Test Data Protection Checklist

When to use this

Use this checklist before and after testing that involves sensitive, production-derived, personal, or confidential information.

Related controls

• A.8.33 Test Information
• A.8.11 Data Masking
• A.8.10 Information Deletion

Checklist

• Test data source is documented.
• Synthetic or masked data was preferred.
• Live data use is approved.
• Personal data/privacy requirements are reviewed.
• Access is restricted to authorized testers.
• Logs, debug files, screenshots, exports, caches, and reports are protected.
• Retention period is defined.
• Secure deletion is planned and evidenced.
• Reproducibility needs are balanced against minimization.