A GDPR compliant offshore development team builds and tests without real customer data by keeping production personal data inside the client's EU environment. Offshore engineers work with synthetic test data. Where realism is essential, masked or pseudonymized extracts are produced inside the client's boundary before anyone offshore sees them. A GDPR data processing agreement, standard contractual clauses and a transfer impact assessment then cover the narrow cases where personal data still reaches the team, such as production support.
For a European CTO, the real decision is whether to rely on contracts alone or to remove personal data from the pipeline. 724SOFTWARE delivers from Vietnam, which has no EU adequacy decision, and has built fintech platforms with eKYC and KYC/AML flows. That is why we recommend agreeing which data our engineers may see before an EU engagement starts.
TL;DR
Copying a production database to a Vietnam-based test environment is a restricted transfer. It needs safeguards such as SCCs and a TIA.
Synthetic test data contains no real people. Pseudonymized data is still personal data.
Generate test data as code, mask inside the EU environment, and scan logs for leaked identifiers.
An Article 28 DPA is still needed whenever the offshore team acts as a processor.
About the Author: This guide was written by the engineering team at 724SOFTWARE. We are a Vietnam software team of 200+ professionals (58% senior-level) delivering for clients in 10+ countries. 724SOFTWARE is GDPR compliant and aligned with ISO 27001:2022 standards.
Why is copying production data to an offshore test environment a GDPR problem?
The cheapest compliance control is the data you never send, and the transfer rules explain why. Offshore development means building software with a team in another country, often with a different time zone and labor market. For EU personal data, that destination changes the legal position:
No adequacy for Vietnam. EU personal data sent there requires appropriate safeguards, typically SCCs plus a TIA.
Data minimization covers testing. Personal data must be limited to what is necessary for the purpose. Testing a checkout flow does not need a real customer's name.
Articles 25 and 32 require appropriate technical and organizational measures. Pseudonymization is named as one example.
Already happening: DLA Piper's GDPR Fines and Data Breach Survey (January 2026) found that European supervisory authorities issued fines totalling approximately EUR 1.2 billion in 2025, with regulators remaining highly active in areas including information security and international data transfers.
Author's opinion: A production copy in staging tends to be the least monitored copy of your data. Deleting it removes more risk than any added clause.
What is the difference between synthetic test data, data masking and data pseudonymization?
If real data stays home, the next choice is which substitute each environment gets. The three options carry different legal weight.
Technique | What it does | Personal data under GDPR? | Typical use
|
|---|---|---|---|
Synthetic test data | Generates artificial records | No, if the generator does not reproduce real records | Dev, CI, offshore QA |
Data masking | Replaces values in a copy of real data | Depends on re-identification risk | Performance, migration testing |
Data pseudonymization | Swaps identifiers for tokens; a separate key reverses it | Yes | Analytics, record-linked debugging |
Pseudonymization works like a coat check. Your ticket number reveals nothing about you, but the cloakroom keeps the list linking tickets to owners. Anyone holding that list can reverse the process, so GDPR still treats the data as personal. Synthetic data has no list because there was never an owner.
Data masking tools fit when you need production-like volume. Run them inside the EU environment so the unmasked source never crosses the border.
How does synthetic data generation work for software testing?
Synthetic data generation, the first row of that table, creates artificial datasets that mirror the structure or statistics of real data. Two approaches dominate:
Rule-based generators: schemas and constraints written by the team. They produce format-valid identifiers, dates and deliberate edge cases.
Generative models: GANs, VAEs and diffusion models learn real distributions. They are often paired with differential privacy, which adds mathematical noise for quantifiable privacy protection.
Author's opinion: Functional tests prioritize edge cases over realistic distributions: a 120-character surname, a leap-day birthday, a currency without decimals. Generative models earn their cost in fraud rules and analytics. If you train one on real data, that training is itself processing personal data, so it belongs in the EU environment.
AI coding tools also help here without touching personal data. Claude Code can draft generators from a schema alone, with an engineer reviewing the output. 724SOFTWARE, a selected Anthropic partner in Vietnam, trains its engineers to use Claude Code in daily delivery.
What does a secure software development lifecycle look like when the offshore team never sees real data?
Decide once which data each environment may hold and enforce that decision in tooling. This builds GDPR requirements into every SDLC phase:
Classify data (client, BA): map personal fields to the schema.
Assign a tier per environment (client DPO, tech lead):
- Dev, CI and offshore QA: synthetic only.
- EU-hosted pre-prod: masked.
- Production: real data, client-controlled.Keep generators as code (offshore team): version-controlled and reviewed like features.
Mask inside the boundary (EU-hosted job): pull, mask, then publish.
Scan for leaks (DevOps): CI checks fixtures, logs and error payloads for identifiers.
Set a production-access protocol (both): access for incidents is time-boxed, approved and logged.
Watch for these failure modes:
A "temporary" production dump that is never deleted.
Error trackers capturing request bodies.
A/B tests collecting more personal data than the hypothesis needs.
Which contracts are still needed if real data never leaves the EU?
Good engineering shrinks the paperwork, but rarely removes it. Incident response and production support usually involve some access.
GDPR data processing agreement (Article 28): sets scope, purpose and security measures. Sub-processors need the controller's prior written authorization and inherit the same obligations.
Standard contractual clauses: the usual safeguard for transfers to Vietnam.
Transfer impact assessment: documents whether protection is equivalent. Author's view: a synthetic-only design narrows what the TIA must defend.
ISO 27001 in context: it aligns with Article 32 security measures but does not cover data subject rights or consent. ISO 27701 adds those.
What should you ask an offshore partner about test data management?
Stepping back from contracts, the real test is whether a partner can show the workflow rather than name a standard. Ask:
Which environments hold which data tier, and who approved it?
Can you walk through a sample generator script?
How are logs scrubbed?
Who are your sub-processors?
At 724SOFTWARE, the production-access protocol runs alongside a follow-the-sun model with incident response under 10 minutes, supported by a 24/7 SLA. Billing is based on actual working hours, and clients can monitor team delivery directly.
Frequently Asked Questions
Can an offshore team in Vietnam work on EU personal data?
Yes, with safeguards. Because Vietnam has no adequacy decision, you need SCCs, a TIA and an Article 28 DPA.
Is pseudonymized data exempt from GDPR?
No. A key can re-identify people, so it remains personal data.
Is synthetic test data always anonymous?
Only if the generator does not reproduce real records. Check any model trained on real data for memorization.
Do we need SCCs if the team only uses synthetic data?
Not for that work. Support access usually brings them back into scope.
Does ISO 27001 alignment mean GDPR compliance?
No. ISO 27001 covers security controls, not data subject rights or consent.
About 724SOFTWARE
724SOFTWARE is a Vietnam-based technology company that works as a long-term technology partner through dedicated teams, embedded staff augmentation and offshore development centres. Its engineers build web and mobile applications, with QA, DevOps and security testing inside the same team. The company is GDPR compliant and aligned with ISO 9001 and ISO 27001:2022 standards. It scales teams from 1 to 50+ pre-vetted engineers in 2-4 weeks, with a 95% client retention rate.
Decide which data tier each environment may hold, then work with 724SOFTWARE to build a team around that design at https://724software.com.vn/.
