PIS/PASEP in privacy-first sandboxes
A PIS/PASEP directly and uniquely identifies a worker before INSS and FGTS: it is not an anonymous value, it is a key that ties a person to benefits, wages and employment history. Copying that number from a real employee to seed a test environment exposes personal data outside the context the person consented to.
The seed passes the same format checks as production, without an accidental dump from this environment exposing a real person link to wages and benefits.
Training or demo recordings tend to circulate beyond the original team; a synthetic number removes the need to blur the screen or audit who had access to the video afterward.
A bug tracker is often read by an external vendor or lives in a repository with permanent history; a synthetic value in the screenshot keeps the ticket from becoming a permanently archived leak.
They appear in different contexts, but many systems use the same 11-digit structure with a check digit.
Manually swapping digits almost always breaks the modulo-11 check digit, so the "anonymized" value fails validation and stops being useful for testing; and if someone fixes the check digit on purpose, there is still a risk of recreating another real worker number by coincidence, which solves nothing.
It falls under the general personal data category (it identifies a natural person), not the closed sensitive-data list (health, racial origin, etc.) in the law; even so, personal data still requires a legal basis and use minimization, which alone is enough reason not to keep it in a test environment without a need.
It depends on the layer under test: format validation and internal business rules work fine with any synthetic number carrying a correct check digit; only a real call into eSocial staging (which has its own official sandbox) would need a government-recognized number, and even then the right move is to use eSocial own sandbox, not a real employee record.
It is not the database field label that decides, it is the origin of the value: if the number came from a real enrolled person, it carries the same protection duty wherever it gets copied, and it is the data protection officer (DPO) or the internal privacy policy who should formalize the rule against ever reusing a real record outside production.
Generation happens locally in the browser. Analytics receives only action, status, type and format, never the generated PIS/PASEP.