On regulatory sandboxes and cross-border data

Been following some of the discussions around regulatory sandboxes and I'm still trying to get my head around the practicalities for firms operating in multiple jurisdictions. It seems great for testing innovative products in a controlled environment, but when you scale out, especially with services that rely on integrated data across borders, things feel like they could get messy fast.

My specific concern is how different national data privacy laws intersect with a sandbox's 'relaxed' environment, particularly for a firm that might trial something in, say, the UK sandbox, but has clientele or data pipelines touching EU or even Asian jurisdictions. Does the sandbox protection truly extend to data handled outside its direct oversight, or does a firm essentially need to be compliant with all relevant data regulations from day one anyway, regardless of the sandbox? Trying to understand if the sandbox just defers the full compliance headache or genuinely offers a grace period for data-related legal frameworks beyond the immediate jurisdiction.