In the old days, there was effectively a rule about using live (i.e. identifiable) data for training courses or for testing systems. You couldn’t do it. The Information Commissioner’s office used to say so. But now, the guidance is long gone from their website and different people have different opinions. There’s nothing wrong with that of course, and there are definitely arguments that can be mounted in favour of some use of personal data in these circumstances.

SPOILER ALERT: they’re not great.

This is an area to approach with considerable caution; my aim here is to give you ammunition to challenge somewhat lazy assertions that you have to use live data. If someone can put forward a reasonable case that the various alternatives won’t work, there are ways to manage the risks, but I’m not here to encourage you to dive in feet first. This is definitely an area for putting a toe gingerly into the water.