Synthetic data promise something that many organisations need: the ability to use, share and analyse data without exposing the people behind them. Instead of working on real customer, patient or employee records, a company trains a model on the original dataset. It then generates new, artificial records that reproduce the dataset’s statistical properties. The resulting data can be used for analytics, software testing or the development of AI systems, often with far fewer constraints than the original.

It is therefore not surprising that synthetic data are increasingly presented as a privacy-enhancing technology. But from a legal perspective the question that matters is a precise one: are the synthetic data anonymous under the GDPR, and can the organisation prove it? The answer is not automatic. The question has also become more pressing since 7 July 2026, when the European Data Protection Board adopted its draft Guidelines 02/2026 on anonymisation, which were open for public consultation until 30 October 2026.

This article draws on research by Daniele Panfilo and the Aindo team, including work co-authored with Data Valley. It explains what makes synthetic data risky, how their privacy can be measured, and what companies should do before calling them anonymous. It returns to a topic we first addressed in 2021 in Synthetic data, the last frontier of data protection and data sharing (in Italian), in a very different regulatory landscape.

What synthetic data are

There is no universally accepted definition of synthetic data. A useful working definition comes from research by Boudewijn, Ferraris, Panfilo, Cocca and others, presented at the NeurIPS 2023 workshop on synthetic data. It describes them as data generated through a purpose-built mathematical model or algorithm, the “generator”, with the aim of solving one or more data-science tasks.

Generators can be built in many ways:

• deep-learning models, such as generative adversarial networks (GANs) and variational autoencoders;
• decision trees and Bayesian networks;
• diffusion models;
• nearest-neighbour methods;
• increasingly, large language models.

Aindo’s own research has proposed a deep-learning pipeline for generating synthetic tabular data, published in IEEE Access in 2023.

For privacy, the most important distinction is how the generator uses the original records. Most generators learn the overall properties of the dataset probabilistically and then produce new records by random sampling. This breaks the one-to-one correspondence between real and synthetic records. Some methods, however, create one synthetic record for each real record, starting from that record as a “seed”. In that case the link between the synthetic data and the real person is at least partly maintained, and the privacy risk is significantly higher.

Why synthetic does not automatically mean anonymous

The research identifies four main sources of risk that companies should understand before relying on synthetic data.

1. Overfitting and memorisation. A poorly trained generator may memorise and reproduce patterns from the training data rather than generalising from them. Isolated records, with few similar records around them, are particularly difficult to generalise. Datasets with outliers, sparse data or under-represented groups are therefore more exposed. These are often the records that are easiest to single out.
2. The generation method. As noted above, seed-based generators that produce one synthetic record for each real one preserve a link to the individual.
3. Specific model failures. GANs, for example, may suffer from “mode collapse”. Instead of capturing the variety of the real data, they reproduce a small selection of real individuals very accurately. The synthetic data then cluster around specific real records and leak information about them.
4. The threat model. The risk depends on what an attacker knows and can access beyond the synthetic data. An attacker may have access to the synthetic data only, to the generator’s inputs and outputs, to the generator itself with its parameters, or to auxiliary information such as some attributes of some real individuals. The more an attacker knows, the greater the risk of re-identification.

Three ways to measure privacy

The central problem identified by the research is that there is no standard for quantifying the degree of privacy protection offered by synthetic data. The NeurIPS paper reviews the approaches proposed so far and groups them into three families.

Mathematical privacy properties.

• Differential privacy is the best known. It is a property of the generator: a generator is differentially private if its output does not change significantly when a single record is removed from the training data, so an observer cannot tell whether a given person was included.
• k-anonymity, by contrast, is a property of the dataset. It requires each combination of attribute values to be shared by at least k individuals.
• Plausible deniability, relevant in particular to seed-based generators, requires that each synthetic record could plausibly have been generated from several different real records.

Statistical indicators. Most practical metrics measure how many synthetic records are identical or suspiciously similar to real ones, from the share of exact matches to distance-based and nearest-neighbour measures. They are easy to compute. But they measure properties of a specific synthetic dataset rather than providing guarantees, and their results depend heavily on the choice of similarity measure.

Experimental attack-based assessments. This approach simulates attacks against the synthetic data and measures how successful they are compared with a baseline. Typical attacks try to infer whether a person’s record was used for training (membership inference) or to deduce the value of a sensitive attribute (attribute inference).

The research relates these approaches to the three risks that European regulators have used since 2014 as the benchmark for anonymisation: singling out, linkability and inference. No single measure covers all three. A later chapter by Panfilo and co-authors, published in 2024 in the volume of the Computers, Privacy and Data Protection (CPDP) conference, develops this survey of privacy measurement for structured synthetic datasets. For companies, the practical lesson is that a privacy claim about synthetic data should rest on a combination of methods, chosen according to the generator, the data and the likely attackers, rather than on a single score.

What the EDPB now expects

The EDPB’s draft guidelines give this technical debate a legal framework. They update the 2014 opinion of the Article 29 Working Party and propose three criteria for testing whether data are anonymous:

• No Record Isolation;
• No Linkage;
• No Inference.

If all three are met, the data can be considered anonymous. If one is not, further analysis is needed.

The guidelines mention synthetic data explicitly in relation to inference. They note that data aggregated to represent correlations rather than the original information, as in AI models or synthetic data, may still allow specific inferences about an individual, for example when the data are queried with additional information. Where such an inference is also meaningful, the No Inference criterion is not met.

Three further points in the guidelines are directly relevant to synthetic data projects:

• The perspective of each entity. Anonymity is assessed from the perspective of each relevant entity, taking into account the means reasonably likely to be used. The guidelines propose a “contextual” approach, which considers the capabilities of each party, and a more cautious “simplified” approach, which treats data as personal whenever re-identification is theoretically possible.
• Generation is processing. Generating synthetic data is itself processing of personal data. It requires a legal basis, must be explained transparently and must be documented, including the tests carried out to assess anonymity. Controllers should not describe data as “anonymous” if individuals are still identifiable.
• Anonymity changes over time. The likelihood of re-identification increases with new techniques and new information, including developments in AI. The EDPB therefore recommends reassessing anonymised data periodically.

Why it matters now, especially for health data

The assessment matters most where data are sensitive and in demand. Under the European Health Data Space, health data made available for secondary use will be anonymised by default. Approval for research may also not be needed where individuals are no longer identifiable, which makes synthetic data an attractive way to unlock health data for research and innovation. In both cases, the benefit depends on being able to demonstrate that the data are truly anonymous.

For AI developers, the stakes are similar. Synthetic data are increasingly used to train, validate and test models, and for high-risk systems those data must also meet the quality and representativeness requirements of Article 10 of the AI Act. Privacy and utility have to be assessed together.

Where to start

For companies that use or plan to use synthetic data, a practical approach starts before generation and continues after it:

1. Understand the original dataset, in particular its outliers and small groups, which are the records most exposed to memorisation and singling out.
2. Choose a generation method appropriate to the risk. Avoid seed-based approaches where anonymity is the goal, and consider differentially private training where the data are sensitive.
3. Test the result with more than one method: statistical similarity indicators to detect obvious copies, attack simulations to test realistic threats, and an assessment against the three EDPB criteria.
4. Document everything, from the legal basis and the choice of generator to the metrics, the threat models considered and the results. This is what allows the anonymity of the data to be demonstrated to a supervisory authority or a business partner.
5. Repeat the assessment periodically, and whenever the data are shared with new recipients or new re-identification techniques emerge.

Synthetic data can be a powerful tool for innovation that respects privacy, but only if their privacy protection is measured rather than assumed. The practical question is therefore not “are our data synthetic?” It is: can we show, with appropriate tests and documentation, that no one can reasonably single out, link or infer information about the people behind them?

Data Valley supports companies, research organisations and healthcare providers in using synthetic data, from identifying the use cases where they create value to choosing the right approach and partners, defining the legal basis for generation, testing and documenting anonymity under the GDPR and the EDPB guidelines, and reviewing it over time.

‍

‍