Testing on real data is also a concern for some, I've seen people resort to generating fake data in contexts they can't use real data for infosec reasons.