An electronic device comprising: a memory configured to store instructions; and a processor configured to execute the instructions to: install a first application configured to be operated only in a general area; install a second application configured to be selectively operated in at least one of the general area or a sandbox; when installing the second application, identify metadata of the second application indicating that the second application is associated with the sandbox; based on the identified metadata of the second application, allocate the second application to at least the sandbox without a user's further input for allocation of the second application; grant access by the first application to first data of the second application, wherein the first data is generated as a result of the second application operating in the general area; deny access by the first application to second data of the second application, wherein the second data is generated as a result of the second application operating in the sandbox and an identifier corresponding to the sandbox is added to the second data when the second data is generated; and grant access by the second application to third data of the first application, wherein the third data is generated as a result of the first application operating in the general area; wherein the second data of the second application is accessible by a third application allocated to the sandbox where the second application is allocated, based on the identifier added to the second data. a memory configured to store instructions; and a processor configured to execute the instructions to: install a first application configured to be operated only in a general area; install a second application configured to be selectively operated in at least one of the general area or a sandbox; when installing the second application, identify metadata of the second application indicating that the second application is associated with the sandbox; based on the identified metadata of the second application, allocate the second application to at least the sandbox without a user's further input for allocation of the second application; grant access by the first application to first data of the second application, wherein the first data is generated as a result of the second application operating in the general area; deny access by the first application to second data of the second application, wherein the second data is generated as a result of the second application operating in the sandbox and an identifier corresponding to the sandbox is added to the second data when the second data is generated; and grant access by the second application to third data of the first application, wherein the third data is generated as a result of the first application operating in the general area; wherein the second data of the second application is accessible by a third application allocated to the sandbox where the second application is allocated, based on the identifier added to the second data. install a first application configured to be operated only in a general area; install a second application configured to be selectively operated in at least one of the general area or a sandbox; when installing the second application, identify metadata of the second application indicating that the second application is associated with the sandbox; based on the identified metadata of the second application, allocate the second application to at least the sandbox without a user's further input for allocation of the second application; grant access by the first application to first data of the second application, wherein the first data is generated as a result of the second application operating in the general area; deny access by the first application to second data of the second application, wherein the second data is generated as a result of the second application operating in the sandbox and an identifier corresponding to the sandbox is added to the second data when the second data is generated; and grant access by the second application to third data of the first application, wherein the third data is generated as a result of the first application operating in the general area; wherein the second data of the second application is accessible by a third application allocated to the sandbox where the second application is allocated, based on the identifier added to the second data.