Not just because it would make testing easier. A copy of customer data still needs protection. Moving it into a test system can give more people access or create copies nobody remembers to remove.
Start with invented test records when they can reproduce the problem. If real data is necessary, use an approved process that checks the purpose and the destination before the copy is made.
Reproduce the problem, not the whole database
Suppose a billing calculation fails when an account has several discounts. You may be able to recreate that combination with fictional customers and amounts. You do not automatically need every customer’s billing history.
If the failure depends on a particular record, ask which fields are truly needed. Removing a name is not enough if other fields or free-text notes still reveal the person or confidential business details.
Check the destination
- Who can access the test system?
- Could the copy appear in logs, exports or backups?
- Can the test system send real emails or trigger real transactions?
- How will the data be removed after the work?
A test label does not prevent real consequences. Disable unintended outbound actions and check the connections before running a test with copied data.
Make any real-data use deliberate
Have the responsible data owner approve the purpose and scope. Check customer restrictions and applicable privacy obligations with the right specialist. Limit access to the people doing the work.
Record what was copied and when it should be removed. Include temporary exports and other copies created during investigation. Verify cleanup instead of assuming that deleting the test database removed everything.
If an unapproved copy already exists, stop further sharing and involve the security or privacy owner. Establish where it went and who could access it. Do not assume either that a breach occurred or that the copy was harmless.
Where SOC 2 fits
SOC 2 criteria address authorized movement of information. They also address protecting confidential and personal information during system development when those categories apply. The practical point is straightforward: testing does not suspend your data-protection commitments.
Source
AICPA Trust Services Criteria: CC6.7 and the confidentiality and privacy points of focus under CC8.1. The steps above are implementation guidance, not a prescribed AICPA test-data procedure.