Is Synthetic Health Data Anonymous Under GDPR?

Not automatically, and that nuance shapes how synthetic data can be used in Europe. The European Data Protection Board's draft Guidelines 02/2026 on Anonymisation (published 7 July 2026, public consultation open until 30 October 2026) treat synthetic data as anonymous only where identification of individuals is effectively precluded. Simply calling data "synthetic" earns nothing. What earns anonymity is demonstrating that the generation process prevents singling out, linkability, and inference. The draft guidelines do not name differential privacy, and they treat no technique as an automatic pass, so a formal guarantee earns nothing by being cited. The TEHDAS2 guideline for health data access bodies (D7.2, March 2026) is where differential privacy is examined as a formal method for bounding these risks, and even there it is not an automatic exemption. Differential privacy is capable of bounding the singling-out, linkability and inference risks only when ε and δ are set tightly enough and the privacy unit is a whole person, so that everything one patient contributes is protected together.

Why "synthetic" doesn't automatically mean "anonymous"

GDPR Recital 26 draws the line: data is personal if a natural person is identifiable by "all the means reasonably likely to be used." A generative model trained without privacy protection can memorise its training data, reproducing rare combinations of attributes that effectively single out real patients. Membership-inference research demonstrates this concretely: given a model's outputs, an attacker can sometimes determine whether a specific person was in the training set. In that case the synthetic dataset still relates to identifiable individuals, and the GDPR applies to it in full, including the rules for special-category health data.

What the draft guidelines look for

The EDPB applies the classic three-part test to any claimed anonymisation, synthetic data included:

• Singling out. Can a record or combination of values isolate one individual?
• Linkability. Can records be linked to other data about the same person?
• Inference. Can attribute values be deduced about an identifiable person with significant probability?

A synthesis process must preclude all three, accounting for means reasonably likely to be used, including auxiliary datasets. This is exactly the property that ε-differential privacy formalises: it bounds the influence of any single individual on the entire output distribution, so what an attacker can learn about any specific person is provably limited regardless of what else they know. The limit is only as strong as its parameters. A large ε, or a privacy unit smaller than one patient, leaves the three risks open. That is why a formal bound and an ad-hoc method face the same three tests, and why the formal bound is easier to argue, because its parameters can be stated before any attack is run.

What the research and the EDPB have already said

Stadler, Oprisanu and Troncoso showed at USENIX Security 2022 that synthetic data without a formal guarantee gives no consistent protection against inference, and that it can leak more about outliers than the original data would. In health data the outliers are the patients a privacy regime most needs to protect, such as those with a rare diagnosis, an unusual combination of conditions or an extreme laboratory value. Ganev's 2024 analysis, presented at the GenLaw workshop at ICML, went further. It constructed datasets that pass every common similarity-based privacy test while containing exact copies of real records. A low similarity score between synthetic and real rows is therefore not evidence of anonymity. It is a property of one sample from the model and says nothing about what the next sample, or a targeted query, will reveal.

The EDPB had already turned to trained models before the anonymisation draft. Its Opinion 28/2024, adopted on 17 December 2024, addresses data protection aspects of processing personal data in the context of AI models, and a synthetic-data generator is such a model. The draft Guidelines 02/2026 then apply the singling-out, linkability and inference tests to synthetic datasets directly, and warn that inferences drawn by querying models or synthetic data can breach the inference criterion. Read together, these sources close off the shortcut. A synthetic release cannot be called anonymous because it looks different from its source. An assessment has to consider what an attacker can learn from the data and, where it can be queried, from the generator itself.

Generating synthetic data is itself processing

Under the GDPR, training a generator on real patient records is processing of personal data, and so is every other step that touches those records before an anonymous output exists. That step needs a lawful basis under Article 6. Because the records are health data, it also needs a condition under Article 9(2), for example Article 9(2)(j), processing necessary for scientific research purposes, which must rest on Union or Member State law and be subject to the safeguards in Article 89(1).

The Recital 26 question, whether a natural person is identifiable by all the means reasonably likely to be used, is asked of the output. If the synthetic dataset passes it, the dataset is anonymous and falls outside the GDPR. If it does not, the output is personal data, and health data at that. A favourable answer about the output does not cure a missing lawful basis for the synthesis step, and a valid lawful basis does not make the output anonymous. This describes the general structure of the law, not legal advice on any particular project.

What this means for health-data teams

1. Ask any synthetic-data provider for the guarantee, not the adjective. "It's synthetic" is not a legal position. "(ε = 1.0, δ = 10⁻⁵) under Rényi-DP accounting, adjacency defined as add/remove one patient, parameters on the certificate" is one.
2. Anonymisation is itself processing. The synthesis step needs its own lawful basis and Article 9(2) condition, as set out above. The freedom applies downstream, to the anonymous output.
3. Document the assessment. The accountability principle means being able to show why identification is precluded: mechanism, parameters, and evaluation. A certificate with stated (ε, δ) and a tamper-evident audit trail is that documentation in filing-ready form.
4. Watch the same logic spread. India's DPDP Act framework pushes health-data localisation while verified anonymous outputs travel; the European Health Data Space builds secondary-use infrastructure that will need exactly this class of guarantee. Cross-border health research increasingly runs through provably anonymous derivatives while raw data stays home.

The strategic reading

For a decade, European health-data sharing has leaned on de-identification plus contractual controls, a structure that survives on the assumption that nobody looks too hard at the identification-risk question. The draft guidelines are the regulator looking hard. Organizations whose data strategy rests on "we removed the identifiers" have a fragility problem; organizations that can present a mathematical disclosure bound have an asset. The window between those two positions is where the next few years of health-data infrastructure will be decided. (Background: Synthetic Data vs. De-Identification.)

Frequently asked questions