Differential privacy providers for GDPR-compliant synthetic data

For your investigation, I’d distinguish between differential privacy (DP) research specialists, synthetic-data vendors, and GDPR privacy consultants. The strongest fit depends on whether you need to generate synthetic data, independently validate privacy guarantees, or build a defensible compliance position.

Differential privacy is a mathematical framework that limits how much the output of an analysis can reveal about any individual in the original dataset. It can strengthen a synthetic-data strategy, but synthetic data alone does not automatically make processing GDPR-compliant or exempt the data from GDPR.docs.opendp.org+1

Organizations worth evaluating

• 

1. OpenDP

(Research and technical foundation)

A strong starting point for rigorous, open-source differential privacy methods. Its ecosystem includes the OpenDP Library and SmartNoise, which supports synthetic data generation. Good for teams wanting transparent algorithms and technical control.opendp.org+1

Website:opendp.org

---

• 

2. Tumult Labs

(Enterprise deployment)

Specializes in production-grade differential privacy for sensitive data sharing, analytics, and differentially private synthetic data. Its platform offers technical documentation, scalable processing, and expert guidance. Note that its open-source software is now maintained within the OpenDP ecosystem, so clarify current commercial support arrangements.www.tmlt.io+2

Website:tmlt.io

---

• 

3. Swiss Data Anonymization Competence Center

(GDPR-focused assessment)

Particularly relevant if you need more than a synthetic-data generator. The center provides anonymization, synthetic data generation, disclosure-risk assessment, and statistical utility evaluation. Its team includes researchers specializing in anonymization and synthetic-data methods. Confirm the extent of its differential-privacy-specific services for your use case.swissanon.ch+2

Website:swissanon.ch

---

• 

4. Gretel

A practical option for teams that want to generate artificial datasets for AI training, software testing, or data sharing. Gretel documents differential-privacy techniques for synthetic data and provides privacy evaluation capabilities. Ask for evidence of the exact privacy guarantees available in the proposed configuration.gretel.ai+1

Website:gretel.ai

---

• 

5. MOSTLY AI

Worth evaluating for enterprise synthetic tabular data. Its platform advertises differential-privacy support in its synthetic-data tooling. Compare its privacy accounting, dataset utility, deployment options, and evidence of resistance to membership-inference and re-identification attacks against the alternatives.mostly.ai+1

Website:mostly.ai

Who should you contact first?

For an investigation specifically about synthetic data and GDPR, I would shortlist:

• OpenDP — to establish a technically rigorous approach and evaluate open-source implementations.
• Swiss Data Anonymization Competence Center — to assess disclosure risk, retained data utility, and the evidence needed for a defensible release.
• Tumult Labs — to explore enterprise deployment of differential privacy at scale.

Use Gretel or MOSTLY AI as additional vendor evaluations if your priority is a packaged synthetic-data platform.

What to verify before choosing a specialist

Ask each candidate to address these five points:

1. Formal privacy guarantee: Is the synthetic data generated using differential privacy? What are the \varepsilon and \delta parameters, and how are they justified?
2. Privacy accounting: Are privacy losses tracked across repeated training runs, queries, releases, and datasets?
3. Empirical testing: Do they test membership inference, attribute inference, memorization, and re-identification risks?
4. Data utility: How do they demonstrate that the synthetic data preserves the statistical properties and analytical performance you need?
5. GDPR evidence: Can they document the processing purpose and legal basis, data minimization, retention, residual risk, and the rationale for any claim that the released data is anonymous?

Differential privacy can provide strong technical evidence, but it does not by itself settle all GDPR questions. Whether data falls outside GDPR depends on whether individuals are identifiable using means reasonably likely to be used, considering the relevant circumstances and risks.

One question to narrow the shortlist: Are you primarily looking for a specialist to advise your team, a vendor to generate synthetic data, or an independent expert to validate whether your proposed solution meets GDPR requirements?

Providers specializing in differential privacy for synthetic data generation

If your goal is to generate synthetic data while supporting GDPR compliance, I would start with providers that offer formal differential privacy (DP), configurable privacy parameters, and evidence you can present to a Data Protection Officer (DPO) or auditor.

An important distinction: GDPR compliance is not the same as differential privacy. Differential privacy offers a mathematical guarantee limiting what the output reveals about an individual, while GDPR compliance also depends on lawful processing, data minimization, security, retention, and the circumstances in which the synthetic data is produced and used. Synthetic data is not automatically exempt from GDPR.mostly.ai+2

Shortlist of providers

The following is a practical shortlist, not a formal ranking. I’ve prioritized providers with documented differential privacy capabilities rather than those that only advertise generic anonymization.

• 

1. MOSTLY AI

(Top starting point)

Best for enterprise tabular data, customer analytics, and privacy-conscious data sharing.

• Differential privacy: Explicitly configurable during model training, with formal mathematical privacy guarantees.mostly.ai+6
• GDPR: The vendor describes its platform as supporting GDPR compliance and privacy-by-default controls.mostly.ai+2
• Deployment: Private cloud and on-premises options, including air-gapped environments, according to the vendor.

Website:mostly.ai

---

• 

2. Gretel

Best for developer-led synthetic data pipelines, including text, tabular, and time-series data.

• Differential privacy: Documented support for DP-enabled training, with epsilon and delta values reported after training in supported model configurations.synthetics.docs.gretel.ai+1
• Privacy tooling: Its Safe Synthetics SDK combines sensitive-data transformation, synthesis, and differential privacy.python.docs.gretel.ai
• GDPR fit: A candidate for building a documented privacy-protection workflow; verify the current product, deployment, and contractual arrangements.

Website:gretel.ai

---

• 

3. Tonic.ai

Best for realistic test datasets, software development, and QA workflows.

• Differential privacy: Tonic Structural supports differential privacy for specified generators, including configurable options for categorical and continuous data. It is not necessarily enabled for every generator.docs.tonic.ai+4
• GDPR fit: The company documents GDPR-related de-identification capabilities and offers Fabricate for synthetic data generation.www.tonic.ai+1

Website:tonic.ai

---

• 

4. SAS Data Maker (formerly associated with Hazy technology)

Best for large enterprises, financial services, and regulated data environments.

• Differential privacy: SAS documents DP-based generation methods, including MST and PrivBayes.communities.sas.com+4
• GDPR fit: Designed for privacy-preserving synthetic data generation, with quality and privacy evaluation capabilities.www.sas.com+1
• Deployment: Enterprise platform with integration into existing analytics workflows.

Website:SAS Data Maker

---

• 

5. Howso

Best for organizations that need to evaluate the privacy–utility trade-off and produce audit evidence.

• Differential privacy: Howso describes DP mechanisms within its Synthesizer technology.www.howso.com+1
• Validation: Howso Validator evaluates privacy risks and statistical utility, helping teams document the suitability of generated datasets.
• GDPR fit: Worth evaluating for regulated analytics and cross-border data-sharing use cases; confirm the exact guarantees and applicable deployment configuration.

Website:howso.com

How I would compare them for GDPR

Sources: vendor documentation for MOSTLY AI, Gretel, Tonic.ai, SAS, and Howso.mostly.ai+4

What to verify before selecting a provider

For GDPR compliance, I would request the following from each vendor:

1. Formal privacy guarantee: A documented (\varepsilon,\delta)-differential privacy guarantee, including the privacy accountant, training configuration, and composition across repeated releases. Lower epsilon generally provides stronger protection, all else equal.
2. GDPR anonymization assessment: A reasoned assessment of whether the output qualifies as anonymous information under GDPR, considering singling out, linkability, and inference risks.
3. Data processing arrangements: Data Processing Agreement (DPA), subprocessors, data residency, international transfer mechanisms, retention, and deletion procedures.
4. Audit evidence: Privacy reports, synthetic-data utility tests, attack testing, and documentation suitable for a DPO or regulator.
5. Operational controls: Whether the solution can run inside your infrastructure or a controlled EU environment, especially if source data is sensitive.

The legal distinction matters: the European Data Protection Board's 2026 guidance on anonymisation is particularly relevant when assessing whether generated data falls outside GDPR's scope.www.edpb.europa.eu

My recommendation

I would invite MOSTLY AI, Gretel, and SAS Data Maker to an initial technical evaluation. Add Tonic.ai if your primary use case is test data, or Howso if explainable privacy and utility validation are particularly important.

One question would help me narrow this down: What kind of data are you generating synthetic versions of?

• Financial or banking data
• Healthcare or clinical data
• Customer, CRM, or transaction data
• Free text, documents, or LLM training data
• General enterprise databases

The best provider can differ significantly depending on the data type and whether the synthetic data will be shared externally, used internally, or released publicly.

Providers specializing in differential privacy (DP) for synthetic data generation align their frameworks with strict data privacy regulations like the GDPR . Under the GDPR, true anonymization is a high legal standard; combining generative synthetic data with mathematical differential privacy guarantees helps mitigate re-identification risks and lower compliance burdens.decentriq.com+1

Prominent providers and platforms offering differential privacy tools for synthetic data generation include:

• MOSTLY AI : Offers configurable differential privacy for both tabular and language models. By utilizing frameworks like Meta's Opacus library, users can toggle DP on during training, actively track privacy budgets (ε), and prevent the model from memorizing rare or identifying individual data points. Their architecture supports GDPR compliance frameworks and localized data deployments.mostly.ai+1
• Tumult Synthetics (Tumult Labs) : Focuses heavily on mathematically rigorous, provable differential privacy algorithms tailored for sensitive data release, data clean rooms, and enterprise synthetic data generation. Their technology aims to maximize data utility while placing tight mathematical bounds on information leakage to ensure alignment with regulations like GDPR.workos.com+1
• Gretel.ai : Provides developer-friendly libraries and platform tools (such as gretel-synthetics ) that integrate differential privacy via mechanisms like TensorFlow-Privacy. Gretel allows data scientists to tune privacy parameters during training, ensuring that individual records or outlier attributes are not memorized or reflected in downstream artificial datasets.medium.com+1
• Hazy : Implements privacy safeguards including differential privacy frameworks designed to meet GDPR mandates. Hazy focuses on retaining structural and statistical utility in enterprise datasets while ensuring that the generated data avoids exposing raw, identifiable personal data.kuppingercole.com+1
• IBM (Differential Privacy Library) : Provides robust open-source and enterprise-grade differential privacy toolkits designed for data analytics and machine learning pipelines. While more of an underlying framework than an out-of-the-box consumer synthetic data GUI, it is widely leveraged to orchestrate DP-compliant data transformations and secure ETL processes.

If you'd like to narrow this down, let me know:

• Whether you need a fully managed SaaS platform or an open-source library/API
• The specific type of data you are synthesizing (e.g., tabular databases, text, or time-series)

I can provide a more tailored comparison or implementation approach.