One approach to this problem could be to create a subset of data from Production and apply some means of obfuscation. Has anyone done this? How difficult did you find it and what method did you use?
It sounds like you're not after complete obfuscation, more about anonymising personal details so that test data doesn't need to be subjected to the same confidentiality constraints as production - and there's less risk with it being exposed out in the wild.
I've done something similar; with an import I used a script that anonymised some fields:
- the middle 8 digits of a 16-digit number were replaced by X characters (hide credit card details)
- each alphabetic character was replaced by a random alphabetic character (randomise email addresses)
Your first approach would be to properly categorise the data (perhaps at field level) into security levels - confidential, sensitive, private, personal, etc - to ascertain how it will be anonymised, and the level of obfuscation needed - consult your security policies to guide you, in particular compliance with laws and regulations. It should give you an idea of the scope of your task.
