How does synthetic data work for university research ethics board approval?

Synthetic data does not automatically eliminate the need for ethics board review, but it can significantly simplify the approval process depending on how it was generated and what data it was derived from. When synthetic datasets contain no traceable information about real individuals, many institutions treat them as falling outside the scope of human-subjects research. The questions below unpack exactly how ethics boards, researchers, and regulators are navigating this rapidly evolving area.

Does synthetic data eliminate the need for ethics board review?

Synthetic data does not automatically eliminate the need for ethics board review. Whether review is required depends on how the synthetic dataset was created, what original data it was modeled on, and how your institution interprets its own policies. Some universities have waived review for synthetic data research on the grounds that it does not constitute human-subjects research, but this practice is contested and is not yet settled policy across the sector.

A growing number of medical research institutions, including major centers in Canada, Italy, and the United States, have concluded that research using synthetic datasets falls outside the scope of the US federal Common Rule because the data contains no real or traceable patient information. Under that reasoning, synthetic data research is not “human-subject research” and therefore does not trigger mandatory IRB oversight.

However, Nature’s editorial board has flagged serious concerns with this approach, pointing to two core risks: the possibility that individuals whose data trained the underlying AI model could still be re-identified, and the absence of robust validation standards for synthetic outputs. Regulatory bodies, including the European Data Protection Board, reinforce this caution, holding that anonymity cannot be assumed by default and must be demonstrated case by case.

In practice, most university IRB policies still address human-subjects research broadly, without synthetic-data-specific exemption criteria. Researchers should expect to seek an institutional determination rather than assuming exemption. Synthetic data occupies a genuine gray zone, and the safest path is to engage your ethics board early and document your generation process thoroughly.

What privacy risks does synthetic data address for research participants?

Synthetic data addresses three core privacy risks that arise when working with real participant data: identity disclosure, attribute disclosure, and membership disclosure. By generating artificial records that statistically mirror the original dataset without representing any real individual, synthetic data substantially reduces the likelihood that a specific person can be identified, profiled, or traced back through the dataset.

In research contexts involving electronic health records, wearable device data, or other sensitive biomedical information, accessing and sharing the real underlying data creates significant re-identification exposure. Synthetic data generated through techniques such as generative adversarial networks preserves the aggregate statistical relationships in the original data while removing direct links to individuals. This makes it far more practical to share data across research teams and institutions without triggering the consent and governance requirements that apply to identifiable personal data.

That said, the privacy protection synthetic data offers is not absolute. More recent research consistently shows that when synthetic data is designed to closely resemble the original, some residual re-identification risk remains. The closer the statistical fidelity, the higher the potential for disclosure. This privacy-fidelity trade-off is a central tension that ethics boards are increasingly asking researchers to address explicitly, rather than treating synthetic status as a blanket privacy guarantee.

Regulatory bodies in the UK and EU have reached similar conclusions: whether synthetic data can be processed as non-personal information depends on whether personal information from the source data can be inferred from the synthetic outputs. The practical implication for university researchers is that privacy protection must be demonstrated through formal assessment, not assumed from the generation method alone.

How do ethics boards evaluate synthetic data in research proposals?

Ethics boards evaluate synthetic data proposals using the same core criteria applied to any research involving sensitive information: whether risks are minimized, whether data privacy protections are sufficient, and whether the methods are adequately documented. When the synthetic data was derived from human-subject data, the original source still triggers ethical scrutiny even if the final dataset contains no identifiable records.

In practice, the level of review required varies. Research using fully synthetic datasets with no direct human-subject involvement has been classified as outside IRB scope by some institutions and major academic conferences. At the other end of the spectrum, the NIH’s IRB policy distinguishes between full board review, expedited review, and exempt status based on the degree of re-identification risk and the nature of the underlying data source. Synthetic data research may qualify for expedited or exempt review, but the determination rests with the institution.

Ethics boards are also increasingly being asked to weigh in on questions they are not yet fully equipped to answer. Board members themselves often need education on how synthetic data is generated, what fidelity and privacy metrics mean, and what validation looks like in practice. Frameworks such as the EU AI Act, HIPAA, and the NIST AI Risk Management Framework all emphasize transparency, accountability, and documented risk management, which means a well-prepared submission will include clear documentation of generation methods, validation protocols, and intended use cases.

One practical benchmark comes from the UK Statistics Authority, whose ethics checklist for synthetic data asks researchers to state the public good justification, document methods and known limitations, account for potential bias, and demonstrate that privacy penetration testing has been considered. Researchers preparing a submission to a university research ethics board would do well to work through a similar checklist before submission.

What types of research benefit most from synthetic data approval pathways?

Healthcare and biomedical research benefit most from synthetic data approval pathways, primarily because real patient data is subject to the strictest access controls and the longest ethics review timelines. Synthetic data allows researchers to conduct large-scale studies, simulate clinical trials, and build decision-support tools without ever touching identifiable records, which can dramatically accelerate both the approval process and the research itself.

Specific use cases where synthetic data has proven particularly valuable include epidemiological modeling, medical training simulations, and preliminary hypothesis testing before formal data collection begins. That last application is especially practical for grant-seeking researchers: working with synthetic datasets allows a team to pre-test a research design and generate supporting evidence for a funding application before IRB approval of real data access has even been sought.

Beyond healthcare, fields that routinely handle sensitive personal information are actively exploring synthetic data as a research tool. Economics, education, public policy, and psychology all involve data that carries significant re-identification risk, and researchers in these areas face similar barriers to access. Synthetic data offers a way to conduct meaningful analysis while reducing the friction associated with data utility agreements, consent requirements, and ethics submissions.

Synthetic data is also particularly valuable in research contexts where real data is simply scarce. In low- and middle-income country settings, where the infrastructure for large-scale data collection may be limited, synthetic datasets can provide a statistically representative foundation for research that would otherwise be impossible to conduct. The combination of reduced access barriers and faster ethics pathways makes synthetic data a compelling option across a wide range of academic disciplines.

Can synthetic data be used to share datasets across institutions?

Yes, synthetic data can be used to share datasets across institutions, and this is one of its most compelling practical advantages in university research. Because synthetic datasets contain no directly identifiable personal information, they can be distributed to collaborators, shared with out-of-institution researchers, and published for broad academic use with fewer governance barriers than real data. Multiple public synthetic health datasets are already available for open research use through bodies such as the NIH and the UK’s Clinical Practice Research Datalink.

However, sharing synthetic data across institutions is not governance-free. The real data that a synthetic dataset was modeled on still requires proper governance approval before generation can take place. Researchers cannot bypass access controls on the original data simply by generating a synthetic version of it. Typical governance frameworks for secondary processing of healthcare data still apply at the point of generation, even if the resulting synthetic dataset can then be shared more freely.

A further complication is the absence of a standardized approach to synthetic data governance across institutions and jurisdictions. Researchers may encounter inconsistencies in how different universities, hospitals, or data custodians define acceptable use, access controls, and infrastructure requirements for synthetic data. The EU’s European Health Data Space Regulation, which begins applying from 2027, explicitly names synthetic data as a tool for supporting secondary use of health data, but detailed governance provisions remain an active policy gap.

The emerging consensus in biomedical research is that synthetic data and federated data networks work best as complementary tools: synthetic data enables broad sharing of representative datasets, while federated approaches allow analysis to occur where the real data lives. For cross-institutional academic research, combining both approaches offers the strongest combination of privacy protection and analytical utility.

What are the limitations of synthetic data that ethics boards flag?

Ethics boards flag several substantive limitations of synthetic data, the most significant being residual privacy risk, potential bias, and questions about validity. Synthetic data is not inherently free from disclosure risks, and regulatory guidance from the UK, Singapore, and South Korea all explicitly state that thresholds for sufficiently low re-identification risk have not yet been established. Treating synthetic data as a technical fix that resolves all privacy concerns is a position ethics reviewers are increasingly pushing back on.

Residual privacy risk and the fidelity trade-off

The closer a synthetic dataset resembles the original, the more useful it is for research, but also the higher the risk that individuals in the source data could be re-identified. This privacy-fidelity trade-off is a structural limitation of synthetic data generation, not a problem that better tools alone can eliminate. Ethics boards are right to ask for formal privacy assessments, including membership inference and attribute inference testing, rather than accepting synthetic status as a privacy guarantee.

Bias, fairness, and validity concerns

A second category of limitations relates to fairness and research validity. Synthetic data generation tools can produce datasets where statistical fidelity varies across demographic subgroups, meaning some populations are represented less accurately than others. Applying differential privacy protections can worsen this effect, because the noise added to protect privacy does not distribute evenly across all subgroups. For research that informs clinical decisions or public policy, this kind of representational bias is a serious ethical concern.

Beyond bias, ethics boards also raise questions about whether synthetic data is valid for hypothesis testing and model training when it lacks a direct empirical link to reality. Without standardized benchmarks for evaluating synthetic data quality, it is difficult for reviewers to assess whether a given dataset is fit for its intended purpose. The absence of full disclosure about generation methods and validation procedures compounds this problem, potentially misleading other researchers about the reliability of findings built on synthetic foundations.

How should researchers document synthetic data generation for ethics submissions?

Researchers should document synthetic data generation for ethics submissions by providing four core elements: a clear description of the generation method and its parameters, a separate re-identification risk assessment, fidelity metrics appropriate to the data type, and a utility validation demonstrating that the synthetic data is fit for the intended research task. Synthetic status alone is not a privacy guarantee, and ethics boards increasingly expect documentation that treats it as such.

The CASRAI Synthetic Data in Research guide, updated in mid-2026, is one of the most practical current resources for researchers preparing this documentation. It recommends keeping the re-identification risk assessment separate from the generation method description, reporting which fidelity metrics were used and why they suit the specific data type, and including a train-on-synthetic, test-on-real validation if the synthetic data is intended to substitute for real data in a downstream task.

Privacy penetration testing is another documentation element that ethics reviewers are beginning to expect. This involves conducting formal privacy attacks, specifically membership inference and attribute inference tests, to assess whether the synthetic dataset could be used to extract information about individuals in the original training data. The results of this testing, along with the steps taken to mitigate identified risks, should be included in the submission.

One practical challenge is that there is no single standardized fidelity benchmark across research domains. A metric appropriate for evaluating synthetic medical imaging data does not transfer directly to tabular clinical records or synthetic text. Researchers should match their validation approach to their specific data type and be explicit about this choice in their documentation. Continuous monitoring and regular validation after generation, not just at the point of submission, are also considered best practice for maintaining transparency throughout a research project.

If you are navigating ethics board requirements and want to see how a structured synthetic data platform can make the documentation process more straightforward, we invite you to explore what we offer through a demo with our team.

window.addEventListener(‘scroll’, function() { var bar = document.getElementById(‘sticky-cta’); if (window.scrollY > 600) { bar.style.display = ‘block’; } else { bar.style.display = ‘none’; } });