How to Anonymize PII in PostgreSQL for Development

Ask any developer whether their local database has real customer data in it, and most will say no. Ask them to check, and most will find that it does. Real emails in users . Real names in profiles . Real billing addresses in payments . Real IP addresses in audit_logs . Data that landed in production, got copied somewhere for debugging, and has been sitting in local databases and CI pipelines ever since. This is not a hypothetical compliance problem. It is a real one, and it gets messier the longer it goes unaddressed. What counts as PII in a PostgreSQL database PII is broader than most developers expect. The obvious fields are easy to spot: email , email_address first_name , last_name , full_name phone , phone_number , mobile address , street_address , city , postal_code date_of_birth , dob ssn , national_id , tax_id But in real production schemas, PII hides in less obvious places: free-text fields like notes , description , bio that users fill in ip_address columns in event logs and a