Your test environments use a nightly copy of the production database. Legal has raised it. What is the replacement?

What the interviewer is testing

Whether you can replace a genuinely useful practice with something that preserves its value rather than just removing it.

Why legal is right

A production copy multiplies the number of systems holding personal data, each with weaker access control, broader access, longer retention and no clear purpose. Under most data protection regimes, testing is not a lawful basis for processing personal data, and every copy is in scope for breach notification and subject access requests.

It is also usually the largest and least defensible item in a data protection audit.

Why fixtures alone will not do

Hand-crafted test data has none of production's cardinality, distribution, encoding oddities, historical inconsistency or scale — so it finds none of the defects that matter. Removing production data without replacing its properties degrades testing materially, and pretending otherwise is how this decision gets reversed after the first escaped defect.

The replacement

Synthesised data preserving statistical shape: the same distributions, the same proportion of nulls, referential integrity across tables, the same long tail — the customer with 4,000 orders, the name with an apostrophe, the address that breaks the form.

Masking where synthesis is impractical, applied irreversibly and referentially consistently across tables, so joins still work. A mask that can be linked back to identity has de-identified nothing.

A small, tightly controlled production-like dataset behind real access controls for the specific cases that genuinely need it — a performance test at true scale, a migration rehearsal — with named access, an expiry and audit logging.

Testing in production for what only production can prove: synthetic transactions, canary analysis, shadow traffic.

What a strong answer adds

Warning about privacy leakage through overfitting in generative synthesis: a model trained on data with rare records can reproduce them nearly verbatim, so synthetic output needs a distance-to-nearest-record check rather than an assumption that synthesis equals anonymity.

Common weak answers

Masking names and calling it anonymised, when quasi-identifiers still re-identify. Removing the copy with no replacement.