This is a description of why synthetic generation changes the shape of the compliance question. It is not legal advice, and it is not a substitute for review by a qualified adviser in your jurisdiction.
Saudi Arabia's Personal Data Protection Law applies to personal data — data relating to an identified or identifiable natural person. Text that was generated rather than collected, about people who do not exist, has no data subject. That does not make compliance automatic; it changes which question you have to answer.
What the distinction actually removes
Most of the difficult obligations around a training corpus attach to there being a person behind the data. With collected text you have to be able to answer:
- What was the lawful basis for processing this?
- Were the individuals informed?
- Can a subject access, correct, or request deletion of their data?
- Where is it transferred, and under what conditions?
- What is the retention period?
Each of those questions presupposes an identifiable person. When the corpus contains no real individuals, the questions do not resolve favourably — they stop applying, because the subject-matter trigger is absent.
That is a materially different position from "we anonymised it", which remains a processing activity performed on personal data, and which invites an argument about whether the anonymisation is robust.
Where synthetic corpora actually leak
"Synthetic" is a claim about provenance, and it is only as good as the weakest link in the pipeline. The realistic failure modes:
Seeded from real records. If your generator was conditioned on real customer transcripts — even just to extract a topic distribution — the output may carry identifying detail. A conversation rephrased from a real one is not synthetic in any sense that helps you.
Memorisation from the base model. A general model asked for a plausible Saudi name and national ID may produce a real pairing. Real-looking identifiers are the risk, not names on their own.
Real brands and real people. A generated conversation naming an actual company and an actual named employee is not about a fictional person.
Free-text fields nobody validated. The parts of a row that are not the main content — internal notes, debug fields, error logs — are where unreviewed text survives.
What "synthetic all the way down" requires in practice
| Requirement | Why |
|---|---|
| No real records as seed or few-shot content | Otherwise output is derived from personal data |
| Invented brands, not real ones | A real brand plus a named agent identifies someone |
| Identifiers generated to be structurally invalid | A valid-format national ID may collide with a real one |
| Amounts, dates and reference numbers drawn from generators | Not copied from anywhere |
| Every field checked, not just the main text | Debug fields are where real strings hide |
| PII detectors run over output as a backstop | Catches base-model memorisation |
The point of the last row is that your own intentions are not evidence. A detection pass over the finished corpus is what lets you state a number.
What to be able to show
If someone asks whether your corpus is safe to use, the useful artefacts are:
- A statement of provenance: what the generator was conditioned on, explicitly including the absence of real records
- The identifier policy: how names, IDs, phone numbers and references were produced, and why they cannot collide with real ones
- A detection result: what you scanned the output for, and what you found — ideally zero, stated with the method
- The brand policy: that entities are invented, with the list
That is a short document, and it is far stronger than an assertion that the data is synthetic.
The honest caveat
Regulatory interpretation of synthetic data is still developing, in Saudi Arabia and elsewhere, and "no data subject" is a position about the facts rather than a safe harbour someone has granted you. Organisations in regulated sectors should expect to evidence the provenance claim, not merely make it — which is the practical reason to build the artefacts above while you generate rather than afterwards.