arXiv: SafeStats: Efficient 2PC Protocols for Data Statistic-Related Functions

This publication introduces SafeStats, a new set of cryptographic protocols designed to enable two-party computation (2PC) for common statistical functions, such as mean, variance, and regression, without revealing raw data to either party. The paper presents efficiency improvements that make privacy-preserving data analysis more practical for real-world applications. While not a regulatory change itself, this technical advancement directly supports compliance with data protection frameworks like the GDPR and the EU AI Act, which require data minimization and privacy by design when processing personal data for AI training or analytics.

Organizations that handle sensitive personal data across multiple jurisdictions, particularly in finance, healthcare, and cross-border AI development, are most affected. Any entity that currently shares or aggregates statistical data with partners, vendors, or subsidiaries may now have a more viable technical path to avoid transferring raw data, thereby reducing regulatory risk. Compliance teams in these sectors should evaluate whether their current data-sharing agreements and processing activities could be restructured using such protocols to meet stricter data localization or consent requirements.

Compliance teams should first review their organization’s data-sharing practices to identify high-risk statistical exchanges, such as joint analytics with third parties or cross-border reporting. Next, they should engage with their data engineering and security teams to assess the feasibility of implementing SafeStats or similar 2PC protocols for those use cases. Finally, they should update internal data protection impact assessments and contractual clauses to reflect the use of privacy-enhancing technologies, ensuring that regulators can see proactive steps toward compliance with the EU AI Act’s transparency and data governance obligations.