Synthetic Malaysians still
came from somewhere.

Where the data comes from

The public answer is reasonably clear. The builders list the Department of Statistics, OpenDOSM, MyCensus, eStatistik and the national labour-force publications. From those they built 150,000 base records and expanded them into 1.35 million personas, each with 39 fields: age, sex, state and district, ethnicity, language, education, occupation, and a personality profile. It is built on NVIDIA’s persona framework, released under a commercial-friendly open licence, and the first in NVIDIA’s series to lead with Bahasa Melayu.

The method, as NVIDIA describes it for the whole series, has two stages. First, a statistical model learns how the published figures fit together — how age goes with education, education with occupation, occupation with district — and draws new combinations that match those patterns. Second, a large language model writes each persona’s life story around those attributes.

The part that really is safe

The official statistics are aggregates. A table of how many people of a given age, sex and occupation live in a state contains no individual. Drawing a new “person” from that table does not copy anyone. That part of the claim holds — and it is a far better way to build Malaysian AI than scraping real people’s posts and chats.

The parts nobody has explained

Three ingredients are not in any DOSM table.

Names. DOSM does not publish lists of names. Yet the sample persona quoted in the launch coverage has one — a full Malay name with a patronymic. NVIDIA’s sister datasets show where names usually come from. The Singapore edition lists “8992 unique first names, 4182 unique middle names and 4894 unique last names” taken from the national library’s name authority file and the real-estate salesperson register: real people’s names, split apart and recombined. The Japan edition used a commercial surname database. I could not open the Malaysia dataset’s own documentation, so I cannot tell you its name source. That is exactly the question.

Personality. DOSM does not measure personality. NVIDIA’s own design notes for the series describe the traits as drawn from a standard bell curve with the same average for every country. The 39 fields sound like a portrait of Malaysia. The personality part is a default setting.

The stories. The narratives are written by a language model. The sister datasets name it: OpenAI’s open-weight GPT-OSS-120B. Whatever that model learned about Malaysians, it learned from the internet — which is full of real people.

Why “no personal data” is the wrong promise

“No real individual is represented” describes the output, and I accept it. A persona is not a person.

“No personal data” is a claim about the inputs too, and that is a bigger promise. If the names came from a register of real people, and the stories came from a model trained on real people’s writing, the honest statement is narrower: no real individual is reproduced.

There is also a quieter risk. The coverage says the data goes “down to the district level.” In a large district, a 35-year-old engineer is one of thousands. In a small interior district, a record combining a rare ethnicity, a rare occupation and a narrow age band can describe a handful of real people — sometimes one. Statistical agencies handle this by suppressing small cells. Whether the model that generated these personas did the same, the public material does not say.

I argued something similar about the electoral roll in The Electoral Roll Was Already for Sale. The model is rarely the scarce part. The data is — and the question is always who held it and what they did with it.

To be fair: this is the right direction

I would rather see this than the alternative.

It is open, free to use, and built from official statistics instead of harvested conversations. It leads with Bahasa Melayu, which almost nothing else does. It gives Malaysian developers a way to test whether a chatbot understands a fisherman in Sabah as well as an engineer in KL. And NVIDIA’s own team has shown it takes the naming risk seriously: in the Singapore edition, names were not released as separate fields, to reduce the risk of the model memorising them.

My point is not that the dataset is unsafe. It is that “no personal data” is a sentence the documentation should prove, not a line in a launch post.

What I would ask before using it

If you build on it: read the data card before the press release. Find the name source. Treat the personality fields as synthetic defaults, not Malaysian research. And test with real Malaysian users as well — a persona cannot tell you it was misunderstood.

If a vendor tells you “no personal data”: ask one question. In the inputs, or in the outputs? The answer tells you whether they have thought about it.

If you publish a dataset: list every source, including the boring ones like the name list. Trust is built in the footnotes. I made the same case about assurance in They Were Betting Nobody Would Check.

What’s left to think about

Five questions this launch does not answer — and I do not think anyone can answer them alone.

1. Did we answer the census for this? Malaysians gave their details to the Department of Statistics to plan schools, roads and housing. Those figures now feed a dataset that anyone may use commercially. The numbers are public, so it is legal. Is it the purpose people had in mind when they answered?

2. Whose names are they? If the names came from a register of real people, those people never agreed to become raw material for AI. Does splitting a name up and recombining it make that fine?

3. Whose Malaysia is it? The population figures are ours. The personality is a default setting shared with every other country. The life stories are written by an American model. Is that Malaysian data — or Malaysia seen through someone else’s eyes?

4. Who gets left out? AI tuned on 1.35 million average Malaysians will understand the average Malaysian well. The Orang Asli elder or the Sabah fisherman in a small district is the person it is most likely to get wrong — and a synthetic persona cannot complain that it was misunderstood.

5. Who checks the copy against the original? Once synthetic people become the standard test, AI gets checked against synthetic people. Someone still has to check it against real ones.

The bottom line

Synthetic Malaysians are a good idea, and 1.35 million of them built from official statistics is a real contribution. But synthetic does not mean sourceless. The demographics came from DOSM. The names came from somewhere DOSM does not publish. The personalities came from a default curve. The stories came from a model trained on the internet. “No real individual is represented” is a fair claim. “No personal data” is a claim about everything that went in — and until the name source is on the page, I will keep asking where it came from.

If you worked on the dataset and can answer that, I would be glad to correct this.