Tom Thomson is now even more right in a GDPR world.  With a €20millon fine hanging on it you want to make sure that all steps to prevent exposure of personally identifiable data are absolutely bomb proof.
5 years ago a restore from production was probably acceptable but a bit dubious legally even in non-regulated industries.  The game has moved on.  The consequences and likelihood of data breach have escalated.