"Companies all over the world are using real data on development and test platforms, and in our brave new GDPR world that’s hard – probably impossible – to justify."
The ICO have also been saying for several years not to do this:
“The ICO advises that the use of personal data for system testing should be avoided. Where there is no practical alternative to using live data for this purpose, systems administrators should develop alternative methods of system testing. Should the Information Commissioner receive a complaint about the use of personal data for system testing, their first question to the data controller would be to ask why no alternative to the use of live data had been found”