Building a system means touching its data, and that access is a responsibility, not a convenience. The rules I follow are simple and non-negotiable.
Work on anonymized or seeded data whenever possible. When production data is unavoidable, access it for the specific task, not to browse. Never copy it to a local machine without a reason and a cleanup plan.
Under the Data Privacy Act, this is a legal obligation, not only a matter of ethics. The developer who treats client data casually is a breach waiting to happen.
