Personal data protection in experimental AI governance

Abstract The article examines the relationship between the European Union’s Artificial Intelligence Act (AI Act) and the General Data Protection Regulation (GDPR), focusing in particular on the role of regulatory sandboxes as instruments for fostering innovation while safeguarding fundamental rights. The data-intensive nature of contemporary AI systems creates inherent tensions with core GDPR principles, such as purpose limitation, data minimisation, and the protection of data subject rights. Against this background, the article addresses three key questions: how the sandbox provisions of the AI Act should be reconciled with the GDPR; whether these provisions operate as lex specialis or rather as a contextual clarification of existing rules; and whether regulatory sandboxes can achieve a meaningful balance between innovation and data protection. The analysis shows that, if properly designed, sandboxes can support trustworthy AI through a cooperative and proportionate regulatory approach.