Lesson 4 of 5
Production copies and privacy
9 min
Sooner or later someone suggests copying production into the test system: "real data, real volumes, no setup work." There are good reasons to do it, especially for migration rehearsals and performance tests. There are also serious risks, and most of them are about personal data. As a business tester you will not make the decision, but you need to understand it and work within it.
Why production copies are attractive
- Realistic combinations of master data that nobody would think to create by hand.
- Real volumes for performance and batch job testing.
- Real open items and balances for period-end and payment scenarios.
- Faithful rehearsal of migration and cutover steps.
Why they are risky
An SAP S/4HANA production system holds a lot of personal data: names, addresses, phone numbers and email addresses of customer contacts and sole-trader suppliers, bank details, and, where HR is in the same system, employee data. Under laws such as the EU General Data Protection Regulation, personal data means any information relating to an identified or identifiable person. Copying it into a test system typically means more people can see it, often with broader authorizations, for a purpose it was not collected for.
What masking does
Masking (also called scrambling or anonymization, though these differ legally) replaces personal values with realistic but fictitious ones: names, addresses, bank account numbers, email addresses, tax numbers. Done well, it keeps the data usable: a masked customer still has a valid postal code format and the same sales area, so scenarios still work. SAP and other providers offer tooling to build reduced or scrambled test copies; your Basis and data protection teams decide what is licensed and approved.
Minimize before you mask
Privacy law and good practice both favor data minimization: use no more personal data than the purpose needs. For testing, that often means you do not need a full copy at all. A reduced copy with one company code and a recent time slice may be enough for UAT; built test data may be enough for most functional scenarios. Ask, scenario by scenario, whether real records add anything. Usually they matter for migration validation, performance and some period-end work, and much less for everyday process tests.
Access is the other lever. A test client that holds copied production data should be treated more like production: named users only, no broad authorizations "to make testing easier", and no downloads to personal devices.
Who decides
Using production data in test is a decision for the data owner and the data protection function (for example your data protection officer), with IT security and Basis implementing it. It is not the test lead's decision, and certainly not an individual tester's. On Contoso's program, Grace logs the decision in the PMO's decision register: which data may be copied, how it is masked, which clients receive it and who may access them.
| Role | Responsibility |
|---|---|
| Data owner (e.g., head of sales for customer data) | Decides whether the data may be used for testing and under what conditions |
| Data protection officer or privacy team | Advises on legal basis, minimization and masking requirements |
| Basis and IT security | Performs the copy and masking; restricts access to the test client |
| Test lead (Priya) | Plans scenarios around the approved data; reports any personal data found in test |
| Testers | Use only approved data; never export test data to personal files or email |
What would you do?
During UAT, a Contoso tester notices that the masked test client still shows real email addresses for customer contacts. The tester needs those contacts to test order confirmations by email. What should the tester do?
- Production copies are realistic but carry personal data such as names, addresses and bank details.
- Masking replaces personal values with fictitious ones; it must keep the data usable.
- The data owner and data protection function decide; Basis implements; testers comply.
- Report any personal data found in test, and never send test output to real contacts.
Check your understanding · not graded
Lesson check
1. Under the GDPR, what is personal data?
2. Who decides whether production data may be used in a test client?
3. Why smoke test a client after a masked refresh?
4. A tester finds unmasked email addresses in test. What is the first action?