SDAIA Highlights Synthetic Data: How Your Company Can Use It to Develop AI

On 31 October 2026, SDAIA published a 47-page study titled "Synthetic Data: Opportunities, Challenges and Governance Mechanisms". Synthetic data is generated by algorithms to mimic the statistical properties of your real records without containing information about real people. Your company can use it in three ways: to test its systems and train its models without exposing customer records, to generate rare cases it lacks, such as fraud, and to share information with a developer or partner more safely. But the study warns it is not absolute privacy: it falls under the Personal Data Protection Law if individuals can be identified from it.

What did SDAIA say?

According to SDAIA's announcement, synthetic data can accelerate innovation, reduce collection and preparation costs, and make information easier to share between entities, especially in sectors that handle sensitive information such as healthcare and financial services. But the study itself stresses that generating records that mimic real ones does not necessarily remove the risks of re-identifying individuals or of statistical bias. The study builds governance on four dimensions: privacy protection, data quality, fairness and bias mitigation, and transparency.

The idea is not new: the study says its first systematic use for privacy was in 1993, to protect the confidentiality of US census records, and that the big leap came in 2014 with generative adversarial networks (GANs). What is new is that generative AI has made it easier and cheaper to produce.

3 types of synthetic data

According to the study, it is generated in three ways: rules you write yourself, such as an age distribution of customers; statistical models that learn the relationships between variables; or generative AI models, which suit images, text and other complex inputs.

How can your company use it?

• Testing systems without customer data. Your development and test environment does not need your customers' real names and mobile numbers. Generate synthetic customers, invoices and transactions that look like the real ones in format and distribution, and keep real records in production only. Make sure test records do not point to real domain names or addresses; we saw in the story of the fake company name that matched a real domain what happens when it does.
• Training models on rare cases. The study notes that the financial sector uses it to generate rare transactions for fraud and money-laundering detection. The same idea helps if you have too few cases of fraud, returns or faults to train a model.
• Better representation of small groups. If your records lean towards one city or one customer segment, synthetic data helps balance it so the model is not biased against the rest.
• Sharing with a developer or partner. Give the supplier or software company synthetic data to build and test on, instead of handing over a copy of your customer database.

Does synthetic data fall outside the Personal Data Protection Law?

Not automatically. The study says synthetic data is not mentioned explicitly in the Personal Data Protection Law or its implementing regulation, but Article 9 of the regulation states that anonymised information is not personal data. So the answer depends on re-identification: if a person can be identified from it directly or indirectly, it is subject to the law; if that is not possible, it is treated as anonymous. That is why the study calls for assessing re-identification risk, especially with small datasets and rare cases that are easy to link to people.

The study also notes that in 2023 SDAIA launched the region's first regulatory sandbox for data and privacy, a space to test privacy-enhancing technologies, including synthetic data, without compromising privacy requirements.

4 risks to watch

• Re-identification. The generating model may memorise precise or rare patterns from the real records and expose a specific person.
• Weak realism. Synthetic data may miss outliers and fine details, so the model does well in testing and fails with real customers.
• Model degradation. Training models again and again on output generated by other models gradually strips away diversity, which the study calls model collapse.
• Reproducing bias. If your original records are biased, synthetic data may carry that bias over or amplify it.

Practical steps from SDAIA's roadmap

The study proposes a roadmap of 3 phases and 6 steps, from which we take what suits a medium-sized company:

1. Define the purpose first. Do you want it for software testing, for training a model, or for sharing with an outside party? The purpose sets the accuracy and privacy you need and the right tool.
2. Name an owner and set internal rules. Who approves generating and using it, and who is accountable for its quality. If you have started applying data governance in line with SDAIA, add synthetic data to it.
3. Check quality and privacy before use. Compare the synthetic set with the real one, test whether someone could re-identify individuals from it, and evaluate the final model on independent real records.
4. Document the generation process. Record the source of the original records, the tool or model used and its settings, so the work can be reviewed later.
5. Ask suppliers for transparency. If you buy synthetic data or a generation tool, ask for documents on the sources, the model used, known biases and its limits.

These steps fit with the national AI risk management framework. At Origami we help companies build test environments on synthetic data and keep them separate from real customer records. Contact us if you would like us to start with you.