Synthetic data

Synthetic data is produced by statistical models, simulations or generative AI trained on real data. It can fill gaps in underrepresented groups, create test cases for rare events and reduce the amount of real personal data that teams handle, which is why it is often listed among privacy-enhancing technologies.

It is not automatically anonymous. Data protection authorities such as the ICO and the EDPS point out that a generator trained on personal data may memorize and reproduce real records, and that outliers can be re-identified. Whether synthetic data falls outside the GDPR or the LGPD depends on a documented assessment of re-identification risk, ideally combined with techniques such as differential privacy. Training the generator is itself processing that needs a lawful basis. Synthetic data also inherits or amplifies bias in its source, so provenance and quality checks still apply.

Example: a bank generates synthetic transaction histories to test a fraud system, checks that no synthetic record matches a real customer, and labels the dataset clearly.