A privacy engineer reviews a microservices architecture where dozens of internal services exchange personal data over the corporate network. The team argues that because the traffic never leaves the internal data center, TLS between services is unnecessary and adds latency. A recent internal penetration test demonstrated that an attacker who compromised one host could passively capture plaintext personal data flowing between other services. Which recommendation best addresses the identified privacy risk while aligning with a defense-in-depth approach?