The habit nobody defends out loud
Ask how test data gets made and the honest answer at many companies is "we restore a production dump into staging." It is convenient and realistic, and it means real names, emails, addresses, and transaction histories now live in an environment with weaker access controls, more debug logging, and more third-party tooling than production. Under GDPR, that copy is still personal data: every obligation follows it, and the maximum penalty tier reaches €20 million or 4% of global turnover.
EU and UK buyers increasingly ask about exactly this in vendor security reviews. "Do you use production data in test environments?" is now a standard questionnaire line, and the wrong answer stalls deals.
Two honest alternatives, both built in
- Synthetic generation: our data generator fabricates realistic records (names, addresses, transactions, locale-aware formats) that correspond to no real person. Zero personal data means the GDPR question evaporates for those datasets.
- Masking-based TDM: when tests genuinely need production-shaped data, Enterprise TDM masks the personal fields consistently, so referential integrity survives, with governance over who generated what, when, and from where.
The selling point you get for free
Teams that switch tell the same story in security reviews: the test-data question becomes a strength instead of a scramble. "Staging contains zero production personal data; here is the generation and masking pipeline" is a one-line answer that builds trust with EU, UK, and North American buyers alike, and it removes an entire category of breach from your risk register.
How we measured this
- Synthetic records are produced by the platform generator from schema and locale settings only; no production records are read. Masking transforms the dataset you supply and records who generated what, when and from where.