---
title: Five Safes Framework
url: https://www.emergentmind.com/topics/five-safes
type: topic
---

# Five Safes Framework

Searching arXiv for recent and foundational papers on the Five Safes, contextual integrity, and differential privacy in official statistics.
The Five Safes is a framework used by national statistical offices (NSO) for assessing and managing the disclosure risk of data sharing. At its core, the framework decomposes the confidentiality risk of any statistical data-sharing or dissemination mode into five conceptually distinct axes—Safe People, Safe Projects, Safe Settings, Safe Data, and Safe Outputs—and an NSO manages risk by choosing configurations along each axis [2510.05803]. The framework has also been presented as a specialization of contextual integrity to the situation of statistical dissemination by an NSO, and as a way to contextualize narrow, technical notions of privacy, including differential privacy (DP), within a holistic risk assessment [2510.05803]. At the same time, critical legal and technical scholarship argues that the framework is fundamentally flawed in its present form, particularly in its treatment of legal protections, technical rigor, temporal dynamics of disclosure risk, and public-interest accountability [2011.02142].

## 1. Definition and constituent dimensions

The Five Safes emerged as a model for managing the myriad risks associated with sharing data derived from personal information. The framework first emerged in the mid-2010s, notably through the work of Tanvi Desai, Felix Ritchie and Richard Welpton at the University of the West of England, in *Five Safes: designing data access for research, UWE Economics Working Paper Series 1601, 2016* [2011.02142]. Rather than attempting a purely technical or purely legal solution, it proposes that disclosure risk can be understood and mitigated along five complementary dimensions [2011.02142].

The five dimensions are defined as follows. **Safe People** asks who is allowed to see or handle the data; in practice this means vetting individuals or organizations to ensure they are trustworthy, understand research ethics, and agree to confidentiality rules [2510.05803]. **Safe Projects** asks for what purpose the data is being used; the office checks that proposed analyses are legitimate, socially valuable, and in compliance with legal or regulatory restrictions on usage [2510.05803]. **Safe Settings** concerns the technical or physical environment in which access occurs, ranging from open public web downloads to secure physical Research Data Centers or virtual enclaves, with controls against unauthorized copying, linkage or exfiltration [2510.05803]. **Safe Data** concerns what data items, variables or records are exposed, including subsampling, omission of high-risk variables, recoding, top-coding, and, more formally, any steps that change the input dataset before analysis [2510.05803]. **Safe Outputs** concerns what results are released, with screening of tables, regressions, or maps—by hand or by an automated procedure—to ensure that they do not inadvertently disclose sensitive information such as tiny cell counts or exact unique combinations [2510.05803].

These axes are explicitly interdependent. A very tightly controlled Safe People regime may allow more granular Safe Data, whereas fully open Safe Settings typically demand very coarse Safe Outputs [2510.05803]. This suggests that the Five Safes is not a set of independent binary conditions but a configuration space in which disclosure control is achieved through trade-offs across organizational, technical, and procedural controls.

## 2. Historical uptake and policy embedding

By 2017–2019, the Five Safes framework had been incorporated by major statistical and data-holding bodies in Australia, New Zealand and the UK, both as non-binding policy and, uniquely in South Australia, as legislated requirement [2011.02142]. In Australia, the Australian Bureau of Statistics’ *Confidentiality Series 1160.0 (“Managing the Risk of Disclosure: The Five Safes Framework,” August 2017)* endorses the model as best practice [2011.02142]. The Office of the National Data Commissioner’s March 2019 *Data Sharing Principles* explicitly restate all five safes as its core assurances, and the Australian Institute of Health and Welfare, CSIRO via its *De-identification Decision-Making Framework* (2017), Data.NSW’s June 2019 *Data Sharing Principles*, and the Victorian Government’s data-security guidelines also drew on the framework [2011.02142].

On the legislative front, South Australia’s *Public Sector (Data Sharing) Act 2016 (s 7)* formally embeds the Five Safes in law, which is described as remarkable in a state lacking standalone public sector privacy legislation [2011.02142]. At the Commonwealth level, the October 2020 exposure draft of the *Data Availability and Transparency Bill* signals a move to give the Five Safes “legal grounds” for data sharing across federal agencies [2011.02142]. In the UK, the Office for National Statistics and wider research infrastructure adopted the Five Safes in designing Secure Research Environments, again appealing to the five-dimension model as the means to open de-identified data for social and economic research [2011.02142].

This pattern of adoption indicates that the framework has functioned both as an operational vocabulary for disclosure risk management and as an institutional policy instrument. A plausible implication is that its influence derives partly from its ability to bridge heterogeneous domains—research governance, legal compliance, IT security, and statistical disclosure control—without reducing any one of them to a single metric.

## 3. Contextual integrity as an interpretive framework

A central recent interpretation treats the Five Safes as a specialization of contextual integrity to the specific setting of statistical dissemination by an NSO [2510.05803]. Contextual Integrity (CI), as developed by Nissenbaum and others, holds that a data flow is appropriate if it respects five parameters of informational norms: sender, recipient, subject, information type, and transmission principles [2510.05803]. When the relevant flow is statistical dissemination, these parameters align, imperfectly but usefully, with the dimensions of the Five Safes [2510.05803].

| CI parameter | Five Safes dimension(s) |
|---|---|
| Sender | the NSO or data custodian |
| Recipient | Safe People |
| Subject | component of Safe Data |
| Information type | component of Safe Data and Safe Outputs |
| Transmission principles | Safe Projects + Safe Settings |

In this mapping, the **sender** is the office that holds the confidential database and initiates dissemination; the **recipient** is either approved researchers or the entire public; the **subject** is the individuals or entities described by the database; the **information type** is the nature of the facts shared, such as age, income, or employment; and the **transmission principles** are the constellation of purpose-limitations, legal conditions, security requirements, ethical norms, and vetting rules that govern the flow [2510.05803]. Transmission principles therefore map to both Safe Projects and Safe Settings, while information type spans both Safe Data and Safe Outputs [2510.05803].

Viewing the Five Safes through the CI lens permits recourse to a richer literature when novel or borderline cases arise, such as a novel form of data linkage or a cross-border data sharing agreement [2510.05803]. This suggests that the framework can be interpreted not merely as a checklist of controls but as a context-sensitive normative schema for assessing appropriateness of statistical data flows.

## 4. Differential privacy within the Five Safes

Differential privacy is presented as a mathematically rigorous guarantee that an algorithm’s output does not depend too strongly on any one record in the input [2510.05803]. A unified statement is given in terms of a domain of protected datasets $X$, a dataset metric $d_X(x,x')$, a randomized mechanism $T$, a distributional distance $d_{Pr}(P^1,P^2)$ over outputs, and a privacy-loss budget $\epsilon \ge 0$ [2510.05803]. The definition is:

$$
\Pr[T(x)\in S] \le \exp(\epsilon \cdot d_X(x,x')) \cdot \Pr[T(x')\in S]
$$

for every pair $x,x' \in X$ and every measurable event $S$ in the output space [2510.05803]. Equivalently,

$$
d_{Pr}(\mathrm{Law}[T(x)], \mathrm{Law}[T(x')]) \le \epsilon \cdot d_X(x,x').
$$

A more conventional form also appears in the critical literature: for all data sets $D_1, D_2$ differing in at most one record and all measurable subsets $S$ of the output space,

$$
\Pr[M(D_1)\in S] \le e^\epsilon \cdot \Pr[M(D_2)\in S].
$$

[2011.02142]

Within the Five Safes, DP is said to directly measure the “safety” of two axes: **Safe Data**, by defining precisely how input perturbations or data grouping affect outputs, and **Safe Outputs**, by bounding the risk that any released statistic exposes individual records [2510.05803]. It can be applied at the dissemination stage by adding Laplace or Gaussian noise or releasing a DP synthetic dataset, so that open-data files or enclave exports carry an explicit $\epsilon$ guarantee [2510.05803]. Through composition theorems, an NSO can budget an overall $\epsilon$ across multiple queries or projects, supporting transparent privacy accounting and trade-offs among Safe Outputs across Safe Projects [2510.05803].

The framework also clarifies what DP does not do. It says nothing about **Safe People**, does not judge purpose or legality under **Safe Projects**, does not enforce how algorithms run or how outputs are stored or transmitted under **Safe Settings**, and treats all numeric data as equally risky unless the NSO encodes domain-specific sensitivity via $d_X$ [2510.05803]. This characterization places DP as a formal component inside a broader governance structure rather than as a substitute for that structure.

## 5. Operational configurations and dissemination modes

The Five Safes is presented as a toolkit that can be configured differently across dissemination modes [2510.05803]. In **public-use data files (open data)**, Safe People is “none” and Safe Settings is “fully open,” so Safe Data and Safe Outputs must be heavily aggregated or top-coded [2510.05803]. An NSO might layer on an $\epsilon$-DP mechanism so that microdata tables are perturbed with calibrated noise, using Laplace or Gaussian mechanisms, allowing open release while still giving a quantifiable privacy guarantee [2510.05803].

In **secure research data centers (enclaves)**, researchers and projects are tightly vetted and settings are locked down rooms or remote desktops [2510.05803]. In many cases NSOs still apply additional DP to all extracts leaving the enclave, which lets them relax some of the manual Safe Outputs review while still meeting a global $\epsilon$ budget [2510.05803]. This implies that high-assurance access environments do not eliminate the need for output-side privacy controls, but alter the balance between procedural review and formal release mechanisms.

A third model is **synthetic data plus validation servers**, illustrated by *SIPP Synthetic Beta* [2510.05803]. The NSO publishes a DP-synthesized microdata file that researchers may freely use; researchers then submit code for analysis, the NSO runs it on the confidential “Gold Standard File” in a locked enclave, and applies an $\epsilon$-DP mechanism to the final tables before releasing them [2510.05803]. This two-tier approach combines high utility in local experiments on synthetic data with a formal DP screen on every public output, balancing Safe Data, Safe Outputs, and Safe Settings [2510.05803].

These examples show that no individual “safe” is decisive in isolation. Rather, disclosure risk management is achieved through different allocations of control across access vetting, purpose limitation, execution environment, input transformation, and output release.

## 6. Regulation, social norms, and criticism

Every dimension of the Five Safes is shaped by law, policy, or prevailing social and ethical norms [2510.05803]. For **Safe People**, relevant instruments include data-use agreements, institutional review boards, and professional codes of conduct; under GDPR or the US Confidential Information Protection and Statistical Efficiency Act, only designated “authorized persons” may see identifiable data [2510.05803]. For **Safe Projects**, legal mandates often limit use to policy-relevant research or public interest, while norms in the academic community demand reproducibility and data-sharing, pushing NSOs toward transparent Safe Settings and more open Safe Data, including DP-protected data [2510.05803]. For **Safe Settings**, relevant standards include ISO 27001, FISMA, accreditation rules for physical RDCs, and approved cloud-provider policies [2510.05803]. For **Safe Data**, certain variables may be classified as sensitive, such as health, ethnicity, and religion, requiring stronger de-identification or higher DP weight [2510.05803]. For **Safe Outputs**, applicable rules include minimum cell sizes $\ge 5$, forced suppression rules, and automated DP release systems [2510.05803].

The critical analysis by Culnane, Rubinstein and Watts identifies four fundamental flaws in the framework as adopted in practice [2011.02142]. First, they argue that it is disconnected from existing legal protections, overlaying an ambiguous “safety” vocabulary without reconciling it with statutory definitions of “personal information” and “de-identified” information under Australian law [2011.02142]. The statutory definitions quoted are those in section 6(1) of the *Privacy Act 1988 (Cth)*: “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, and information is “de-identified” if it is no longer about an identifiable individual or an individual who is reasonably identifiable [2011.02142].

Second, they argue that the framework lacks any preference for or specification of strong technical measures [2011.02142]. The academic literature has developed formal privacy metrics—$k$-anonymity, $l$-diversity, and $\epsilon$-differential privacy—but none of these appear in the Five Safes framework itself, and the framework offers no mechanism by which an agency might choose or calibrate $\epsilon$ [2011.02142]. Third, the critique holds that the framework treats disclosure risk as static through time and does not require repeat assessment, even though new auxiliary data, increasing computational power, and drift in use context all change the threat model [2011.02142]. Fourth, the critique argues that the framework contains no hard guardrails tying data release obligations to demonstrable public benefits, thereby supplying little accountability for ensuring that downstream uses align with genuine public interests [2011.02142].

The authors recommend anchoring data-sharing policy firmly in existing legal protections, elevating robust, quantifiable technical measures such as differential privacy, secure multiparty computation or strong encryption, implementing continuous, lifecycle-wide risk management with periodic re-assessments, embedding clear accountability for public-interest outcomes, and resisting the temptation to “add more safes” without shoring up structural dependencies [2011.02142]. This suggests an unresolved tension between the Five Safes as a pragmatic governance framework and the demand for formally specified, continuously updated, and legally integrated privacy assurance.

## 7. Significance and conceptual limits

The Five Safes and contextual integrity together provide a structured lens through which to understand every data-sharing decision as a tuning of five levers—people, projects, settings, data, and outputs—under broader legal and ethical transmission principles [2510.05803]. Differential privacy fits into this structure as a rigorous means of quantifying and budgeting the risk that a data or output choice leaks individual information, but it occupies only part of the overall framework [2510.05803]. No single Safe guarantees privacy alone; privacy protection depends on how the dimensions are woven together with social norms, laws, and formal technical tools [2510.05803].

The critical literature, however, rejects any interpretation of “safe” as an absolute state [2011.02142]. By suggesting that safety can be declared rather than continuously interrogated, the framework may obscure the adversarial and dynamic nature of disclosure risk [2011.02142]. A plausible implication is that the enduring value of the Five Safes lies less in the literal semantics of “safety” than in its role as a vocabulary for structured deliberation. In that reading, its adequacy depends on whether institutions supplement it with formal threat modeling, quantitative privacy mechanisms, lifecycle-wide reassessment, and explicit linkage to legal and public-interest constraints.

Source: https://www.emergentmind.com/topics/five-safes