> is pseudonymisation really a new thing? We do this with prod data for our dev and staging database. a subset of a dump is processed and names, emails and othe

> is pseudonymisation really a new thing? We do this with prod data for our dev and staging database. a subset of a dump is processed and names, emails and other PIIs are replaced with random strings, etc. No it has been done for years to varying effectiveness, and in my experience it is almost always done badly (only randomizing indexes and not all data) unfortunately. Note that even a small subset of personal data is enough to trace it to a person, so either randomize all, or don't bother and set other efforts in place to guard data. Like limiting access, getting very small and rotating subsets of data randomized over all data and guarding access to only test engineers (which you already described). I worked at a medium sized insurance company for a while and the data available to me was only available to me (all engineers had different, very small subsets, only need-to-know) and there were very stringent protection in place like only localized access (no internet on the machine), no laptops, thus only work on location and NEVER SHARE OR ELSE legal paperwork. This was due to the nature of the work which could almost not be done without real world data since it covered fraud detection (on which I won't elaborate further). Other engineer which didn't need the data got randomized databases generated, not extracted.