The risks are essentially that you have far less control over a development/test environment, more people will have access to larger portions of the data, and it will be used and thought of in a far different way. Test data often needs to be sent to 3rd parties, across oceans, or other places where you have no control over it.
Essentially, count on your test data getting out of the database in one way or another via screenshots, email, etc. This doesn't have to be malicious and largely isn't. For the most part, it will be people merely trying to get their job done.
If the data is senstive in nature like medical records, you need to anonymise the data in some way, but still make it reflect production.