User data refers to any information a system collects, stores, processes, or transmits about the people using it – names, emails, passwords, payment details, session data, behavioural logs, preferences, uploaded content.
Testing Implications:
- Data privacy testing – verifies user data is handled per regulations (GDPR, CCPA): consent capture, right to erasure, data minimisation, cross-border transfer rules.
- Data security testing – checks encryption at rest and in transit, access controls, protection against injection attacks, exposure through error messages or logs.
- Test data management – synthetic or anonymised user data is used in test environments instead of real user data, to avoid exposing production data to testers or breaching compliance.
- Data validation testing – confirms user input is checked, sanitised, and stored correctly (field length limits, format checks, rejection of malformed input).
- Data integrity testing – confirms user data isn’t corrupted, duplicated, or lost during processing, migration, or system failure.
- Boundary and negative testing – user data fields are tested with edge cases: empty strings, maximum length, special characters, SQL injection strings, script tags (XSS).
Distinct from test data, which is data created or selected specifically to run test cases — sometimes derived from anonymised user data, sometimes fabricated.