Synthetic Test Data: Why Not to Clone Production

When developing or testing a system, the quickest solution seems to be copying the real database. It is also one of the riskiest: customers' and employees' personal data end up in environments with fewer controls. Synthetic data allows testing without that exposure.

• Copying production into test environments multiplies the places where personal data lives.
• Synthetic or anonymised data allows useful testing without exposing anyone.
• It is a data protection measure decided when the development process is designed.

The problem with copying production

Development and quality environments usually have broader access, less monitoring and more people with permissions. A forgotten backup, a screenshot or a test file can leak real information. Each copy is also one more thing to protect, back up and delete when appropriate.

Alternatives

1. Synthetic data. Artificially generated, with the shape and variety of the real thing, but not corresponding to existing people.
2. Anonymised data. Derived from real data transformed so individuals cannot be identified; care is needed for the anonymisation to be effective.
3. Minimal sets. Only the fields the test needs.

How to implement it

• Set a rule: production information is not copied to development or quality.
• Prepare a generator or a reusable test dataset.
• Include edge cases: long names, special characters, empty fields, high volumes.
• Separate environments and their access.
• Document change control, with tests in quality and a rollback plan.

What to do

• Review today which test environments hold real information.
• Delete those copies securely.
• Establish a test data policy and communicate it to developers.
• Require the same standard from software vendors.
• Include it in a customer portal and other new developments.

Frequently asked questions

What if I need to reproduce a bug that only appears with real data? It can be reproduced with an equivalent synthetic case or an anonymised fragment, with authorisation and access control.

Is synthetic data less reliable for testing? Well designed, it covers the same cases and enables repeatable tests.

Does this apply to small companies? Yes, any organisation that builds or buys software carries this risk.

This practice is part of responsible personal data management; the applicable legal obligations are determined by legal counsel.

In our work with Chilean organizations, we develop and test with synthetic or anonymised data, not production copies.

IT Lab supports Chilean organisations in this. Contact us.