A method comprising: receiving data , wherein the data comprises personal information of one or more individuals and is subject to privacy requirements ; storing the data on a data store ; generating a private synopsis , wherein generating the private synopsis comprises: adding noise to the data ; and aggregating the data and the noise to create a first summary of the data with the noise added, wherein the private synopsis includes the first summary of the data with the noise added and the first summary of the data with the noise added satisfies a differential privacy guarantee, the differential privacy guarantee being based on the privacy requirements and satisfying the privacy requirements ; generating a report from the private synopsis , wherein the report is subject to audit requirements and includes a second summary of the first summary of the data with the noise added, the report being aggregated to a higher level than the private synopsis ; expunging the data after a first time period that is based on the privacy requirements ; and retaining the private synopsis for a second time period based on the audit requirements , wherein the second time period is longer than the first time period and the private synopsis satisfies the audit requirements without access to the data , the audit requirements comprising an enterprise's obligation to provide means for an independent auditor to verify a process used to generate the report . receiving data , wherein the data comprises personal information of one or more individuals and is subject to privacy requirements ; storing the data on a data store ; generating a private synopsis , wherein generating the private synopsis comprises: adding noise to the data ; and aggregating the data and the noise to create a first summary of the data with the noise added, wherein the private synopsis includes the first summary of the data with the noise added and the first summary of the data with the noise added satisfies a differential privacy guarantee, the differential privacy guarantee being based on the privacy requirements and satisfying the privacy requirements ; adding noise to the data ; and aggregating the data and the noise to create a first summary of the data with the noise added, wherein the private synopsis includes the first summary of the data with the noise added and the first summary of the data with the noise added satisfies a differential privacy guarantee, the differential privacy guarantee being based on the privacy requirements and satisfying the privacy requirements ; generating a report from the private synopsis , wherein the report is subject to audit requirements and includes a second summary of the first summary of the data with the noise added, the report being aggregated to a higher level than the private synopsis ; expunging the data after a first time period that is based on the privacy requirements ; and retaining the private synopsis for a second time period based on the audit requirements , wherein the second time period is longer than the first time period and the private synopsis satisfies the audit requirements without access to the data , the audit requirements comprising an enterprise's obligation to provide means for an independent auditor to verify a process used to generate the report . <EOS>