How to Comply with Personal Data Processing in Development Environments

Processing personal data within development environments (both in pre-production and testing phases) has unique challenges that businesses need to address.

Once again, it's about making an effort to ensure sensitive data is protected and user privacy is upheld, all in accordance with the law, which specifically addresses the case of development environments.

Here’s everything you need to know about handling personal data in development settings, from adhering to regulations to utilizing the most effective tools for compliance.

Why Focus on Development Environments?

According to prevalent system engineering models, a distinction is made between various types of environments, with development, pre-production, and production being the most common.

The general trend is to focus on data privacy breaches occurring in major projects and systems of utmost importance. However, this oversight towards what are considered secondary processes (such as testing and pre-production environments) actually poses a greater risk. This is because technical and organizational measures required in these environments are often neglected.

Thus, development environments can become dangerous gateways to personal data.

The right approach is to acknowledge the peculiarities of development settings and ensure that the exposure of personal data is minimized in this context as well.

You might also be interested in: Anonymization and Pseudonymization: Similarities and Differences

What Does the Law Say About Personal Data Processing in Development Environments?

The protection of individuals regarding personal data processing is a fundamental right recognized by the Spanish Constitution, the Charter of Fundamental Rights of the European Union, and the Treaty on the Functioning of the European Union.

Failing to take appropriate measures can violate several principles and result in significant penalties.

Specifically, regarding development environments:

• Article 32 of the GDPR on the security of personal data processing states that in any situation, appropriate technical and organizational measures should be applied to ensure a level of security appropriate to the risk to the rights and freedoms of natural persons. This includes the use of real personal data in pre-production and testing environments.

• The European Data Protection Supervisor (EDPS) in the “Guidelines on the protection of personal data in IT governance and IT management of EU institutions” provides guidelines for personal data processing in development environments:
  • It's advised against using real personal data samples, as those data should not be used for purposes other than for which they were collected.
  • Priority should be given to working with artificially created test data, or test data derived from real data after removing sensitive LPS data.
  • If sufficiently valid artificial test data are not available, real data may be used in the most limited manner possible, following the strictest technical and organizational safeguards.
• Lastly, the European Committee on Data Protection states that personal data processing must offer the highest security guarantees regardless of the context in which it is carried out.

That means, in development environments, the principles of data minimization and data protection by design and by default also apply.

The Challenge of Handling Personal Data in Development Environments

From what we’ve discussed, managing test data efficiently becomes a crucial issue.

The goal is to obtain reliable, accurate, complex, and coherent data that also complies with regulations and ensures the highest level of user privacy protection.

However, the reality is that personal data processing has become a challenge for many companies unfamiliar with how to optimize this process.

Without the right tools, generating test data can consume significant efforts, resources, and time. It may even account for up to half of a test engineer’s time for a project.

Recommendations for Personal Data Processing in Development Environments

The Spanish Data Protection Agency offers the following recommendations:

• Clear differentiation between work in the development environment, testing in pre-production, and deploying applications and services in production environments.
• Avoid sampling data in testing environments, as it could allow unauthorized access.
• Generate precise documentation through a need and proportionality analysis.
• Follow technical and organizational measures outlined in Article 32 of the GDPR, in line with the risk of processing.
• Implement anonymization or risk minimization processes before testing. This includes reducing data processing, limiting data accessibility, and conservation periods.
• Use synthetic data sets.
• Ensure data deletion.

The Solution for Personal Data Processing in Development Environments

icaria TDM (Test Data Management) is designed to efficiently and effectively manage data in development environments, covering functions such as:

• Identifying and masking sensitive data.
• Segmenting and moving coherent data subsets from a source to a target environment.
• Automatically checking results.
• Integrating with third-party tools.
• Injecting input data into test cases on demand.
• Providing data in a “self-service” or on-demand format.
• Generating synthetic data from templates and models.
• Integrating with automated testing execution environments.

Benefits of this tool include:

• Improved efficiencies in test execution, reducing costs.
• Minimizing time dedicated to testing, cutting waiting times in half.
• Generating more reliable and automated tests.
• Compliance with legislation regarding personal data processing.

Want to learn more about how to comply with personal data processing in development environments? Request a demo of our icaria TDM tool and see firsthand how it can assist your business.