What file or data I should NOT give outsourcing developer for security when they need a copy site of my site? I'm asking a outsourcing developer to modify some part of my site and then he needs the copy of my site as a test site.
My site is already working site and has users registered. What comes in mind first is deleting user table from database to protect the personal information. 

And the what else I should NOT give the developer? I trust the one who works on my site of course. But in generally is there any files or database table that can be harmful if　the third party obtains?
Deleting the user table might break features that rely on node authors or some other user information. Try setting every user's email to email@mail.com and their password to 'password'. You shouldn't give the settings.php file, since it has your database credentials and the cryptographic salt Drupal uses to hash users' passwords.