Synthetic Data

Explanation

Synthetic Data checks that, wherever possible, sensitive real customer records are replaced with artificially generated stand-ins when evaluating AI systems in regulated domains, so that testing and benchmarking do not expose genuine personal or financial data. This matters for banks because evaluation datasets are frequently copied, shared, and stored, multiplying the exposure of real KYC, account, and transaction details used in Document Extraction and RAG. It is measured by the Synthetic Data Substitution Rate - the proportion of records in a sensitive-domain evaluation set that are synthetic rather than real. To implement it, generate statistically representative synthetic data that preserves the structure and distribution of production data without copying real individuals, route sensitive-domain evaluations to these synthetic sets, and log the substitution rate per evaluation run together with provenance showing which fields were synthesised. The threshold is at least 80% synthetic for sensitive-domain evaluation, supporting data-minimisation principles under RBI Data Privacy, NIST MEASURE 2.10, and ISO Annex A. If an evaluation set falls below 80% synthetic content, the control should flag it, require justification for any real data used, and prompt remediation - typically regenerating or expanding the synthetic portion before the evaluation is accepted as compliant.