Test Data Management Strategies in Enterprise Systems Under GDPR
Keywords:
Data Anonymization, GDPR, Sensitive data protection, Synthetic test data, Test Data Management (TDM)Abstract
Enterprise software systems in highly regulated markets, such as healthcare, financial services, and insurance, require that representative data be used to validate business processes, system integration, and performance. However, using production data in non-production environments triggers privacy and compliance issues as prescribed by the General Data Protection Regulation (GDPR). The regulation provides privacy protection for the handling, storage, and reuse of personal information across different environments, e.g., development, quality assurance, staging, etc. This article provides an overview of how Test Data Management allows organizations to ensure that software testing is compliant with data protection laws such as the GDPR while not compromising the level of realism necessary to properly test quality. This article also examines the risks involved in copying production databases for use in testing environments and reviews modern approaches to reduce this risk, including data masking, anonymization, pseudonymization, data synthesis, and data subsetting. It further examines the controlled conditions under which production-derived data remains a justifiable testing resource, the governance and automation infrastructure required to operate Test Data Management at enterprise scale, and the particular implementation challenges presented by healthcare systems. Emerging technologies including artificial intelligence-driven synthetic data generation, differential privacy, and data virtualization are evaluated as near-term advances that will progressively narrow the gap between privacy protection requirements and testing realism demands. The article concludes that integrating governance frameworks, automated pipelines, and privacy-preserving technologies into Test Data Management processes allows organizations to maintain high software quality while sustaining continuous compliance with data protection obligations.
Downloads
References
Peter Warren Singer and Allan Friedman, "Cybersecurity and Cyberwar: What Everyone Needs to Know," Oxford University Press, 2013. Available: https://doi.org/10.1093/wentk/9780199918096.001.0001
Khaled El Emam and Fida Kamal Dankar, "Protecting Privacy Using k-Anonymity," Journal of the American Medical Informatics Association, 2008. Available: https://doi.org/10.1197/jamia.M2716
Regulation (EU) 2016/679 of the European Parliament and of the Council, "General Data Protection Regulation (GDPR)," 2016. Available: https://www.legislation.gov.uk/eur/2016/679
Vahid Garousi et al., "The Need for Multivocal Literature Reviews in Software Engineering: Complementing Systematic Literature Reviews with Grey Literature," Proceedings of the 20th International Conference on Evaluation and Assessment in Software Engineering, 2016. Available: https://doi.org/10.1145/2915970.2916008
Nicola Rieke et al., "The Future of Digital Health with Federated Learning," NPJ Digital Medicine, 2020. Available: https://doi.org/10.1038/s41746-020-00323-1
Paul Voigt and Axel Von dem Bussche, "The EU General Data Protection Regulation (GDPR): A Practical Guide," Springer International Publishing, 2017. Available: https://doi.org/10.1007/978-3-319-57959-7
Latanya Sweeney, "k-Anonymity: A Model for Protecting Privacy," International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 2002. Available: https://doi.org/10.1142/S0218488502001648
Pierangela Samarati, "Protecting Respondents' Identities in Microdata Release," IEEE Transactions on Knowledge and Data Engineering, 2002. Available: https://doi.org/10.1109/69.971193
Ann Cavoukian, "Privacy by Design: The 7 Foundational Principles," Information and Privacy Commissioner of Ontario, Canada, 2009. Available: https://student.cs.uwaterloo.ca/~cs492/papers/7foundationalprinciples_longer.pdf
Daniel J. Solove, "A Taxonomy of Privacy," University of Pennsylvania Law Review, 2006. Available: https://doi.org/10.2307/40041279
Helen Nissenbaum, "Privacy as Contextual Integrity," Washington Law Review, 2004. Available: https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10
ISO/IEC 27001:2022, "Information Security, Cybersecurity and Privacy Protection: Information Security Management Systems Requirements," 2022. Available: https://www.iso.org/standard/27001
ISO/IEC 27701:2025, "Information Security, Cybersecurity and Privacy Protection: Privacy Information Management Systems Requirements and Guidance," 2025. Available: https://www.iso.org/standard/27701
Maurizio Atzori, "Weak k-anonymity: a low-distortion model for protecting privacy," In International Conference on Information Security, 2006. Available: https://doi.org/10.1007/11836810_5
Nicolas Papernot et al., "Semi-Supervised Knowledge Transfer for Deep Learning from Private Training Data," arXiv preprint arXiv:1610.05755, 2017. Available: https://doi.org/10.48550/arXiv.1610.05755
Reza Shokri et al., "Enhanced Membership Inference Attacks Against Machine Learning Models," IEEE Symposium on Security and Privacy, 2022. Available: https://doi.org/10.1145/3548606.3560675
Cynthia Dwork and Aaron Roth, "The Algorithmic Foundations of Differential Privacy," Foundations and Trends in Theoretical Computer Science, 2014. Available: https://doi.org/10.1561/0400000042
NIST, "NIST Privacy Framework," n.d. Available: http://nist.gov/privacy-framework
Dr. NISHA VARMA et al., "Data-Driven Software Quality Assurance: Leveraging Machine Learning for Risk Prediction and Test Optimization," International Journal of Mathematical Analysis and Research, 2026. Available: https://doi.org/10.64137/3108-2637/IJMAR-V2I1P101
Kohei Arai, "Intelligent Computing,” Proceedings of the Computing Conference, Springer Nature Switzerland, 2025. Available: https://link.springer.com/book/10.1007/978-3-031-92605-1
Marianna Capasso, "Synthetic Data as Meaningful Data: On Responsibility in Data Ecosystems," Big Data and Society, 2025. Available: https://journals.sagepub.com/doi/pdf/10.1177/20539517251386053
Santanam Kasturi, "Some Aspects of Test Data Management Strategy," IEEE International Conference on Computing, Power and Communication Technologies (GUCON), 2020. Available: https://doi.org/10.1109/GUCON48875.2020.9231129
Downloads
Published
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All papers should be submitted electronically. All submitted manuscripts must be original work that is not under submission at another journal or under consideration for publication in another form, such as a monograph or chapter of a book. Authors of submitted papers are obligated not to submit their paper for publication elsewhere until an editorial decision is rendered on their submission. Further, authors of accepted papers are prohibited from publishing the results in other publications that appear before the paper is published in the Journal unless they receive approval for doing so from the Editor-In-Chief.
IJISAE open access articles are licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. This license lets the audience to give appropriate credit, provide a link to the license, and indicate if changes were made and if they remix, transform, or build upon the material, they must distribute contributions under the same license as the original.
