This is very important and requires some foresight when the real data is personally identifiable information, private health information, etc.

It's possible, but requires designing a safe way to run pre-production code that touches production data. Which in practice means you better be sure you're only doing reads, not writes, and running your code in the production environment with all the same controls as your production code.