A.8.33
Test information
Technological controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control selects and protects development/test information and manages its retention and deletion. Prefer synthetic or appropriately transformed data; where real production information is essential, verify a lawful basis, minimum scope, approval, and adequate safeguards. Masking or pseudonymization does not automatically guarantee anonymity, so assess re-identification and source-data disclosure risks. The aim is to protect information according to sensitivity while preserving reliable test results.
Key checkpoints
- Is there a policy/procedure for selecting, using, protecting, and disposing of test data, and is it shared with development/test teams?
- Is the use of production data for testing restricted in principle, with approval by the responsible owner obtained where it is unavoidable?
- When production data is used, is identifiability reduced as needed and re-identification risk assessed, with any exception to transformation managed through a lawful basis and separate approval/safeguards?
- Are access and storage/transport safeguards appropriate to actual test-data sensitivity, with production-equivalent protection for sensitive production copies?
- Are the copying/transfer of production data into test environments and its use there logged and traceable?
- Is unneeded data securely deleted after testing, with a defined basis, deadline, and access restrictions for records that must be retained?
Implementation guidance
- Document the criteria and responsibilities for selecting, generating, using, protecting, and disposing of test data as a policy/procedure, and train/share it with development and test staff.
- Prefer synthetic/fabricated data but check whether generation reproduces source personal information or rare records. The synthetic label alone does not justify public disclosure or unrestricted use.
- Verify the necessity and lawful basis for production data and obtain prior owner approval and privacy-function approval where needed. Where transformation is unsuitable, document a separate exception limiting scope, duration, users, and compensating controls.
- Reduce unnecessary identifiers through masking, pseudonymization, tokenization, or field removal and assess linkage with other data. Pseudonymized data can remain identifiable using additional information, so separate keys/mappings and maintain required privacy safeguards.
- Apply privileges, account management, necessary encryption, and logging according to test-data sensitivity and risk. Give sensitive production copies protection equivalent to production, without lowering safeguards for test convenience.
- Manage the copying/transfer of production data into test environments so that the approval, timing, target, handler, and method are recorded and traceable.
- After testing, delete unneeded production copies and residual data under A.8.10 and record outcomes. Where legal preservation or justified validation records are needed, define minimum scope, retention deadlines, and use restrictions, including backup expiry/recovery procedures.
Evidence
- Test data management policy/procedure and test data selection/use criteria
- Approval requests/records for the use of production data in testing (owner/data protection officer approval)
- Masking/pseudonymization/transformation and re-identification-risk verification records, with minimized and restricted access to sensitive before/after samples
- Test environment access privilege lists and access/usage logs
- Records of copying/transferring production data into test environments (timing/target/handler)
- Confirmation of deletion/disposal of test data after testing and disposal history
Nonconformity examples
- A production database is copied unchanged for testing without the required lawful basis, exception approval, and safeguards.
- Staff take out and use production data at their own discretion without any approval process for test data use.
- The access control/encryption level of the test environment is markedly lower than production, leaving personal data exposed to risk.
- Masked/pseudonymized data remains re-identifiable but is treated as anonymous and used without needed access restrictions.
- Unneeded production copies remain on test servers, developer PCs, or shared storage after testing without a valid retention basis or deletion plan.
- The use/copying of production data for testing is not logged, so there is no way to trace which data was used where.