A development team needs realistic customer data but must not receive production identity values. The application does not need to recover those original identities. Which approach best fits?

1. Give developers the production decryption keys for convenience
2. Provide a suitably anonymized or synthetic dataset and validate reidentification risk
3. Copy production data and rename its storage bucket
4. Remove the database password but retain every personal field