We have a payroll system where users input their worked hours. There is a database of users with names, emails, addresses, input hours etc. We want to transfer that data to preprod for testing purposes.

My question is: How should we go about transferring personal data in compliance with GDPR? Should we absolutely replace the user data or there are other ways?

CodePudding user response：

Does the data in a preprod env has to be absolutely equal to the data in prod, if that isnt the case you can use a library to fill your preprod database a library like faker can do the job.

Concerning GDPR, if the both database are hosted by the same service, same server same timezone, you are not breaking in rules but if a user that requests his data to be removed, it has to be removed in Production and Preprod env.

CodePudding user response：

A pre-production environment should by definition be as near as humanly possible to the production environment. As long as you have the same privacy protections in that environment as in the production environment (restrictions to need-to-know, ability to extract data at request, ability to purge data at request, and so on), I don't see why GDPR should be a hindrance. You need to have measures in place to ensure the data-in-motion part doesn't fall into the wrong hands, of course: sometimes, encryption actually is the answer to security issues!

IANAL, of course: there sometimes seem to be about as many interpretations of GDPR as there are citizens in the EU…