Five Safes Framework

• Five Safes is a framework that manages disclosure risk by assessing data sharing along five dimensions: Safe People, Safe Projects, Safe Settings, Safe Data, and Safe Outputs.
• It integrates legal, technical, and procedural controls to ensure that data dissemination meets rigorous risk management and public-interest criteria.
• Critics argue that while useful, the framework needs more robust technical metrics and dynamic, legally anchored reassessments to address evolving risks.

Searching arXiv for recent and foundational papers on the Five Safes, contextual integrity, and differential privacy in official statistics. The Five Safes is a framework used by national statistical offices (NSO) for assessing and managing the disclosure risk of data sharing. At its core, the framework decomposes the confidentiality risk of any statistical data-sharing or dissemination mode into five conceptually distinct axes—Safe People, Safe Projects, Safe Settings, Safe Data, and Safe Outputs—and an NSO manages risk by choosing configurations along each axis (Bailie et al., 7 Oct 2025). The framework has also been presented as a specialization of contextual integrity to the situation of statistical dissemination by an NSO, and as a way to contextualize narrow, technical notions of privacy, including differential privacy (DP), within a holistic risk assessment (Bailie et al., 7 Oct 2025). At the same time, critical legal and technical scholarship argues that the framework is fundamentally flawed in its present form, particularly in its treatment of legal protections, technical rigor, temporal dynamics of disclosure risk, and public-interest accountability (Culnane et al., 2020).

1. Definition and constituent dimensions

The Five Safes emerged as a model for managing the myriad risks associated with sharing data derived from personal information. The framework first emerged in the mid-2010s, notably through the work of Tanvi Desai, Felix Ritchie and Richard Welpton at the University of the West of England, in Five Safes: designing data access for research, UWE Economics Working Paper Series 1601, 2016 (Culnane et al., 2020). Rather than attempting a purely technical or purely legal solution, it proposes that disclosure risk can be understood and mitigated along five complementary dimensions (Culnane et al., 2020).

The five dimensions are defined as follows. Safe People asks who is allowed to see or handle the data; in practice this means vetting individuals or organizations to ensure they are trustworthy, understand research ethics, and agree to confidentiality rules (Bailie et al., 7 Oct 2025). Safe Projects asks for what purpose the data is being used; the office checks that proposed analyses are legitimate, socially valuable, and in compliance with legal or regulatory restrictions on usage (Bailie et al., 7 Oct 2025). Safe Settings concerns the technical or physical environment in which access occurs, ranging from open public web downloads to secure physical Research Data Centers or virtual enclaves, with controls against unauthorized copying, linkage or exfiltration (Bailie et al., 7 Oct 2025). Safe Data concerns what data items, variables or records are exposed, including subsampling, omission of high-risk variables, recoding, top-coding, and, more formally, any steps that change the input dataset before analysis (Bailie et al., 7 Oct 2025). Safe Outputs concerns what results are released, with screening of tables, regressions, or maps—by hand or by an automated procedure—to ensure that they do not inadvertently disclose sensitive information such as tiny cell counts or exact unique combinations (Bailie et al., 7 Oct 2025).

These axes are explicitly interdependent. A very tightly controlled Safe People regime may allow more granular Safe Data, whereas fully open Safe Settings typically demand very coarse Safe Outputs (Bailie et al., 7 Oct 2025). This suggests that the Five Safes is not a set of independent binary conditions but a configuration space in which disclosure control is achieved through trade-offs across organizational, technical, and procedural controls.

2. Historical uptake and policy embedding

By 2017–2019, the Five Safes framework had been incorporated by major statistical and data-holding bodies in Australia, New Zealand and the UK, both as non-binding policy and, uniquely in South Australia, as legislated requirement (Culnane et al., 2020). In Australia, the Australian Bureau of Statistics’ Confidentiality Series 1160.0 (“Managing the Risk of Disclosure: The Five Safes Framework,” August 2017) endorses the model as best practice (Culnane et al., 2020). The Office of the National Data Commissioner’s March 2019 Data Sharing Principles explicitly restate all five safes as its core assurances, and the Australian Institute of Health and Welfare, CSIRO via its De-identification Decision-Making Framework (2017), Data.NSW’s June 2019 Data Sharing Principles, and the Victorian Government’s data-security guidelines also drew on the framework (Culnane et al., 2020).

On the legislative front, South Australia’s Public Sector (Data Sharing) Act 2016 (s 7) formally embeds the Five Safes in law, which is described as remarkable in a state lacking standalone public sector privacy legislation (Culnane et al., 2020). At the Commonwealth level, the October 2020 exposure draft of the Data Availability and Transparency Bill signals a move to give the Five Safes “legal grounds” for data sharing across federal agencies (Culnane et al., 2020). In the UK, the Office for National Statistics and wider research infrastructure adopted the Five Safes in designing Secure Research Environments, again appealing to the five-dimension model as the means to open de-identified data for social and economic research (Culnane et al., 2020).

This pattern of adoption indicates that the framework has functioned both as an operational vocabulary for disclosure risk management and as an institutional policy instrument. A plausible implication is that its influence derives partly from its ability to bridge heterogeneous domains—research governance, legal compliance, IT security, and statistical disclosure control—without reducing any one of them to a single metric.

3. Contextual integrity as an interpretive framework

A central recent interpretation treats the Five Safes as a specialization of contextual integrity to the specific setting of statistical dissemination by an NSO (Bailie et al., 7 Oct 2025). Contextual Integrity (CI), as developed by Nissenbaum and others, holds that a data flow is appropriate if it respects five parameters of informational norms: sender, recipient, subject, information type, and transmission principles (Bailie et al., 7 Oct 2025). When the relevant flow is statistical dissemination, these parameters align, imperfectly but usefully, with the dimensions of the Five Safes (Bailie et al., 7 Oct 2025).

CI parameter	Five Safes dimension(s)
Sender	the NSO or data custodian
Recipient	Safe People
Subject	component of Safe Data
Information type	component of Safe Data and Safe Outputs
Transmission principles	Safe Projects + Safe Settings

In this mapping, the sender is the office that holds the confidential database and initiates dissemination; the recipient is either approved researchers or the entire public; the subject is the individuals or entities described by the database; the information type is the nature of the facts shared, such as age, income, or employment; and the transmission principles are the constellation of purpose-limitations, legal conditions, security requirements, ethical norms, and vetting rules that govern the flow (Bailie et al., 7 Oct 2025). Transmission principles therefore map to both Safe Projects and Safe Settings, while information type spans both Safe Data and Safe Outputs (Bailie et al., 7 Oct 2025).

Viewing the Five Safes through the CI lens permits recourse to a richer literature when novel or borderline cases arise, such as a novel form of data linkage or a cross-border data sharing agreement (Bailie et al., 7 Oct 2025). This suggests that the framework can be interpreted not merely as a checklist of controls but as a context-sensitive normative schema for assessing appropriateness of statistical data flows.

4. Differential privacy within the Five Safes

Differential privacy is presented as a mathematically rigorous guarantee that an algorithm’s output does not depend too strongly on any one record in the input (Bailie et al., 7 Oct 2025). A unified statement is given in terms of a domain of protected datasets $X$, a dataset metric $d_X(x,x')$, a randomized mechanism $T$, a distributional distance $d_{Pr}(P^1,P^2)$ over outputs, and a privacy-loss budget $\epsilon \ge 0$ (Bailie et al., 7 Oct 2025). The definition is:

$$\Pr[T(x)\in S] \le \exp(\epsilon \cdot d_X(x,x')) \cdot \Pr[T(x')\in S]$$

for every pair $x,x' \in X$ and every measurable event $S$ in the output space (Bailie et al., 7 Oct 2025). Equivalently,

$$d_{Pr}(\mathrm{Law}[T(x)], \mathrm{Law}[T(x')]) \le \epsilon \cdot d_X(x,x').$$

A more conventional form also appears in the critical literature: for all data sets $D_1, D_2$ differing in at most one record and all measurable subsets $d_X(x,x')$0 of the output space,

$d_X(x,x')$1

(Culnane et al., 2020)

Within the Five Safes, DP is said to directly measure the “safety” of two axes: Safe Data, by defining precisely how input perturbations or data grouping affect outputs, and Safe Outputs, by bounding the risk that any released statistic exposes individual records (Bailie et al., 7 Oct 2025). It can be applied at the dissemination stage by adding Laplace or Gaussian noise or releasing a DP synthetic dataset, so that open-data files or enclave exports carry an explicit $d_X(x,x')$2 guarantee (Bailie et al., 7 Oct 2025). Through composition theorems, an NSO can budget an overall $d_X(x,x')$3 across multiple queries or projects, supporting transparent privacy accounting and trade-offs among Safe Outputs across Safe Projects (Bailie et al., 7 Oct 2025).

The framework also clarifies what DP does not do. It says nothing about Safe People, does not judge purpose or legality under Safe Projects, does not enforce how algorithms run or how outputs are stored or transmitted under Safe Settings, and treats all numeric data as equally risky unless the NSO encodes domain-specific sensitivity via $d_X(x,x')$4 (Bailie et al., 7 Oct 2025). This characterization places DP as a formal component inside a broader governance structure rather than as a substitute for that structure.

5. Operational configurations and dissemination modes

The Five Safes is presented as a toolkit that can be configured differently across dissemination modes (Bailie et al., 7 Oct 2025). In public-use data files (open data), Safe People is “none” and Safe Settings is “fully open,” so Safe Data and Safe Outputs must be heavily aggregated or top-coded (Bailie et al., 7 Oct 2025). An NSO might layer on an $d_X(x,x')$5-DP mechanism so that microdata tables are perturbed with calibrated noise, using Laplace or Gaussian mechanisms, allowing open release while still giving a quantifiable privacy guarantee (Bailie et al., 7 Oct 2025).

In secure research data centers (enclaves), researchers and projects are tightly vetted and settings are locked down rooms or remote desktops (Bailie et al., 7 Oct 2025). In many cases NSOs still apply additional DP to all extracts leaving the enclave, which lets them relax some of the manual Safe Outputs review while still meeting a global $d_X(x,x')$6 budget (Bailie et al., 7 Oct 2025). This implies that high-assurance access environments do not eliminate the need for output-side privacy controls, but alter the balance between procedural review and formal release mechanisms.

A third model is synthetic data plus validation servers, illustrated by SIPP Synthetic Beta (Bailie et al., 7 Oct 2025). The NSO publishes a DP-synthesized microdata file that researchers may freely use; researchers then submit code for analysis, the NSO runs it on the confidential “Gold Standard File” in a locked enclave, and applies an $d_X(x,x')$7-DP mechanism to the final tables before releasing them (Bailie et al., 7 Oct 2025). This two-tier approach combines high utility in local experiments on synthetic data with a formal DP screen on every public output, balancing Safe Data, Safe Outputs, and Safe Settings (Bailie et al., 7 Oct 2025).

These examples show that no individual “safe” is decisive in isolation. Rather, disclosure risk management is achieved through different allocations of control across access vetting, purpose limitation, execution environment, input transformation, and output release.

6. Regulation, social norms, and criticism

Every dimension of the Five Safes is shaped by law, policy, or prevailing social and ethical norms (Bailie et al., 7 Oct 2025). For Safe People, relevant instruments include data-use agreements, institutional review boards, and professional codes of conduct; under GDPR or the US Confidential Information Protection and Statistical Efficiency Act, only designated “authorized persons” may see identifiable data (Bailie et al., 7 Oct 2025). For Safe Projects, legal mandates often limit use to policy-relevant research or public interest, while norms in the academic community demand reproducibility and data-sharing, pushing NSOs toward transparent Safe Settings and more open Safe Data, including DP-protected data (Bailie et al., 7 Oct 2025). For Safe Settings, relevant standards include ISO 27001, FISMA, accreditation rules for physical RDCs, and approved cloud-provider policies (Bailie et al., 7 Oct 2025). For Safe Data, certain variables may be classified as sensitive, such as health, ethnicity, and religion, requiring stronger de-identification or higher DP weight (Bailie et al., 7 Oct 2025). For Safe Outputs, applicable rules include minimum cell sizes $d_X(x,x')$8, forced suppression rules, and automated DP release systems (Bailie et al., 7 Oct 2025).

The critical analysis by Culnane, Rubinstein and Watts identifies four fundamental flaws in the framework as adopted in practice (Culnane et al., 2020). First, they argue that it is disconnected from existing legal protections, overlaying an ambiguous “safety” vocabulary without reconciling it with statutory definitions of “personal information” and “de-identified” information under Australian law (Culnane et al., 2020). The statutory definitions quoted are those in section 6(1) of the Privacy Act 1988 (Cth): “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, and information is “de-identified” if it is no longer about an identifiable individual or an individual who is reasonably identifiable (Culnane et al., 2020).

Second, they argue that the framework lacks any preference for or specification of strong technical measures (Culnane et al., 2020). The academic literature has developed formal privacy metrics—$d_X(x,x')$9-anonymity, $T$0-diversity, and $T$1-differential privacy—but none of these appear in the Five Safes framework itself, and the framework offers no mechanism by which an agency might choose or calibrate $T$2 (Culnane et al., 2020). Third, the critique holds that the framework treats disclosure risk as static through time and does not require repeat assessment, even though new auxiliary data, increasing computational power, and drift in use context all change the threat model (Culnane et al., 2020). Fourth, the critique argues that the framework contains no hard guardrails tying data release obligations to demonstrable public benefits, thereby supplying little accountability for ensuring that downstream uses align with genuine public interests (Culnane et al., 2020).

The authors recommend anchoring data-sharing policy firmly in existing legal protections, elevating robust, quantifiable technical measures such as differential privacy, secure multiparty computation or strong encryption, implementing continuous, lifecycle-wide risk management with periodic re-assessments, embedding clear accountability for public-interest outcomes, and resisting the temptation to “add more safes” without shoring up structural dependencies (Culnane et al., 2020). This suggests an unresolved tension between the Five Safes as a pragmatic governance framework and the demand for formally specified, continuously updated, and legally integrated privacy assurance.

7. Significance and conceptual limits

The Five Safes and contextual integrity together provide a structured lens through which to understand every data-sharing decision as a tuning of five levers—people, projects, settings, data, and outputs—under broader legal and ethical transmission principles (Bailie et al., 7 Oct 2025). Differential privacy fits into this structure as a rigorous means of quantifying and budgeting the risk that a data or output choice leaks individual information, but it occupies only part of the overall framework (Bailie et al., 7 Oct 2025). No single Safe guarantees privacy alone; privacy protection depends on how the dimensions are woven together with social norms, laws, and formal technical tools (Bailie et al., 7 Oct 2025).

The critical literature, however, rejects any interpretation of “safe” as an absolute state (Culnane et al., 2020). By suggesting that safety can be declared rather than continuously interrogated, the framework may obscure the adversarial and dynamic nature of disclosure risk (Culnane et al., 2020). A plausible implication is that the enduring value of the Five Safes lies less in the literal semantics of “safety” than in its role as a vocabulary for structured deliberation. In that reading, its adequacy depends on whether institutions supplement it with formal threat modeling, quantitative privacy mechanisms, lifecycle-wide reassessment, and explicit linkage to legal and public-interest constraints.