Is synthetic data actually private?

Not automatically. Synthetic data generated from real records can leak information about the people in them, so privacy depends on how it is made and tested. NIST treats synthetic data as one de-identification technique that needs measured re-identification risk, governance and sometimes formal guarantees such as differential privacy.

What does NIST say about it?

NIST SP 800-188, on de-identifying government datasets, describes de-identification as any process of removing the association between identifying data and the data subject. It lists data sharing models agencies can choose: publishing de-identified data, publishing synthetic data based on identified data, offering a query interface with de-identification built in, or sharing data in protected enclaves. It names techniques including removing identifiers, transforming quasi identifiers and generating synthetic data using models.

It also says that not all tools which merely mask personal information provide enough functionality for de-identification, and recommends evaluating goals and risks before release, using a disclosure review board, adopting a standard with measurable performance levels and running re-identification studies.

Why can synthetic data leak?

A generative model learns patterns from real records. If it learns them too closely, it can reproduce rare records or combinations almost exactly. A rare diagnosis in a small town, a very large transaction, a unique job title: outliers are the first to leak. Even without copying, an attacker with outside data may be able to infer whether a particular person was in the training set.

Constructed example: a clinic generates synthetic patient records to share with a research partner. One synthetic patient has an unusual age, condition and postal code combination that matches a real patient. Nothing was copied field by field, yet the record points to a real person. A test that checks nearest neighbor distances between synthetic and real rows would have caught it.

What is differential privacy?

NIST SP 800-226 describes differential privacy as a mathematical framework that quantifies the privacy loss to entities when their data appears in a dataset. The publication introduces a differential privacy pyramid of factors and lists privacy hazards, common pitfalls that appear when the mathematics is turned into software. It helps practitioners think about differentially private solutions. In short, a differentially private generator limits how much any single person's data can change the output, and states that limit as a number you can examine.

It is not free. Stronger guarantees usually cost accuracy, so you tune a budget for the use case.

How do you decide whether synthetic data is private enough?

Ask four questions.

1. What is the threat? A public release faces different attackers than data shared with a vetted partner under contract.
2. What did you test? Distance to closest real record, membership inference attempts and checks on rare values are the sort of measurements NIST's talk of re-identification studies points toward.
3. Is there a formal guarantee? If yes, what is the privacy budget and how was the implementation verified?
4. Who is accountable? NIST suggests a review board for a reason.

Legal definitions of personal data and anonymized data differ by jurisdiction. Whether a dataset falls outside privacy law is a question for counsel, not a conclusion to draw from the word synthetic.

What is it good for?

Software testing, demos and development environments, where realistic shapes matter but real people should not. For these uses a generator built from a schema and rules, with no real records involved, avoids the training leak entirely.

What to do

1. State the purpose and the audience before choosing a technique.
2. Prefer rule based fake data when you only need realistic shapes for testing.
3. If you train a generator on real data, test for closest record leakage and rare value leakage.
4. Consider differential privacy when the data is sensitive and shared widely, and record the budget.
5. Have a review board or named owner approve each release.
6. Ask counsel whether the result counts as personal data.

Quick check

Sources

• NIST SP 800-188, De-Identifying Government Datasets
• NIST SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees

Last reviewed: 18 October 2026.