DORA and test data: only anonymised, pseudonymised or randomised
Since 17 January 2025, EU banks, insurers, investment firms and payment institutions have had to follow DORA's ICT risk rules. Its technical standard is blunt about test environments: production data may be stored there only in anonymised, pseudonymised or randomised form, with a narrow exception.
The ruleNon-production environments store only anonymised, pseudonymised or randomised production data, and its integrity and confidentiality must be protected.RTS Art. 16(5)
The exceptionProduction data may be stored only for specific testing occasions, for limited periods, after approval by the relevant function and reporting to the ICT risk management function.RTS Art. 16(6)
More testing, more test dataFinancial entities must test their ICT systems regularly, from vulnerability scans to scenario-based and end-to-end tests.DORA Arts. 24–25
End-user systems tooThe same rules apply, on a risk basis, to ICT systems developed or managed by users outside the ICT function.RTS Art. 16(9)
What your ICT risk function sees
Every non-production source in one view, in DORA's own terms: anonymised, pseudonymised or randomised, with a run record behind each one and any exception logged.
Synthesized / Controls /DORA · RTS on ICT risk, Art. 16(5)Export for auditIllustration
Environments
4
Sources
6
Treated
5
Exceptions
1, approved
Last run
03 Oct 06:42
EnvironmentSourceTypeData stateLast runEvidence
UAT-01Core banking tablesTABLEPseudonymised03 Oct 06:10Run record
UAT-01Loan documentsPDFPseudonymised03 Oct 06:42Run record
SIT-02Complaints mailboxMAILPseudonymised02 Oct 22:15Run record
DEV-04CRM notes columnTEXTAnonymised01 Oct 19:02Run record
DEV-04Synthetic customersTABLERandomised01 Oct 19:20Run record
Illustration. The data states follow the wording of Commission Delegated Regulation (EU) 2024/1774, Art. 16(5)(a).
Production data is more than tables
The standard says production data, not production databases. Statements, scanned forms, emails, attachments and notes copied into a test environment fall under the same rule, and are usually the part a refresh forgets.
Each capability carries its status today, so you can plan around what exists.
AvailablePseudonymise and randomise databasesMasking and synthetic generation across connected systems, including SAP, with the same replacement everywhere.
Engineer-ledDocuments in the same refreshPDF, Word and PowerPoint files, including scans, masked alongside the tables they belong to.
Engineer-ledMailboxes and office filesInboxes, attachments, spreadsheets and Slack exports.
Engineer-ledEvidence for the ICT risk functionA run record for every refresh: what was treated, by which policy, with what result.
Engineer-ledNotes columnsFree text inside customer and case records, masked in place.
Before the next test refresh
Inventory every non-production environment, including user-built tools.
Confirm each holds only anonymised, pseudonymised or randomised data.
Route any exception through approval, time-box it and report it to ICT risk.
Include documents and attachments in the refresh, not just tables.
Keep evidence of each refresh for supervisors and auditors.
Yes. Article 16(5) names anonymised, pseudonymised and randomised data. Pseudonymised data is still personal data under GDPR, so GDPR obligations carry on alongside DORA.
Does DORA apply in the UK?
No. DORA is EU law. UK firms have their own operational resilience rules, though UK providers of ICT services to EU financial entities may meet DORA requirements through their contracts.
Can we ever test with real data?
Yes, under the Article 16(6) exception: for a specific testing occasion, for a limited period, approved by the relevant function and reported to the ICT risk management function.
This page summarises the rules for planning purposes. It is not legal advice; check how they apply to you with your counsel or DPO.
The platform underneath, in production
Documents run on the same platform banks and insurers already trust with their test data.
Documents and text use the same policies, the same engine and the same deployment as these results.
