The fraud team wants a model. Legal cannot find a lawful basis for the real transaction histories. At the next meeting the fashionable fix appears: generate a synthetic dataset that “statistically mirrors” the real one and train on that instead. The privacy problem disappears, or does it? Synthetic data is genuinely useful, but the legal claim usually attached to it (“it’s not personal data”) is true only under conditions most teams never verify.
What synthetic data is, and the two legal moments
Synthetic data is artificially generated data that preserves the statistical properties of a source dataset without reproducing its records. Legally there are two processing moments, and teams habitually analyse only the second. Moment one: generating the synthetic set requires processing the real personal data, which needs a legal basis, purpose compatibility analysis and, for sensitive categories, far more. Moment two: using the synthetic output, which escapes data protection law only if the output is genuinely anonymous.
The anonymity test synthetic data must actually pass
Synthetic does not mean anonymous. The output is personal data if records can be singled out, linked back, or attributes inferred, and generative models are known to memorise: rare combinations and outliers leak from source to output. The practical standard mirrors the anonymization test: run similarity and membership-inference checks, document outlier handling, and treat “privacy guarantees” from vendors as claims to verify, not facts to cite. A synthetic set generated with differential-privacy budgets and tested for re-identification stands on defensible ground. A GAN trained overnight on the raw customer table does not.
Where it fits a Turkish startup’s stack
Three sweet spots. Testing and development: KVKK-compliant alternative to copying production into staging, a recurring finding in Turkish audits. Sharing: giving investors, partners or offshore dev teams “data-shaped” material without triggering cross-border transfer rules, provided the anonymity work is done. Training: augmenting scarce classes and prototyping before you invest in a lawful pipeline for the real data. The anti-pattern is using synthetic data as a laundering step, generating from unlawfully collected data and claiming a clean slate. The unlawful first processing does not wash out.
Three de-identification routes, compared
| Technique | Still personal data? | Best use | Typical failure |
|---|---|---|---|
| Pseudonymization | Yes, always | Security measure inside your perimeter | Treated as anonymization in vendor decks |
| Anonymization | No, if irreversible | Publishing statistics, releasing datasets | Small cohorts re-identify; “we removed names” claims |
| Synthetic generation | Only if output passes the anonymity test | Test data, sharing, class augmentation | Model memorises outliers; no membership-inference testing |
A defensible pipeline, step by step
What the compliant version of the fraud-model story looks like: (1) a documented legal basis for the generation processing, typically legitimate interest with a recorded balancing test, since the purpose is privacy-protective; (2) outlier treatment before training the generator, because rare records are what leak; (3) generation under a differential-privacy budget where the vendor supports it; (4) a membership-inference and nearest-record similarity test on the output, with thresholds set in advance; (5) a one-page dataset sheet recording all of the above. Steps four and five are the difference between an engineering claim and a legal position. They are what you hand the KVKK Board, a GDPR authority, or a diligence team when the question “is this really anonymous?” arrives.
Is synthetic data anonymous under GDPR/KVKK?
Only if it passes the same re-identification analysis as any anonymization claim. The label “synthetic” carries no legal weight by itself.
Does the AI Act say anything about it?
Yes. It expressly recognises synthetic and anonymised data among the options for the data-governance duties of high-risk systems, which makes documented generation pipelines a compliance asset once the postponed regime lands in December 2027.
This week’s homework
Pick one dataset you currently copy into staging or share externally. Price a synthetic replacement: source basis for generation, a membership-inference test, and one page of documentation. That page is what turns “we use synthetic data” from marketing into a defence.
Related: pseudonymization · AI Compliance Hub.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call