Characteristics of GDPR-compliant data
Synthetic data is not anonymized; it's fabricated from scratch without origin in real people. This is critical: GDPR defines PII as information identifying real individuals. A synthetic dataset with name: 'John M. Smith' and email: john.smith.7492@testmail.invalid doesn't violate GDPR because no real John Smith has that email nor that specific pattern.
Key markers to distinguish synthetic data: 1) TLD .invalid (RFC 6761, guaranteed not to resolve), 2) TEST- prefixes in IDs, 3) explicit flag "synthetic": true in JSON. This prevents test data from accidentally mixing with production.
Common mistake: using 'obfuscated' real data (changing John Doe to J**n D**). That's still PII processed without consent. Synthetic data must be algorithmically generated with realistic statistical distributions but no 1:1 mapping to real people. A synthetic IBAN must pass checksum validation without corresponding to an existing bank account.
Generating realistic data without violating privacy
Libraries like Faker (Python/JS/PHP) generate plausible data: common names by country, properly formatted addresses, card numbers passing Luhn algorithm. But configure locales correctly: Faker('en_US') generates 'Smith' and 'Johnson', not 'García' and 'Rodríguez'.
For financial data, use official test ranges: cards 4000-xxxx-xxxx-xxxx (Visa test), 5555-xxxx-xxxx-xxxx (Mastercard test). Payment processors guarantee these numbers are never assigned to real customers. Synthetic IBANs: valid structure with correct country codes but test bank BIC/SWIFT codes.
Health data requires extra care due to additional regulations (HIPAA in US, specific laws in EU). Generate generic medical conditions ('Synthetic condition A') instead of specific diagnoses. For labs, use standard reference ranges but not real patient values. Never use anonymized clinical histories: re-identification is trivial with enough datapoints.
Anonymization strategies vs. synthetic data
Anonymization starts with real data and applies techniques to remove PII: k-anonymity (each record is indistinguishable from at least k-1 others), l-diversity (sensitive attributes have at least l distinct values), differential privacy (adding mathematically guaranteed noise). But perfect anonymization is nearly impossible; studies show re-identification with only 3-4 quasi-identifiers.
Synthetic data avoids this problem by generating statistically similar distributions without real individuals. Tools like Synthpop (R) or SDV (Python) learn the structure of real data and generate new records that maintain correlations without identities. A synthetic transaction dataset preserves purchase patterns (product correlation, temporality) but no row corresponds to a real customer.
When to use each approach: anonymization for aggregate statistical analysis where you need exact properties of the original dataset. Synthetic for testing/development where you need volume and variety without legal risk. For ML training, synthetic avoids sampling bias introduced by anonymization when removing outliers to guarantee k-anonymity.
Compliance and auditing of test datasets
Document synthetic origin in metadata: each dataset should include generation_method, date_generated, source_algorithm. In GDPR audits (Art. 30 record-keeping obligations), you must demonstrate that test data is not PII. A README file with: "This dataset was generated using Faker 8.0 with deterministic seed X for reproducibility. No record corresponds to any real person, place or entity."
Implement data lineage tracking: if a bug allows synthetic data to be copied to production, you need to detect it fast. Set up alerts when fields with "synthetic": true appear in production databases. Data governance tools like Apache Atlas or Collibra can automatically tag synthetic datasets.
For children's data (Art. 8 GDPR), include parental_consent fields even in synthetic data to test verification flows. If your app processes data from minors under 16, testing must cover scenarios with/without parental consent. Synthetic data enables generating edge cases (13-year-old with consent in jurisdiction requiring 16) without involving real children.