Synthetic Data
What is Synthetic Data?
Artificially generated data that mimics the statistical properties of real-world data without containing actual personal information. Synthetic data can be used for AI training and testing while preserving privacy.
Terms that appear alongside synthetic data
Each of these is named in at least one of the same controls as synthetic data. The number is how many controls name both.
- gdpr 4 shared controls
- differential privacy 4 shared controls
- pseudonymisation 3 shared controls
- anonymisation 3 shared controls
- nist 3 shared controls
- federated learning 3 shared controls
- privacy by design 2 shared controls
- data protection 2 shared controls
Frameworks that govern synthetic data
What the standards actually require on synthetic data
Requirements naming synthetic data across 6 standards, quoted from the control text.
Synthetic data generation produces artificial datasets that preserve statistical properties of the original data without containing real personal data, supporting model training and testing while reducing personal-data exposure;
ENISA-DPE-4.5 · Synthetic data →Production data used in a test environment is protected as it would be in production, or synthetic data is generated instead, the test environment is made similar or identical to production including configurations and data sets so that testing finds flaws, an...
ffiec-it-examination-handbook::DAM-VII.B.2(a) · VII.B.2(a) Data Controls in the Testing Environment (Development, Acquisition, and Maintenance) →Assess whether collecting, using and disclosing personal information is necessary, reasonable and proportionate for each use case; consider whether privacy enhancing technologies can achieve similar outcomes;
australia-national-framework-for-the-assurance-of-ai-in-government-2024::4.2 · 4.2 Minimise and protect personal information →Because Article 89(1) covers many methods and technologies, controllers may need safeguards beyond anonymisation or pseudonymisation, chosen for the risks of the method: governance structures such as internal or external review boards with data subject represe...
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::8.5 · 8.5 Select further safeguards fitted to the research method from the EDPB's menu: oversight governance, enhanced transparency, consent as a safeguard, strict purpose limits, PETs, secure environments, sharing rules, re-identification penalties, qualifications, training, publication protection, confidentiality →Minimise the use of personally identifiable information for research, testing and training through data obfuscation, randomisation, anonymisation or synthetic data.
fbi-cjis-security-policy::SI-12(2) · SI-12(2) Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and Research →Personal data must not be used for testing; false or synthetic data must be used instead, and where using personal data for testing is unavoidable the technical and organizational measures of the production environment must be applied, with a risk assessment i...
iso-27701-2019::6.11.3 · Test data →Questions people ask about synthetic data
What is Synthetic Data?
Why is Synthetic Data important for compliance?
Which compliance frameworks address Synthetic Data?
Where can I learn more about Synthetic Data?
See how Synthetic Data applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.