RegulationsUS · EU · UK
Few laws say "test data". Most of them still cover it: personal data doesn't stop being personal when it is copied into dev, and documents count as much as databases. Here is what each one asks of data outside production.
What each regulation says about test and non-production data, and which documents it touches most.
| Regulation | Applies to | What it says about test data | Documents most affected | |
|---|---|---|---|---|
GDPR and UK GDPR EU and UK | Anyone processing personal data of people in the EU or UK | Minimise it (Art. 5(1)(c)), build in pseudonymisation (Art. 25), secure it (Art. 32). Pseudonymised data is still personal data (Recital 26). | CVs, emails, contracts, KYC packs | Read more |
HIPAA US | Covered entities and business associates | No test-environment exemption. De-identify by Safe Harbor or Expert Determination (45 CFR 164.514). | Lab reports, discharge summaries, EOBs, claims | Read more |
PCI DSS v4.0.1 Global | Anyone storing, processing or transmitting card data | No live PANs in pre-production unless protected as the CDE (6.5.5). Remove test data before go-live (6.5.6). | Transcripts, chat logs, disputes, statements | Read more |
DORA EU | Banks, insurers, investment firms, payment institutions | Non-production stores only anonymised, pseudonymised or randomised production data (RTS 2024/1774, Art. 16(5)). | Statements, loan files, KYC packs, claims | Read more |
CCPA and CPRA California | Businesses meeting the CCPA thresholds | Deidentified information falls outside personal information only with reasonable safeguards, a public commitment not to re-identify, and contracts binding recipients (Civ. Code §1798.140(m)). | Support tickets, emails, HR files | Coming |
GLBA Safeguards Rule US | Financial institutions, including lenders and tax preparers | A written security programme with a data inventory, access controls, encryption and secure development practices (16 CFR 314.4). | Loan files, tax returns, statements | Coming |
NYDFS Part 500 New York | New York-regulated financial services firms | Nonpublic information is in scope in every system: access privileges, encryption and asset inventory (23 NYCRR 500). | Account files, claims, KYC packs | Coming |
EU AI Act EU | Providers of high-risk AI systems | Training, validation and testing data must meet data-governance and quality criteria (Art. 10). | Training and evaluation corpora | Coming |
Subject access and FOI UK and EU | Controllers answering DSARs; UK public authorities | Release the requester's own data and protect everyone else's (UK GDPR Art. 15; Freedom of Information Act 2000). | Case files, emails, letters | Read more |
Also often relevant: FCRA for consumer reports, state health-data laws, and rules from your own supervisor.
One page per regulation: what an auditor will ask about your test environments, and the evidence that answers it. GDPR, HIPAA, PCI DSS and DORA.
Usually, if it is generated rather than copied and doesn't reproduce real people. Check how it was made: synthetic data built badly from real records can still leak them.
Then all of them apply. A US bank's test copy can be in scope of GLBA, PCI DSS and NYDFS Part 500 at the same time, and an EU insurer's of GDPR and DORA.
Documents too. None of them limits itself to structured data: a statement, a scanned claim form or an email thread about a customer is personal data like the row it came from.
This page summarises the rules for planning purposes. It is not legal advice; check how they apply to you with your counsel or DPO.
Documents and text use the same policies, the same engine and the same deployment as these results.
Published results from database and synthetic data work on the Synthesized platform.
We'll take one environment, find the personal data in its tables and documents, and show what masking it would take.