Reply to post:

Just remember that if you are governed by the PCI DSS (and probably HIPAA, SOX, etc.), you can't use production data for anything else, so no cloning your DB servers for use in staging, cert, dev, reporting, etc.