article 59 creates a specific legal basis for processing personal data beyond its original collection purpose within AI regulatory sandboxes — where this is necessary for developing AI systems in the public interest. It is a carefully scoped exception to GDPR’s purpose limitation principle, designed to enable AI innovation while maintaining strong data protection safeguards.

WHAT IT SAYS

Public interest processing with six strict cumulative conditions

Personal data lawfully collected for other purposes may be processed in AI regulatory sandboxes for developing, training and testing AI systems in the public interest — but only where all six conditions are met simultaneously
Condition 1: The AI system must be developed for a substantial public interest in a specific field, such as public health, safety, or environmental protection
Condition 2: The data processed must be necessary and proportionate to achieve the public interest objective
Condition 3: Effective monitoring mechanisms must be in place to identify risks to data subjects and to promptly mitigate those risks
Condition 4: Personal data must be processed in a functionally separate, isolated and protected environment under the control of the sandbox participant
Condition 5: Data cannot be shared outside the sandbox — and data created within the sandbox cannot be shared at all
Condition 6: Processing must not affect the application of data subjects’ rights under GDPR, including their rights of access, rectification, erasure and objection

WHO IS AFFECTED

Public interest AI developers within approved sandbox environments

Sandbox participants developing AI systems for public interest purposes — healthcare, public safety, environmental monitoring, and similar
National data protection authorities who may be consulted on sandbox data processing arrangements
Competent authorities managing sandboxes who must ensure the six conditions are met
Data subjects whose data may be further processed — they retain all GDPR rights

WHAT IT MEANS FOR SMES

A valuable pathway for public interest AI development — but conditions are strict

If you are developing AI for healthcare, public safety, environmental monitoring, or similar public interest applications, Article 59 may allow you to access data that GDPR would otherwise restrict — but only within a sandbox
The six conditions are cumulative — all must be met simultaneously; this is not a general relaxation of GDPR, it is a tightly scoped exception
The data isolation requirement is technically demanding: personal data must be in a completely separate, controlled environment with no possibility of outward sharing
Data subjects retain all their GDPR rights even within the sandbox — ensure your data governance processes can respond to access and erasure requests for sandbox data
If your AI project does not serve a substantial public interest — if it is primarily commercial — this article does not apply to you; the purpose limitation exception is strictly scoped

Article 57 — AI regulatory sandboxes (the environment within which this article applies)
Article 58 — Sandbox functioning (the operational framework that governs data processing arrangements)
Article 10 — Data governance for high-risk AI (the main data obligations outside sandboxes)
Article 62 — SME measures (the broader innovation support context)

← Back to the Guide