I'm wondering what do other UX professionals do when they need to see personal information for a test? Like home address or salary? Especially if conducted at the company you work for?
First and foremost, make sure that you are following any legal requirements and corporate policies about the handling of personal data for both your location and your participants' location. Be especially careful about legal requirements for the handling of personal information if your country and the country(-ies) of your participants differ. Depending on what your usability study is about, there might be different levels of requirements for different types of personal information. For example, financial or medical information might need a higher level of security and privacy than simple demographic data like name or address. How you handle the disclosure of personal information should be part of the non-disclosure agreement that your participants sign to participate in your research. If the information that you might discuss is particularly sensitive, you should verbally confirm how you handle that information with your participants.
Second, make sure that you conduct yourself with the highest level of ethical behavior with personal information. If possible, create your test plan and test script such that you reduce the possibility that you will be exposed to personal information. If you must be exposed to personal information during the course of your research, or if the user spontaneously shares personal information, be clear what will happen with the personal information and that you will protect their privacy. For example, if a user shares their salary spontaneously and you are recording the session, you should remove or obfuscate that part of the recording so that no one else will be exposed to that personal information. If you have a legal or policy obligation as a result of being spontaneously exposed to that personal information, disclose that and what the obligation is.
When you are creating your research plan, make the determination of whether you need to see real user data or realisitic user data. If you can use realistic data, make it as realistic as possible. Use realistic names (go for something better than John Doe or Jane Smith) and data (fully populate lists, use unique values instead of repeated values, etc). Likewise, if any of your tasks are about data creation or manipulation, make those tasks as realistic as possible to continue the realism that you have started with the realistic pre-populated information.
If you do need to be exposed to personal information, clearly identify what steps you will take to protect that information, and make sure that this is clearly communicated to anyone participating in or observing the research. You might be able to record the session if you commit to removing or obfuscating any personal information that is shared, which can be very time-consuming. If you create any artifacts during your research session, safeguard them carefully until you can either either destroy the artifacts or redact them to hide the personal information.
You might have to limit participation or observation in research sessions where personal information might be disclosed. If you do have additional participants or observers, discuss how to handle that personal information part of your debriefing discussion immediately after the session has ended. If you are pressed for time, you might need to simply say, "that participant told us [something] that is personal, please do not discuss that personal information with anyone else".
At some point when conducting research, a participant is going to share personal information with you. Be thoughtful when it happens, and ensure that you do everything that you can to protect that information.
For the some of the solutions I design, we created quite a few "dummy" accounts for use in our usability tests. On some solution it is not possible to do this, so in those situation we will ask test participants to sign a NDA (Non Disclosure Agreement).
I design enterprise software for banks so some of our tests are performed on-site in the bank, and if there is sensitive data, we are not allowed to make video recordings or photos of the screen, which can present challenges. In those situations we need to be very careful with camera placement if we need to record any video. However you can still make video recordings of other things, e.g. participants face and mouse/keyboard, plus we can capture audio recordings.