Question

A privacy engineer discovers that the organization's software development teams routinely copy a full production customer database into lower test and QA environments to support realistic functional testing. These non-production environments have weaker access controls and are accessible to numerous contractors. Testing does not require real identities, only data that behaves realistically. Which technical control BEST addresses the privacy risk while preserving testing utility?

Accepted Answer

Apply static data masking to irreversibly replace personal data with realistic surrogate values before the copy is loaded into non-production environments

Answer

Encrypt the production database at rest and reuse the same encryption keys in the non-production environments

Answer

Apply dynamic data masking at query time in the production database so test users see obfuscated values

Answer

Require contractors to sign confidentiality agreements before granting them access to the test environments