Lesson 4 of 5
Privacy and production copies
9 min
Listen to this lesson
A production copy is attractive because the data is real. That is also the problem. Production holds personal data about customers' contact people, suppliers who are sole traders, employees and sometimes consumers. Copying it into a test system extends the reach of that personal data to more people, more systems and weaker controls. Data protection law does not exempt test systems.
Where personal data hides in SAP
- Business partners: names, addresses, phone numbers, email addresses, tax numbers and bank details of persons and contact people.
- Employee data: HR master data, payroll results, and employee-related business partners used for travel expenses or as suppliers.
- Free text: notes on sales orders, service tickets and invoices often contain names, phone numbers or worse.
- Attachments: scanned invoices, signed delivery notes and contracts.
- Logs and change documents: user names and the history of who changed what.
The obligations in plain terms
Under the EU General Data Protection Regulation (GDPR) and similar laws, personal data may only be processed for a lawful, defined purpose, limited to what is necessary, and protected with appropriate technical and organizational measures. GDPR names pseudonymization and data minimization among those measures and requires data protection by design. Testing is rarely the purpose the data was collected for. Your organization's data protection officer decides how the rules apply; your job is to make sure the test approach does not ignore them.
| Principle | What it means for test data | Contoso example |
|---|---|---|
| Minimization | Copy only the data the tests need | Copy 2025 sales for plant 1710, not ten years of history |
| Pseudonymization / anonymization | Replace identifying values before testers see them | Contact names, emails and bank details scrambled in QAS |
| Access control | Restrict who can see the copy | Only the test team and support have QAS logons |
| Retention | Remove copies when no longer needed | Training client 200 rebuilt each quarter without real data |
Data protection principles applied to SAP test systems.
Scrambling before access
The safest pattern is to make personal data unrecognizable before anyone outside Basis can log on to the copied system. SAP offers tooling for this, such as the scrambling functions in SAP Test Data Migration Server, which can scramble data during transfer or in an existing system using predefined or custom rules. Many organizations also build their own scrambling programs. Whatever the tool, the test team should agree the rules, because careless scrambling breaks tests.
- CopyProduction data copied to an isolated target; no tester access yet
- ScrambleNames, contact details, bank data and free text replaced by rule
- VerifySample records checked: personal data gone, business keys intact
- ReleaseLogons opened to the test team under normal access controls
Some data should be removed rather than scrambled. HR and payroll data is rarely needed outside HR testing; exclude it from general test copies. Attachments are hard to scramble and are often better left behind. When a test genuinely needs realistic personal data, for example to test a privacy feature such as blocking and deletion, use synthetic people created for the purpose.
- Do the planned tests need this data at all?No → leave it out of the copy, as with HR and payroll data or attachments · Yes → next question
- Does it identify a living person?No → copy it as is, within the minimized scope · Yes → next question
- Does the test need realistic personal data, for example to test blocking and deletion?Yes → use synthetic people created for the purpose · No → scramble it with deterministic, format-preserving rules
Access, retention and evidence
Scrambling is one control among several. Keep the list of people with logons to a production-derived system short and reviewed, and remove access when people leave the project. Agree how long a copy may live: a QAS refreshed every quarter should not keep last year's copy in a forgotten client. Training clients, such as Contoso's client 200, are a common blind spot because trainees and trainers come and go; build them from synthetic data where you can.
Test evidence can leak personal data too. A screenshot of a business partner, an exported spreadsheet of open items or a defect attachment can carry names and bank details into tools with much wider access than the SAP system. Ask testers to capture document numbers and business keys rather than whole screens of personal data, and to crop or mask what they must capture.
| Evidence | Leaks personal data | Safe and still checkable |
|---|---|---|
| Customer check | Screenshot of the full business partner screen with contact names and bank details | Business partner number and the sales area it was tested in |
| Open items | Exported spreadsheet of all open items with names | Document numbers and amounts for the items the test touched |
| Defect attachment | Uncropped screen of an invoice with a contact's phone number | Cropped or masked image showing only the failing field |
What would you do?
Grace, Contoso's PMO lead, wants QAS refreshed from production so UAT uses realistic data. Production holds supplier bank details and contact people for Great Lakes Fleet Services. Testers include contractors. What should Priya insist on?
- Production copies contain personal data in business partners, HR, free text, attachments and logs.
- Data protection obligations apply to test systems: minimize, pseudonymize, restrict access, retain only as long as needed.
- Scramble before testers get access, with deterministic rules that keep formats valid.
- Exclude HR data and attachments from general test copies unless a test truly needs them.
Check your understanding · not graded
Lesson check
1. When should personal data in a production copy be scrambled?
2. Which is an example of data minimization in a test copy?
3. Why must scrambling rules be deterministic and format-preserving?
4. Where can personal data hide besides business partner records?