How should PII be handled when testing and reporting defects?

• A. Do not collect or disclose PII; redact sensitive data; use synthetic data and privacy-preserving test data.
• B. Collect PII for debugging.
• C. Share PII with developers.
• D. Ignore privacy concerns.

Answer: (A)

Protecting personal information during testing means minimizing exposure by using data that isn’t real or isn’t tied to a person. The best approach is to avoid collecting or disclosing PII, redact sensitive data, and rely on synthetic or privacy-preserving test data. Redacting or masking real data keeps tests realistic enough to catch defects while preventing sensitive details from leaking. Synthetic data can reproduce typical patterns and edge cases without containing any actual person’s information, and privacy-preserving test data techniques maintain useful structure and relationships for meaningful testing. This approach reduces legal and security risk, aligns with privacy regulations, and still lets you validate functionality and report issues accurately. Collecting PII for debugging or sharing such data with developers, or ignoring privacy concerns, increases exposure and violates best practices for data protection.