For testing and development purposes in non-production enviornment, test data should be generated so as not host live data in environments with less controls. When live data must be used, it should be masked or tokenized to de-identify the personal information it contains.