Question

A privacy engineer is designing a new internal REST API that will allow multiple downstream teams to request customer records. During architecture review, the engineer must decide how the API should behave when a calling service requests fields for which no specific access grant or documented purpose has been configured. Which design approach best embodies privacy by default?

Accepted Answer

Deny the fields by default and return only the attributes explicitly authorized for the caller's registered purpose

Answer

Return all available fields but log the access so unauthorized use can be reviewed after the fact

Answer

Return a masked version of every field so callers always receive a complete record structure

Answer

Return all fields for the first request and prompt the caller to confirm purpose on subsequent requests