A synthetic patient has never been admitted to a hospital, never taken a pill, never had a postcode. Yet a dataset full of them can still count as personal data.

That sounds like a contradiction, and it’s the part most explainers skip. Synthetic data is usually pitched as a way to test software and train models without touching real patient or customer records. Sometimes it delivers. But the UK Information Commissioner’s Office (ICO) judges anonymity by how identifiable people are, not by what a dataset is called, and flaws in the source data can follow it into the copy.

So what is synthetic data, and when can you trust it with sensitive work? Below is a short definition, followed by four questions you can use on any synthetic dataset, tested against a fictional hospital.

What Is Synthetic Data, and How Is It Made?

In plain terms, what is synthetic data? It’s artificial data produced by a model that has learned the patterns in a real dataset. The records look like the originals and behave like them statistically, but each one is meant to describe someone or something that never existed.

NIST, the US standards agency, describes the process in two steps: build a probabilistic model of the population the real data came from, then use that model to generate new records. The model can be as simple as counting how often things occur, or as complex as a generative adversarial network (GAN), where two neural networks compete until one produces convincing fakes.

Two details matter later. First, the generator learns from real records, so building synthetic data from patient files is itself a use of personal data. Second, NIST points out that many generation techniques come with no formal privacy guarantee at all.

Synthetic data vs anonymized data

Teams often treat what is synthetic data and what is anonymized data as one question. They aren’t. Anonymization starts with real records and removes or masks what identifies people. Synthetic generation creates new records from a model. Both can fail. NIST notes that stripping identifiers from a dataset does not prevent re-identification. Synthetic data fails in a different way: the model can remember too much.

Why “It’s Synthetic” Isn’t a Privacy Answer

Under UK and EU data protection law, truly anonymous data falls outside the rules. The test is whether a person could be identified by any means reasonably likely to be used. The ICO’s anonymisation guidance adds the “motivated intruder” test: could a determined person with access to resources pick out individuals? It also treats identifiability as a spectrum that moves over time as new data and tools appear.

Knowing what is synthetic data technically doesn’t answer the legal question. Guidance for UK health developers says that when data is generated to statistically mimic real data, you should assess the likelihood of re-identification and add safeguards if needed so the risk is sufficiently remote.

Other regions ask similar questions in different words. In the US, teams handling health data often look to HIPAA’s expert determination route, where a qualified expert documents that the risk of identification is very small. Whether that fits a given synthetic dataset is a question for counsel. Canada and other jurisdictions have their own tests, so don’t assume the UK or EU answer carries over.

The UK rules are also moving. The ICO ran a consultation on draft anonymization guidance for research purposes that discusses synthetic data, closing on 19 October 2026, so check for the final text.

How a synthetic record can leak

To see why, go back to what is synthetic data: a model’s imitation of real records. The usual culprit is the outlier. A generator learns common patterns well, but a rare record has little company, so the model may reproduce it almost whole. A membership inference attack exploits this: the attacker checks whether a specific person’s record was in the training data.

In one 2023 study of tabular generators, researchers reconstructed between 78 and 100 percent of the underrepresented training records in their tests, using only black-box access to a trained model and the similarity-based privacy metrics shipped with it. The lesson isn’t that every dataset is exposed. It’s that a passing privacy score isn’t proof of safety.

Four Questions to Ask Before You Trust a Synthetic Dataset

This framework works whatever your answer to what is synthetic data looks like, tabular, text or image. Picture a fictional hospital, Northfield General, with 40,000 admission records: age band, sex, postcode district, diagnoses, medications and readmission outcome. Outside developers will build a readmission-risk tool on a synthetic copy. Buried in the data are seven patients with a rare metabolic condition, all from one small district.

1. Does it resemble the original? (Fidelity)

Fidelity is statistical resemblance. Compare age bands, diagnosis frequencies and, crucially, relationships between columns. Northfield’s synthetic set gets the share of diabetes patients right, but hands a diabetes medication to patients with no diabetes diagnosis. Column-by-column checks pass. The relationships are broken.

2. Does it preserve useful patterns? (Utility)

Resemblance isn’t the same as usefulness. A common test is to train a model on the synthetic data, then evaluate it on held-back real data and compare it with a model trained on real records. For plain software testing, what is synthetic data actually for? Often just valid formats and awkward edge cases.

Here’s the tension in fidelity vs utility: the closer the copy, the higher the re-identification risk. Singapore’s data protection regulator made this point in a 2024 proposed guide.

3. Could it reveal information about real people? (Privacy)

This is where “anonymous” gets earned or lost. Useful checks include measuring how close synthetic records sit to training records compared with a held-out control set, running membership inference tests that look specifically at outliers, and reviewing rare combinations. At Northfield, the seven rare-condition patients in one district are the obvious risk. Options include suppressing or generalizing them before generation, or accepting less detail for that group.

Differential privacy is the strongest tool here. It mathematically limits how much any one person’s record can influence the output. NIST describes it as a provable guarantee, but also names the cost: accuracy. Add enough protection and rare groups get blurred first. It also has to be implemented correctly, and NIST warns that buggy differentially private code can quietly violate privacy without crashing. That differential privacy synthetic data trade-off is the central bargain of the field.

4. Does it reproduce bias? (Bias)

Usually, yes. Any honest answer to what is synthetic data includes what it was copied from, flaws included. Research on fair synthetic data states plainly that biases in the original data carry into the synthetic version, and studies on tabular data have found the effect can vary by generator and in some setups get stronger.

Suppose Northfield’s rural patients over 75 are under-diagnosed with heart failure because fewer of them get scans. The synthetic copy inherits that pattern, and the readmission tool learns that older rural patients are low risk. The fix isn’t a bigger synthetic dataset. It’s testing performance by subgroup and correcting the source.

What Is Synthetic Data Good For, and When Should You Skip It?

It suits software testing, demos, training exercises and internal sandboxes where realistic structure matters more than exact statistics, while real data stays locked down.

Skip it, or take extra care, in these cases:

• Small datasets or rare groups. Each person is easy to spot.
• Conclusions about real patients. A synthetic cohort can’t tell you whether a treatment works.
• Legal certainty without testing. If nobody runs privacy attacks and documents the result, don’t call the data anonymous.
• Generators trained on generated output. A 2024 paper in the journal Nature found that indiscriminately training models on model-generated content makes the rarer parts of the original distribution disappear, a problem called model collapse.

Until tests say otherwise, treat synthetic data derived from personal data as personal data. Document what you checked, keep a data protection impact assessment on file, and review the result again as attack methods improve.

Frequently Asked Questions

What is synthetic data in machine learning?

It’s artificial data generated from the patterns in real data, used to train, test or validate models when real data is scarce, sensitive or hard to share. Its value depends on how closely it matches the real task and how well it protects the people behind the source data.

What is synthetic data used for in healthcare?

Mostly software testing, developer sandboxes, teaching and early model development, where teams need realistic records without handing out real patient files. Because the generator learns from patient data, the same privacy testing applies.

Can synthetic data leak personal information?

Yes. If a generator memorizes unusual records, someone may be able to infer that a person was in the training data or recover some of their details. Outliers face the highest risk.

Is synthetic data considered personal data?

Not automatically either way. Under UK and EU rules it depends on whether people can be identified by means reasonably likely to be used. Data that fails that test remains personal data, and generating it from real records is itself processing personal data.

Does synthetic data reduce or amplify AI bias?

It copies bias by default and can worsen it, depending on the generator. It can help when you deliberately rebalance under-represented groups, but only if you then test results for each subgroup.

How does differential privacy protect synthetic data?

It limits the influence any single person’s record can have on what the generator learns, which bounds what an attacker can infer. The cost is accuracy, especially for small groups, and the implementation has to be correct.

How do you evaluate synthetic data quality?

Check fidelity, utility, privacy and bias separately, using the four questions above.

The Question to Ask Next

A synthetic patient never existed, but the people it was learned from did. So the next time someone says a dataset is safe because it’s synthetic, ask for evidence: what was tested, against which attacks, and what happened to the outliers? A clear answer to what is synthetic data is only the start. The useful answer is what this dataset, from this generator, has been shown to withstand.

To Read More Interesting article like that you can visit our AI and technology section.