What it asks for. Development, testing and production environments should be separated and secured. The aim is to protect production systems and data from being compromised or disrupted by development and testing activity.
In practice. Environments are logically or physically separated, with different accounts, credentials and network controls, and developers do not hold standing write access to production. Changes reach production through a controlled pipeline rather than manual copying. Production data is not used in test unless it is protected to the same level or masked. Evidence includes architecture diagrams, access lists for each environment, pipeline controls and the rules for using data outside production.
Common gaps. Copies of real personal data in test systems are a very common finding and a GDPR concern. Shared credentials or tooling across environments and emergency access to production that becomes permanent also undermine separation.