Sensitive data should absolutely not be in use in dev & test servers that means the data needs to me masked in dev?
General Data Protection Regulation, California Citizens Privacy Act, Health Insurance Portability and Accountability Act, Federal Educational Rights and Privacy Act, Stop Hacks and Improve Electronic Data Security Act, Brazil Data Protection Law. If one, or more, of these don't apply to you and your data today, guaranteed, one, or more, will apply tomorrow. And, India is working on one, Canada is working on one, Australia, Illinois, Vermont, both Carolinas. Someone, somewhere is going to get you if you put protected information into unprotected servers.