Due to privacy rules and regulations like GDPR, PCI and HIPAA it is not allowed to use privacy sensitive personal data for testing. But anonymized (and preferably subsetted) production data may be used as representative data for test and development.
Because of privacy rules such as GDPR, PCI, and HIPAA, using private information for testing is not allowed.  However, anonymized and possibly reduced versions of real-world production data can be utilized to test and develop software.