PM-25, Minimization of Personally Identifiable Information Used in Testing, Training, and Research, asks you to write and apply policy on using PII for internal testing, training and research, to limit the amount used, to authorize any use that is required, and to review the policy on a schedule. It binds federal systems and others by contract. For engineering teams it is a plain reference for a familiar problem: production data in a test database.
What it means in practice
NIST says using PII for testing, research and training raises the risk of unauthorized disclosure or misuse. The record advises consulting the senior privacy official or counsel to confirm the use fits the purpose the data was collected for. It also says to use placeholder data when possible.
That last sentence is the practical answer. Synthetic or masked data removes most of the risk. When real data is truly needed, the control asks for an explicit authorization, not a quiet copy of the production database.
The weak spots are usually in lower environments, data science notebooks and demo systems, which often have weaker access control than production.
Evidence to collect
- The written policy on PII in testing, training and research
- Approval records for each authorized use of real PII
- Evidence of masking or synthetic data generation in pipelines
- Inventory of non production environments that hold PII
- Policy review records
Common gaps
- A nightly copy of production feeds the staging database
- Developers hold local dumps with customer data
- Demo environments use real names and emails
- Approvals are given verbally
How to implement it
- Default to synthetic or masked data in every non production environment.
- Require a written approval, with an expiry, when real PII is needed.
- Scan non production databases for PII patterns on a schedule.
- Delete test copies when the approval ends.
Quick check
What does the record recommend when possible?
Use placeholder data to avoid exposing PII during testing, training and research.
