Big risk of having your privacy sensitive information stored on other infra than the main servers a path to get that information to your QA servers should not even exist.

Many more people that should not have access to that data, in bulk or otherwise suddenly have access which does an end run around all your - hopefully - carefully crafted security.

Keep in mind that what you think isn't privacy sensitive may very well be radioactive when combined with other data.