GDPR Compliance

Yes. GDPR applies wherever personal data is processed, and holding a test copy is processing. Article 32(1)(a) names pseudonymization and encryption as appropriate technical measures, which is why organizations pseudonymize or anonymize the copies they provision to non-production. Mage Data does this automatically at provisioning, so every non-production environment is compliant from the moment it exists.

Pseudonymized data, defined in Article 4(5), can still be linked back to an individual using additional information, so it remains personal data and stays in scope. Anonymized data cannot be re-identified by any means reasonably likely to be used and, under Recital 26, falls outside the Regulation entirely. Mage Data supports both: reversible tokenization where re-linking is needed, irreversible masking where it is not.

No, not by name. Article 32 requires technical and organizational measures appropriate to the risk and gives pseudonymization as an example rather than an obligation. Masking is the most established way of meeting that duty for personal data held outside production — and with Mage Data it is policy-driven, so the same GDPR classification group governs every database and file without per-system scripting.

Answering a request means knowing every system that holds that individual's data, including copies in non-production. Mage Data's discovery maintains that inventory continuously, and Citizen Map locates a specific data subject's records across it — turning a manual search across teams into a lookup, and a thirty-day scramble into a routine task.

Mage Data discovers and classifies personal data across databases and files using a built-in GDPR policy, pseudonymizes or removes it from environments that do not need it, applies role-based masking and monitoring where production access is required, and retains records of what was found and what was applied — the evidence supervisory authorities expect under Article 5(2).