Synthetic Data Under GDPR: Compliance Challenges

Updated: July 2026

Synthetic data generation under the General Data Protection Regulation raises a compliance question that most organisations underestimate: whether the data they’ve generated is personal data at all. Data artificially produced by a model, rather than recorded from a real event, can still count as personal data under GDPR if it enables someone to be identified. That distinction, driven by anonymisation quality and re-identification risk rather than how the data was generated, decides the full scope of an organisation’s obligations.

This guide covers when GDPR applies to synthetic data generation, how anonymisation differs from pseudonymisation for this purpose, what compliance looks like in practice, and how to assess re-identification risk. It covers the legal and compliance side; the technical mechanics of building a data generator are outside its scope.

Príomhghnéithe

• Whether synthetic data counts as personal data depends on re-identification risk. How it was generated doesn’t change that: fully anonymised synthetic data falls outside GDPR, and data that still allows identification stays inside it.

• Partially synthetic data, which mixes real data elements with generated ones, usually keeps enough detail to identify people and remains personal data subject to the full regulation.

• Anonymisation under Recital 26 must be irreversible. Pseudonymisation under Article 4(5) is reversible with additional information and does not remove data from GDPR’s scope.

• Generating synthetic data from real personal data is itself a processing activity requiring a lawful basis under Article 6, and explicit consent or another Article 9 condition where special category data is involved.

• A Data Protection Impact Assessment under Article 35 is expected wherever synthetic data generation carries meaningful re-identification risk. That risk needs revisiting as generation techniques and re-identification methods both keep advancing.

What Counts as Synthetic Data Under GDPR?

Synthetic data is data generated by an algorithm or machine learning model to statistically resemble a real dataset, without recording an actual event involving an identified or identifiable person. GDPR applies to personal data, meaning information relating to an identified or identifiable natural person. That definition is what decides whether a synthetic dataset falls inside GDPR’s scope. How the data was produced doesn’t factor into that test.

Whether synthetic data counts as personal data matters because it decides whether the full set of GDPR obligations applies: lawful basis, data subject rights, and the technical and organisational measures required to protect the data.

What Is the Difference Between Fully and Partially Synthetic Data?

Fully synthetic data consists of records generated entirely by a model, with no direct correspondence to a real individual. When properly anonymised, this kind of data can fall outside GDPR’s scope as non-personal data.

Partially synthetic data combines real data elements with generated ones, producing hybrid records that often retain enough detail to identify specific people. This distinction matters directly for compliance: fully synthetic data that achieves genuine anonymisation avoids GDPR obligations, while partially synthetic data typically remains personal data subject to the full framework.

How Does Anonymisation Differ From Pseudonymisation for Synthetic Data?

GDPR Recital 26 states that personal data rendered anonymous through an irreversible process is no longer personal data and falls outside GDPR. The Article 29 Working Party’s Opinion 05/2014 set out the criteria regulators have used to assess this: re-identification has to be impossible by any means reasonably likely to be used. That’s a materially higher bar than making re-identification difficult.

Pseudonymisation, defined in Article 4(5), replaces identifying elements with artificial identifiers while keeping the technical possibility of re-identification using additional information held separately. Pseudonymised data is still personal data under GDPR and still requires full compliance.

Whether a given synthetic dataset counts as anonymised or pseudonymised, using these standards, determines whether generating it creates new compliance obligations or removes the data from GDPR’s scope entirely.

What Does GDPR Require When You Generate Synthetic Data?

An organisation has compliance obligations wherever synthetic data generation involves processing original personal data, regardless of whether the resulting synthetic output itself ends up anonymised.

What Lawful Basis Applies to Synthetic Data Generation?

Article 6 GDPR requires a lawful basis for processing personal data to create synthetic datasets. Legitimate interests are commonly used for research and development work involving training data. Still, the controller has to show the processing serves a genuine organisational interest and that safeguards for data subject rights are in place.

Special category data under Article 9, health data being the clearest example, needs explicit consent or another specific legal ground before it’s used to generate synthetic records. The heightened protection that applies to sensitive data carries over into how it’s used to build a synthetic dataset as much as how it’s stored.

Organisations generating synthetic data from customer data need to document the lawful basis they’re relying on and apply data minimisation at every stage of the generation process, from collection onward.

What Data Subject Rights Apply to Synthetic Data?

Access, rectification, and erasure rights under Articles 15 to 17 apply wherever a synthetic dataset still allows a specific data subject to be identified. Controllers need a process for handling these requests that covers both the underlying source data and the resulting synthetic data.

Partially synthetic datasets that retain identifiability keep the full range of data subject rights obligations, including portability and objection under Articles 20 and 21. Fully anonymised synthetic data doesn’t carry these obligations, since there’s no identifiable person left to hold the right.

Where synthetic data feeds an AI model used to make decisions about individuals, the transparency requirements around automated decision-making may extend to explaining where that training data came from and how it was generated.

How Should Organisations Assess Re-Identification Risk?

Technical and organisational measures need to address re-identification risk directly, through differential privacy, k-anonymity, or other privacy-enhancing techniques that measurably reduce the chance someone can be identified. The European Data Protection Supervisor has stressed that this risk needs ongoing monitoring as synthetic data models change. A single assessment at launch isn’t enough.

Risk thresholds need periodic review, since new re-identification techniques keep emerging and the statistical properties of synthetic datasets become better understood as machine learning research advances. Regulators expect organisations to document their risk assessment methodology and show, with evidence, that technical safeguards achieve real anonymisation in practice.

How Do You Build a GDPR-Compliant Synthetic Data Programme?

A workable synthetic data programme needs a structured process rather than a single policy document. For organisations generating synthetic data from personal datasets for AI development, analytics, or data sharing, that process generally covers four steps.

1. Conduct a Data Protection Impact Assessment. Evaluate the processing activity, identify privacy risks, and document safeguards for the synthetic data generation under Article 35.

2. Implement privacy-enhancing technologies. Deploy differential privacy, k-anonymity, or other technical measures that reduce re-identification risk while preserving the statistical distribution the training data needs to stay useful.

3. Set up ongoing re-identification risk monitoring. Build a recurring process to reassess identification risk as generation techniques improve and new re-identification methods appear.

4. Document the compliance measures. Maintain processing records under Article 30, covering the lawful basis relied on, the technical safeguards applied, and the data subject rights procedures that cover the synthetic dataset.

How Do Anonymised and Pseudonymised Synthetic Data Compare?

Feature	Anonymised Synthetic Data	Pseudonymised Synthetic Data
GDPR status	Non-personal data (exempt)	Personal data (regulated)
Data subject rights	Not applicable	Full rights obligations
Retention limits	No GDPR restrictions	Article 5 limitations apply
Transfer requirements	No Article 44 restrictions	Chapter V safeguards required
Risk level	Low, if anonymisation is genuine	Moderate to high

Where the statistical properties an AI model needs can be preserved without allowing re-identification, anonymised synthetic data is the safer default. Pseudonymised approaches are worth accepting only where the business case justifies the ongoing GDPR compliance work that comes with them.

What Are the Common Compliance Challenges With Synthetic Data?

How Do You Determine Whether Synthetic Data Is Personal Data?

Legal uncertainty is common here, particularly where a machine learning model generates records realistic enough that it’s genuinely unclear whether a specific person could be identified from them. Applying the Article 29 Working Party’s identifiability criteria, combined with regular re-identification testing carried out by an independent analyst, is the practical way to resolve that uncertainty. Documenting the assessment methodology and keeping evidence of the testing gives the organisation something to point to if a regulator asks.

How Do You Balance Data Utility Against Privacy Protection?

Privacy-enhancing techniques that reduce re-identification risk can also reduce the statistical accuracy an AI model needs to train well. Calibrating differential privacy noise levels and testing iteratively for the minimum privacy parameters that still preserve the dataset’s essential statistical properties is how most organisations resolve this tension in practice, rather than picking one extreme or the other.

How Do You Handle Cross-Border Transfers of Synthetic Data?

Transferring synthetic data generated from EU personal data internationally raises the same Chapter V adequacy and safeguard questions as any other international transfer, if the data is still personal data. Genuine anonymisation before transfer takes the data outside those requirements entirely. Where the synthetic dataset retains identifiable information, Standard Contractual Clauses and other appropriate safeguards apply in the same way they would to the underlying source data.

Conclúid

GDPR compliance for synthetic data comes down to one question: does the anonymisation actually eliminate re-identification risk, or does it just make identification harder? Generating synthetic data from personal data is a regulated processing activity in its own right, and organisations need to treat it that way, with a documented lawful basis, a risk assessment that gets revisited as techniques evolve, and clear evidence that the anonymisation holds up rather than just looking sufficient on paper.

Frequently Asked Questions

Is synthetic data personal data under GDPR?

It depends on whether a person can still be identified from it. Fully synthetic data that achieves genuine anonymisation falls outside GDPR. Partially synthetic data, and synthetic data with weak anonymisation, typically remains personal data and stays inside GDPR’s scope.

Do you need a DPIA to generate synthetic data?

Where the process involves personal data and carries a meaningful re-identification risk, yes. Article 35 requires a Data Protection Impact Assessment for processing likely to result in high risk to individuals, and synthetic data generation from sensitive or large-scale datasets typically meets that bar.

Does anonymised synthetic data still need a lawful basis?

The generation process does, because it involves processing the original personal data used to build the model. Once the output achieves genuine anonymisation, the resulting synthetic dataset itself falls outside GDPR and no longer needs its own lawful basis.

Can pseudonymised synthetic data be transferred outside the EU?

Yes, but it’s still personal data, so Chapter V’s transfer rules apply. That typically means Standard Contractual Clauses or another adequacy mechanism, the same requirements that would apply to the source data.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.