Singapore - Synthetic Data Generation Guide

Overview

The PDPC Proposed Guide on Synthetic Data Generation (15 July 2024) sets out good practices for producing structured synthetic data as a Privacy Enhancing Technology (PET). The Guide was jointly developed with the Agency for Science, Technology and Research (A*STAR) and is intended to be available as a resource within the IMDA PET Sandbox. It frames synthetic data as artificial data generated by purpose‑built mathematical or ML models that can mimic statistical properties of source datasets while warning that synthetic output may still pose re‑identification risks. The Guide focuses on fully synthetic structured data, provides three common use case archetypes (AI training, data sharing/analysis, software testing), and offers a five‑step process and annexed handbook to guide organisations in technical, governance and contractual controls to mitigate residual risks. It emphasises a risk‑based approach, recognising trade‑offs between utility and privacy, and positions the document as a living guide to be updated as the technology and evaluation methods evolve.

Definitions

The Guide defines key terms used throughout: "synthetic data" as artificially generated data created by mathematical or ML models trained on source data; "fully synthetic" (no real records preserved) and "partially synthetic" (some original values retained) distinctions; "re‑identification risk" meaning the probability an individual in source data can be matched to synthetic records; and "Privacy Enhancing Technology (PET)" covering data obfuscation, encrypted computation and federated analytics. The Guide focuses on structured tabular data and clarifies that while high‑quality synthetic data can preserve statistical properties and utility, it is not automatically non‑personal data and still requires privacy risk assessment.

Governance and Institutional Framework

The Guide outlines governance expectations for organisations that generate synthetic data, including role‑based accountability (CIO/CTO/CDO/Data Protection Officer), documented policies, and cross‑functional oversight. It recommends integrating synthetic data governance into existing data protection management systems and PDPA compliance programmes, and using contractual safeguards when engaging external vendors or cloud providers. The PDPC suggests organisations adopt explicit project charters specifying purpose, legal basis, data sources, expected end‑uses and retention timelines. Where appropriate, organisations are encouraged to engage regulators and the IMDA PET Sandbox (IMDA PET Sandbox) for early regulatory feedback. The Guide also recommends periodic board reporting for higher‑risk projects and inclusion of synthetic data projects in enterprise risk registers and privacy impact assessments.

Key Focus Areas

The Guide’s technical and process focal points include: (1) data understanding and minimisation—identify sensitive fields, remove outliers and restrict granularity where feasible; (2) synthetic generation choices—select generation methods (statistical, model‑based, GANs, probabilistic models) appropriate to data types and risk tolerance; (3) privacy controls—apply pseudonymisation on source data, inject calibrated noise, and consider differential privacy for metrics or model training where provable bounds are needed; (4) utility validation—define and measure downstream performance metrics to ensure synthetic data supports intended tasks without overfitting to real individuals; (5) re‑identification testing—use membership, attribute and record linkage tests and threshold‑based risk criteria described in Annex D and Annex E; and (6) contractual and operational controls—access restrictions, purpose limitation clauses, logging, and incident response integration with existing PDPA obligations. The Guide emphasises iterative trade‑off analysis between utility and disclosure risk and recommends conservative deployments in high‑sensitivity domains (e.g., healthcare, finance) unless robust mitigation is in place.

Implementation Framework

The Guide offers a practical five‑step implementation flow: Step 1—Know your data: catalogue fields, provenance and sensitivity; Step 2—Prepare data: pseudonymise/anonymise and remove outliers, apply minimisation; Step 3—Generate synthetic data: choose model architecture and training protocols, incorporate noise or constraints as needed; Step 4—Assess re‑identification risks: apply quantitative and qualitative tests from Annexes D/E and compare to predefined risk thresholds; Step 5—Manage residual risk: apply contractual, organisational and technical safeguards, maintain documentation and monitoring. Each step includes recommended artifacts (data dictionaries, model cards, risk assessment reports) and acceptance criteria for release. The Guide further provides a sample data dictionary format (Annex B) and examples of generation methods (Annex C) to aid implementation teams.

Monitoring and Evaluation

The Guide requires ongoing monitoring of synthetic data projects: scheduled re‑identification testing, validation of downstream model performance, incident detection and reporting, and periodic review of assumptions (e.g., changes in linkable external datasets that might raise re‑identification risk). It recommends maintaining logs of generation runs, model versions and random seeds where feasible for reproducibility and audit. The Guide encourages organisations using synthetic data in production to include synthetic data metrics in their privacy KPI dashboards, and to re‑evaluate risk when dataset composition, use cases or external threat models change. Where possible, results from the IMDA PET Sandbox pilots and public case studies should inform refinements.

Penalties, Liability, and Appeals

Although the Guide itself is non‑binding, organisations are reminded that synthetic data generation activities remain subject to the PDPA and other sectoral rules. PDPC enforcement powers under the PDPA include directions and financial penalties; since 1 October 2022 the PDPA regime allows penalties of up to 10% of an organisation's annual turnover in Singapore (for qualifying thresholds) or SGD 1,000,000 (whichever is higher) depending on circumstances. Organisations are therefore encouraged to document risk assessments, follow the Guide’s practices, and consult PDPC where novel or high‑risk designs are proposed. The Guide also notes that civil liability or sectoral regulatory sanctions may arise from misuse of data or harms traceable to synthetic outputs; it recommends clear allocation of contractual liability and dispute/appeal mechanisms in supplier contracts.

Relationship to Other Instruments

The Guide complements and builds on existing PDPC materials such as advisory guidelines on AI use and prior PDPC technology guides (e.g., anonymisation guidance). It is designed to be used alongside IMDA’s PET Sandbox resources and sectoral rules (e.g., health, finance) administered by agencies like the Ministry of Health and the Monetary Authority of Singapore where more stringent controls may apply. The Guide references OECD/PDP research and international best practices on PETs and situates synthetic data guidance within the PDPA accountability framework, recommending alignment of synthetic data project governance with organisational PDPA accountability obligations.

International Alignment

The Guide acknowledges analogous instruments internationally — for example, PET guidance and synthetic data research emerging from OECD, EU data protection authorities, and standards bodies — and seeks alignment on terminology and evaluation approaches. PDPC suggests interoperability with international standards and encourages use of internationally recognised privacy techniques (e.g., differential privacy) and measurable re‑identification tests to facilitate cross‑border collaborations while respecting local legal constraints. Through IMDA’s sandbox and international engagement, Singapore aims to harmonise practices to support data sharing, research collaboration and trade while maintaining strong privacy safeguards.

Implementation Timeline

Sources and References