[parkersweb]

We've been going through the same exercise for the last 6 months. As a dev company that services a bunch of small to medium size clients we found we couldn't get insurance for data loss - and increasingly our clients require a clause in the contract that makes us liable.

One step we've had to take is to stop using copies of the live database in our dev environments (I suspect that practice is fairly common!). Instead we've build an automated rule-based system that produces 'munged' copies of the data (i.e. realistic size and type, but with no useful information), transferring that to our build and dev systems nightly - and reporting on what steps have been taken.

Shameless plug - we're also in the process of building plugins for platforms like Wordpress[1] to simplify some of this for smaller projects.

[1] http://datamunge.io

[noir_lord]

I've just inherited an absolute mess at the new place and yes production data in Dev was the norm, I rapidly started fixing that, starting with proper virtualized instances running with Dev configs etc.

It's bonkers how often I've seen that over the years.