Synthetic Data Compliance Framework (SDCF): A Purpose-Bounded Methodology for Assessing Synthetic Data Privacy, Fidelity, and Fairness

RETIREMENT NOTICE — 30 August 2026 Claims in this record have been retired by the author. The deposited file is retained unaltered for citation continuity and audit reference. The record should not be relied on as a current specification. Specifically retired: The composite Privacy Risk Score (B-PRS) as a weighted aggregate of sub-metrics. The preliminary Bronze Tier evaluation across ten synthetic datasets reported below and in the deposited file, including the 60% Restricted classification rate and the B-PRS range of 9 to 79. These results are not reinstated. This notice is limited to the claims listed above and makes no assertion about the remaining content of the record. No currently public document replaces this record. Synthetic data is increasingly adopted for privacy-preserving analytics, data sharing, and AI model development in regulated environments. However, organisations lack standardised methodologies for determining whether synthetic datasets satisfy regulatory expectations for privacy protection, statistical utility, and fairness. This paper presents the Synthetic Data Compliance Framework (SDCF), a purpose-bounded assessment methodology connecting quantitative metrics to regulatory requirements under GDPR, the EU AI Act, and relevant ISO/IEC and NIST standards. SDCF introduces a tiered assessment architecture (Gold, Silver, Bronze) based on source data accessibility, with composite metrics for Privacy Risk Score (PRS), Fidelity Index (FI), and Fairness Variance (FV). Preliminary empirical evaluation of the Bronze Tier methodology across ten heterogeneous synthetic datasets demonstrates conservative risk classification (60% Restricted outcome), meaningful quality discrimination (B-PRS range: 9 to 79), and cross-domain applicability.