We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers.
Will this be allowed under GDPR? Do we need to get the Data Controller to document that we do this? Or will we have anonymise the data?