A dataset contains generated people rather than copied rows. That sounds reassuring, but “synthetic” describes how the data was produced, not a universal guarantee that information about real people cannot be inferred.
Separate resemblance from disclosure
A generator is often trained to reproduce patterns in source data. The useful question is whether its output also exposes information about particular source records or unusual combinations of attributes. Removing names from the output does not answer that question.
The research paper Synthetic Data — Anonymisation Groundhog Day examines the limits of treating synthetic data as a straightforward privacy solution. Its broader lesson for a project review is to evaluate the actual generation method and threat model, rather than accepting the label as the assessment.
Define who might learn what
Ask who will receive the data, what other information they could combine with it and what disclosure would be harmful. An internal software test and a public research release have different exposure conditions. Rare records may deserve special attention even when the overall distribution looks realistic.
Document the source data permissions, generation process and privacy checks. If a method offers a formal privacy guarantee, have a suitably qualified person review the assumptions and parameters. Do not describe a casual similarity check as equivalent to such a guarantee.
Test utility separately
A dataset can be useful for demonstrating a dashboard while being unsuitable for estimating a rare event. Evaluate it against the actual task. Conversely, high predictive usefulness does not establish privacy protection.
Keep an explicit release decision with an accountable owner. Record what is permitted, who may access the output and which limitations must travel with it. Retain appropriate controls over the original data throughout.
Synthetic data can be valuable, but its value is clearer when the claims are narrow: suitable for a specified use under reviewed conditions. That is a stronger basis for sharing than “the rows are generated, so privacy no longer matters.”