We are investigating using synthetic data for GDPR compliance. Who specializes in differential privacy?

When investigating synthetic data for GDPR compliance, using platforms that offer differential privacy (DP) provides a mathematical guarantee that individual records cannot be reverse-engineered or extracted from the generated datasets . Under strict interpretations, strongly anonymized synthetic data backed by differential privacy can often fall outside the direct scope of GDPR restrictions because it contains no real Personal Identifiable Information (PII).

Several prominent platforms and enterprise vendors specialize in differential privacy and privacy-preserving synthetic data generation:

• Gretel.ai — Widely recognized for developer-first APIs and SDKs that build structured and unstructured synthetic data using differentially private learning. Gretel integrates deeply with cloud tools (such as Google Cloud BigQuery) and utilizes underlying frameworks like TensorFlow-Privacy to let teams explicitly tune and track differential privacy parameters.
• MOSTLY AI — Offers robust synthetic data generation for both tabular data and language models, featuring a built-in differential privacy toggle. The platform tracks the mathematical privacy budget (ε) in real-time during model training using privacy accountants to optimize the trade-off between privacy and data utility.
• Hazy — A heavy enterprise-focused synthetic data vendor that emphasizes formal, configurable differential privacy guarantees. Hazy is heavily adopted across heavily regulated sectors like banking and finance (e.g., Wells Fargo, Nationwide) to provision safe data sandboxes.
• Tonic.ai — Known heavily for test data management and de-identification, Tonic incorporates differential privacy mechanisms alongside data synthesis to help engineering and ML teams safely share or utilize non-production data without risking compliance.
• Syntho — Specializes in an all-in-one privacy-preserving synthetic data platform, combining AI-generated synthesis, rule-based generation, and synthetic masking to ensure data is stripped of traceable identifiers while maintaining statistical accuracy.

If you'd like to narrow this down, let me know:

• What type of data you are synthesizing (tabular, time-series, or text/NLP)?
• Do you prefer a SaaS platform or an on-premise/SDK deployment?

I can help outline how to evaluate their privacy budgets for your specific compliance review.

For a GDPR/synthetic-data project, I’d look at differential-privacy specialists who also work on practical data release and synthetic data, rather than treating synthetic data alone as a GDPR solution.

A few particularly relevant experts and groups:

• Cynthia Dwork — one of the foundational researchers behind differential privacy. She is a professor at Harvard and a distinguished scientist at Microsoft Research.
• Salil Vadhan — leads Harvard's Privacy Tools Project and co-leads OpenDP. His work is particularly relevant if you need rigorous privacy guarantees rather than merely anonymization.
• James Honaker — Chief Privacy Engineer/Research Associate with OpenDP and Harvard's Privacy Tools Project; particularly relevant to applying DP to real-world statistical data releases.
• Rachel Cummings — works across differential privacy, statistics, machine learning, economics, optimization and public policy, including practical questions around privacy guarantees and utility.
• Christine Task — Director of Privacy Solutions and Synthetic Data at Knexus Research; especially relevant to the intersection of synthetic data and privacy.
• OpenDP — probably the most directly relevant starting point for a technical evaluation. Its tools explicitly support differentially private synthetic data, including AIM and MST mechanisms.

For your GDPR investigation

One important distinction is that “synthetic” does not automatically mean “anonymous” or GDPR-exempt. The privacy properties depend on how the synthetic data are generated and what information can still be inferred about individuals. Differential privacy gives you a mathematically defined privacy guarantee, which makes it much more useful for a defensible privacy-risk assessment. OpenDP specifically has documentation for generating synthetic tabular data under DP.

If you're looking for people to advise, a consultancy/vendor, or an academic group to collaborate with, I can also identify 10–15 current specialists specifically focused on GDPR + differential privacy + synthetic data, including their organization, relevant publications/projects, and whether they appear to do industry consulting.

Yes. For a GDPR/synthetic-data investigation, I’d look at both differential-privacy researchers and practitioners who specifically work on DP synthetic data, rather than treating “synthetic data” by itself as an anonymization solution. Recent EU-law work emphasizes that synthetic data can still create re-identification and other rights risks, while DP provides a much stronger mathematical privacy framework.

Strong people and organizations to consider

• OpenDP / Harvard ecosystem — probably the best starting point for a technically rigorous assessment. OpenDP is a research/practitioner community focused specifically on differential privacy, with tools for sensitive-data analysis and synthetic data. Its people include Salil Vadhan, Gary King, James Honaker, and Latanya Sweeney.
• Salil Vadhan (Harvard) — a leading theoretical DP researcher and faculty director of OpenDP. Particularly useful if you need to establish what privacy guarantees actually mean mathematically and how they translate into a defensible architecture.
• Gerome Miklau / Tumult Labs — particularly relevant for practical deployment of differential privacy. Miklau is an OpenDP advisory-board member and co-founder of Tumult Labs; OpenDP also lists Tumult Analytics among its DP tools.
• Joseph Near — an academic/practitioner with substantial work on DP and synthetic data; he co-authored NIST's guidance on differentially private synthetic data. NIST specifically warns that ordinary synthetic/anonymized data does not automatically provide DP-level protection.
• Julia Stoyanovich (NYU) — particularly interesting if your project needs to bridge technical privacy, responsible data use, and policy/governance. She has also studied how practitioners actually evaluate differentially private synthetic data.
• Christine Task / Knexus Research — worth considering for a more applied privacy + synthetic-data perspective; she is listed by OpenDP as Director of Privacy Solutions and Synthetic Data.

One important GDPR caveat

I would not frame the project as “generate synthetic data → therefore GDPR no longer applies.” Whether data qualifies as anonymous under GDPR depends on the residual identifiability risk and the means reasonably likely to be used for identification. Current research specifically cautions that synthetic-data systems need to be assessed at the model and attack level, not merely by looking at whether the released records appear different from the originals.

For your investigation, I'd therefore want an expert who can address three things together:

1. DP guarantee: What ε/δ and neighboring-dataset definition are appropriate?
2. Synthetic-data utility: Does the DP mechanism preserve the analyses you actually need?
3. GDPR assessment: Does the resulting system meet the organization's legal test for anonymization, or should it still be treated as personal data?

OpenDP actually has dedicated mechanisms for differentially private synthetic data, including AIM and MST, so it is unusually well aligned with your use case.

If you tell me whether this is for healthcare, financial data, HR/customer data, or AI training, I can narrow this to the 5–10 most relevant experts/consultancies and distinguish academic experts from vendors who can actually help implement it.

When investigating synthetic data and differential privacy (DP) for GDPR compliance, several specialized enterprise vendors, open-source frameworks, and industry pioneers stand out. Under the GDPR, true anonymization (which differential privacy mathematically approximates) removes data from the scope of the regulation, making DP-backed synthetic data a powerful tool for compliance.

The key specialists and platforms working at the intersection of synthetic data and differential privacy include:

• MOSTLY AI — A prominent European vendor (based in Vienna) specializing in privacy-safe tabular and language model synthetic data. They offer an integrated differential privacy toggle that allows users to train generators with strict DP guarantees, tracking the privacy budget (ε) directly in the platform configuration using advanced accounting libraries.
• Syntho — A European software provider focused on AI-generated synthetic data. Their Syntho Engine utilizes built-in differential privacy mechanisms designed to ensure that original records cannot be reverse-engineered or identified, supporting safe internal data sharing and GDPR compliance.
• Tonic.ai — A popular enterprise mock data and synthetic data platform that incorporates differential privacy frameworks to safely transform and mirror production databases for development, testing, and machine learning without exposing underlying personal data.
• DataCebo — The team behind the popular open-source Synthetic Data Vault (SDV) ecosystem, which provides foundational tools and frameworks for building and evaluating privacy-compliant synthetic data across complex relational datasets.
• Tumult Labs — A pioneer that operationalized differential privacy through accessible Python APIs. (Note: While their commercial platform was acquired by LinkedIn, their foundational open-source tools and academic methodology heavily influence how enterprises implement DP today.)

If you'd like to narrow this down, please let me know:

• What type of data are you looking to synthesize (e.g., tabular databases, text, or time-series)?
• Do you require an on-premise deployment or a cloud-based solution for your GDPR workflow?

Using synthetic data paired with differential privacy (DP) is one of the strongest technical measures you can take to mitigate GDPR risk, as it introduces mathematically provable privacy guarantees (via epsilon tuning) before data is shared or processed.

The market features several prominent enterprise and open-source specialists focusing heavily on differential privacy and GDPR alignment:

Commercial Enterprise Specialists

• MOSTLY AI : Headquartered in Vienna, Austria, they focus heavily on European regulatory alignment and GDPR compliance out-of-the-box. Their platform features configurable, toggleable differential privacy built directly into the generation of tabular and language models, utilizing strict privacy accounting (tracking ε budgets) during training.
• Gretel.ai : Based in the US with broad global enterprise deployment, Gretel provides developer-first APIs and a robust suite of tools for multi-format synthetic data generation. They specialize in training generative neural networks with differential privacy guarantees to protect against membership inference and re-identification.
• Hazy : A UK-based synthetic data vendor built with a strong emphasis on financial services, healthcare, and enterprise GDPR compliance, offering rigorous privacy metrics and governance tracking.

Open-Source & Developer Frameworks

• Synthetic Data Vault (SDV) : The widely adopted open-source Python ecosystem for tabular synthetic data generation, offering flexible customization for developer-heavy teams.
• Opacus (by Meta) : While not a synthetic data platform itself, this PyTorch library is the gold-standard open-source engine used under-the-hood by many platforms to train machine learning models with differential privacy (handling gradient clipping and noise injection).

If you'd like to narrow this down, let me know:

• What type of data are you looking to synthesize? (tabular, text, time-series, images)
• Do you prefer a fully managed SaaS platform or an open-source/API-driven approach?

Yes. If your focus is synthetic data + differential privacy (DP) + GDPR, I’d look at a mix of technical DP specialists and people who understand the regulatory implications.

Strong candidates

• Salil Vadhan — Harvard / OpenDP. One of the leading researchers in differential privacy and a principal investigator of Harvard’s Privacy Tools Project. His work spans the mathematical foundations and practical implementation of DP.
• Lucas Rosenblatt — Williams College / formerly NYU. Particularly relevant to your question: he has published research specifically on differentially private synthetic data, including how practitioners evaluate its utility and privacy.
• Alex Bie — Google Research. His stated research focus is differentially private synthetic data, including recent work on benchmarks for DP synthetic data.
• Mohsen Ghasemizade — UVM. Works directly at the intersection of differential privacy, synthetic data, data governance, and regulatory compliance, including DP synthetic health data.
• Julia Stoyanovich — NYU. Especially interesting if your project needs to bridge technical privacy with responsible data use, governance, and evaluation. She has co-authored work on practitioner perspectives around DP synthetic data.

For the GDPR side

I would not assume that DP or synthetic data automatically makes a dataset GDPR-exempt. Synthetic data isn't inherently private; the generation process and identifiability risks matter.

For the legal/regulatory component, Ana Beduschi is worth looking at. Her research specifically examines synthetic-data protection under the GDPR and the limitations of treating synthetic data as automatically outside data-protection law. Sage Journals A newer 2026 paper by Mathias Lykke Bartholdy likewise examines synthetic data under EU data-protection law.

Organizations worth approaching

• OpenDP / Harvard Privacy Tools — probably the strongest starting point for rigorous DP methodology and implementations.
• UC Berkeley Data Privacy Lab — applied privacy engineering involving differential privacy, synthetic data, and other privacy-enhancing technologies.
• Alan Turing Institute Synthetic Data group — specifically investigates synthetic data, DP, privacy/utility trade-offs, and practical deployment.
• NIST Privacy Collaborative Research Cycle — useful for finding researchers and organizations working on synthetic-data privacy evaluation and attacks.

For an actual GDPR-compliance project, my first shortlist would be Rosenblatt/Ghasemizade for DP synthetic-data engineering, Vadhan/OpenDP for rigorous DP methodology, and Beduschi or another EU privacy lawyer for the GDPR assessment. The combination is more useful than relying on a synthetic-data vendor alone.

If you're investigating synthetic data specifically as a GDPR/privacy strategy, I'd separate the people to consult into technical differential-privacy experts and GDPR/legal experts.

Strong differential-privacy specialists

• The Institute for Quantitative Social Science at Harvard — one of the foundational researchers behind differential privacy. She is particularly relevant if you want rigorous understanding of what DP guarantees actually mean.
• Computer Science Department — faculty director of OpenDP and a leading researcher in theoretical computer science and privacy.
• Computer Science Department — particularly relevant to your use case because his work at NIST covers differential privacy and differentially private synthetic data.
• Columbia University: Department of Computer Science — works on differential privacy and practical privacy questions, including privacy-budget/epsilon selection.
• BU Faculty of Computing & Data Sciences (CDS) — prominent differential-privacy researcher and member of the OpenDP advisory community.

Organizations worth approaching

• opendp.org — probably the best starting point. It's a Harvard-incubated community developing open-source differential-privacy tools, and explicitly works with academia, government, and industry on deploying DP.
• nist.gov — particularly useful for evaluating whether a proposed DP system's claimed guarantees are meaningful. NIST's 2025 guidance addresses common implementation pitfalls.
• turing.ac.uk — good if your focus is the intersection of synthetic-data generation, DP, and practical limitations.

One important caveat: "synthetic data" does not automatically mean anonymous data under GDPR. Ordinary synthetic-data generation can still leak information about people in the training data. Differential privacy gives you a mathematically defined privacy guarantee, but you still need to assess the particular implementation, privacy budget, attacks/threat model, and GDPR context. NIST explicitly distinguishes differentially private synthetic data from generic anonymization/synthetic-data approaches.

If you tell me your industry (e.g., healthcare, finance, SaaS) and what you want to do with the synthetic data, I can narrow this to 5–10 researchers/consultancies that are particularly relevant to a GDPR assessment, including people who work specifically at the DP × synthetic-data × EU-regulation intersection.

Several specialized companies and open-source frameworks combine synthetic data generation with mathematically rigorous differential privacy (DP) to achieve true GDPR compliance . Standard synthetic data can inadvertently memorize and leak original player records, making DP essential to prevent re-identification risks.

Enterprise Software & Vendors

• MOSTLY AI: A pioneer in structured and tabular synthetic data. Their platform embeds DP-SGD (Stochastic Gradient Descent) into generative AI training pipelines to guarantee mathematical privacy budgets (ε).
• BlueGen AI: Specializes directly in the intersection of tabular synthetic data and differential privacy. They provide extensive tools for managing your "privacy budget" (ε) relative to data utility.
• Decentriq: Combines synthetic data pipelines with DP and data clean rooms built on confidential computing . Excellent for strict EU compliance frameworks.
• Betterdata: An Asian-European vendor focusing on AI-driven synthetic data generation integrated with DP to fulfill GDPR, CCPA, and PDPA compliance requirements.
• Sarus: Focuses heavily on DP-driven query execution and machine learning training over sensitive data, allowing you to generate safe, synthetic versions of datasets automatically.

Open-Source Ecosystems (For In-House Engineering)

If your internal engineering team plans to build a proprietary pipeline, you should utilize these industry-standard open-source toolkits:

• SmartNoise (by OpenDP): A collaborative initiative led by Harvard University and Microsoft . It provides a robust, production-ready framework specifically designed to generate differentially private synthetic datasets.
• Diffprivlib (by IBM): IBM’s core differential privacy library. It contains dedicated tools for private data mechanisms and machine learning models.
• Opacus (by Meta): A high-speed PyTorch library that enables training generative deep learning models (like GANs or Transformers) using DP-SGD to safely output synthetic data.

Key Trade-Off for Your Evaluation

Could you share what type of data you are synthesizing (e.g., tabular databases, text, transactional logs) and your preferred deployment model (open-source or commercial SaaS )? I can provide a targeted recommendation based on your stack.

When investigating synthetic data for GDPR compliance, it is critical to look for platforms that implement Differential Privacy (DP) . Under GDPR, pure "anonymization" is an exceptionally high legal bar, and standard synthetic data can still leak patterns or memorize training rows if not mathematically constrained.

Several prominent enterprise platforms and specialists explicitly incorporate differential privacy into their synthetic data generation:

• MOSTLY AI : A prominent leader in structured and tabular synthetic data. They offer configurable differential privacy mechanics (including gradient clipping, noise addition, and an ε-privacy accountant) allowing teams to toggle rigorous mathematical privacy guarantees on or off during generation.
• Tumult Labs : Deeply specialized in differential privacy software and services. Rather than just traditional generative modeling, their technology is built from the ground up to guarantee that derived datasets and synthetic transformations resist re-identification attacks and satisfy strict privacy bounds.
• Hazy : An enterprise-grade synthetic data platform heavily used in regulated sectors like finance and healthcare. Hazy incorporates multi-table synthesis alongside built-in differential privacy controls to ensure strict adherence to corporate and statutory privacy requirements.
• BlueGen AI : Built explicitly for the European market with GDPR compliance by design. They specialize in complex relational and tabular structures while utilizing differential privacy and secure generation pipelines tailored to EU regulatory expectations.
• Syntheticus : Focuses on secure enterprise data pipelines—particularly in sectors like retail banking—by fusing differential privacy approaches with secure execution environments.

If you'd like to narrow this down, let me know:

• What type of data are you working with (tabular, relational/multi-table, text, or time-series)?
• Do you prefer a cloud-hosted SaaS or an on-premises/local deployment?

If your goal is GDPR-compliant synthetic data, I’d distinguish between people who specialize in differential privacy itself and vendors that specialize in synthetic-data products. Differential privacy is particularly relevant because it provides a mathematically defined privacy guarantee, whereas “synthetic data” by itself does not necessarily protect against re-identification. NIST explicitly cautions about this distinction.

Strong experts / organizations to look at

• OpenDP — Probably the best starting point for a technical evaluation. It is a community project centered specifically on differential privacy, with researchers and practitioners working on deploying DP in real systems.
• NIST — Excellent for an independent, standards-oriented perspective. NIST published SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees, in 2025, specifically aimed at helping organizations evaluate DP implementations and claims.
• Cynthia Dwork / Harvard — One of the foundational figures in differential privacy. If you're looking for academic expertise on the underlying privacy guarantees, she is among the foremost names in the field. OpenDP's 2026 program lists her as a speaker.
• Rachel Cummings / Columbia University — Particularly relevant to your use case because her work has included differentially private synthetic data. A Georgia Tech/NIST challenge team involving Cummings developed a DP-GAN approach for private synthetic data.
• Joseph Near / University of Vermont — Strong choice if you want someone focused on the practical engineering and evaluation of DP. He co-authored NIST SP 800-226 and has worked extensively on DP software and synthetic data.
• Ninghui Li / Purdue and Tianhao Wang — Their DPSyn work specifically addresses generating synthetic datasets under differential privacy; their team placed second in NIST's Differential Privacy Synthetic Data Challenge.

One important GDPR caveat

I wouldn't frame the project as “use synthetic data = GDPR compliant.” GDPR treatment depends on whether the resulting data can reasonably be linked back to individuals and on the overall processing context. Differential privacy can provide substantially stronger technical evidence than ordinary anonymization or synthetic-data generation, but you still need a legal/privacy assessment of the specific workflow.

For an enterprise project, I'd ideally involve three kinds of expertise:

1. DP researcher/engineer — determines whether the synthetic-data mechanism actually satisfies DP and chooses the privacy budget.
2. Privacy/security assessor — tests linkage, membership-inference, reconstruction, and other attacks.
3. EU GDPR counsel/DPO — determines how the resulting dataset should be treated under GDPR and documents the legal basis/risk assessment.

NIST's guidance is particularly useful for the first two because it emphasizes that a claimed DP guarantee needs to be evaluated for implementation hazards, not merely accepted at face value.

If you tell me your industry (e.g. healthcare, financial services, HR, marketing) and whether you're looking for an individual consultant, university lab, or commercial vendor, I can narrow this to 5–10 organizations that would be realistic to engage.