testland/test-data-governance-reference

Pure-reference catalog of test-data lifecycle governance: retention schedules for test datasets, cross-environment data-sharing agreements, deletion of test data containing real PII, refresh cadence, access controls, and the legal basis for each policy under GDPR Art. 5 storage limitation and NIST SP 800-122. Use when defining a data-steward role for test environments, authoring a retention policy for a test database, scoping a data-sharing agreement before promoting a dataset from production to staging, or determining the deletion timeline for any test fixture that contains live personal data.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Cross-environment data-sharing agreements

Name: testland/test-data-governance-reference
Rating: 74.4 (1 reviews)
Author: testland

Referenced from SKILL.md. When a dataset moves between environments (production to staging, staging to dev, dev to a third-party test vendor), a data-sharing agreement (DSA) must be in place before the transfer. The DSA governs:

Purpose statement. The specific test goal that justifies the transfer (GDPR Art. 5(1)(b) purpose limitation). A vague "QA use" is not sufficient; name the sprint, the feature, or the compliance audit.
Data categories transferred. Enumerated from the cross-jurisdiction map in pii-categories-reference so all applicable regimes are in scope.
Receiving environment classification. Documents whether the target environment meets the access control and audit standard required for the tier (NIST 800-122 §4 control families apply here).
Retention limit in the receiving environment. Must be equal to or shorter than the source environment retention, never longer.
Deletion obligation. Receiving party must confirm deletion and provide a certificate no later than 5 business days after expiry.
Onward transfer restriction. The receiving environment may not forward the dataset to a fourth environment without a separate DSA. This prevents uncontrolled fan-out of high-impact datasets across test fleets.

Third-party vendors (outsourced QA teams, penetration testers, performance testing partners) accessing environments containing personal test data are processors under GDPR Art. 4(8) and require a Data Processing Agreement (DPA) in addition to the DSA. The DPA must specify the categories of data, the processing purposes, and deletion obligations at contract end.