What it is
The UK Information Commissioner's Office describes it as artificial data generated by data synthesis algorithms, which replicates patterns and the statistical properties of real data.
It may be partially synthetic, where only some variables are replaced, or fully synthetic, where all are.
Why it matters
It is offered as a way to test, develop and train without using real records. EU law now names it: the AI Act, as consolidated in July 2026, allows special categories of personal data to be processed for bias detection only where that cannot be done effectively with other data, including synthetic or anonymised data.
It is not automatically anonymous. The same regulator notes that some generation methods are vulnerable to attacks that reveal the underlying data, that synthetic data inherits the bias of its source, and that an acceptable balance of usefulness and protection is not always achievable. DII has read no evidence of how widely enterprises use it.
The problem it addresses
DII editorial view
Teams are often blocked from using real records for testing, development or training because the data is personal or restricted. Synthetic data reproduces the patterns without the records. Whether it is safe to treat as non-personal is a separate question.
Business and organisational relevance
DII editorial view
Synthetic data is attractive to teams that are blocked from using real data. Whether it may be treated as free of personal data is a legal and risk judgement, and should not be left to the team that wants to use it.
Practical use cases
- Test and development data
- Sharing data patterns without sharing records
- Supplementing training data
Benefits and opportunities
- Less use of real personal data
- Data for cases that are rare in real data
Risks, limitations and dependencies
- It is not automatically anonymous: "some synthetic data generation methods have been shown to be vulnerable to model inversion attacks, membership inference attacks and attribute disclosure risk"
- It inherits bias: if the source is not representative, "neither will the synthetic data" be
- "In some cases, you will not be able to achieve an acceptable balance of utility and protection"
Prerequisites for adoption
DII editorial view
- Source data that is representative; bias is inherited
- A way to measure both usefulness and protection
- A legal view on whether the output is personal data
Implementation considerations
- Do not assume it is anonymous. Whether it is personal data depends on whether the source information can be inferred from it.
- Check the source for bias first. Synthetic data reproduces the patterns of its source, including unrepresentative ones.
- Measure usefulness and protection together. Raising one tends to lower the other, and sometimes no acceptable balance exists.
The DII Radar assessment
Catalogue status
Not yet assessed. DII has not published a Radar assessment for Synthetic Data Generation. It is listed in the catalogue so that it can be explained. No relevance, direction, strategic impact or enterprise adoption is given for it, and it is not plotted on the Radar.
What to consider next
DII editorial view
- Do not assume it is anonymous
- Check the source for bias first
- Measure usefulness and protection together
Evidence and references
The sources DII read for this explainer. Each entry gives what the record holds; nothing is added.
- Privacy-enhancing technologies (PETs) guidance The overview page, "How can PETs help with data protection compliance?" and the synthetic data page were read. View source for reference 1 (external site)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026 Article 4a(1)(a) was read. The first 100,000 characters of the text were searched; later articles were not. View source for reference 2 (external site)