Every API that touches personal data makes a privacy decision, whether anybody frames it that way or not: who can access this, on what basis, for what purpose, and for how long.
The most effective control is the least used one — data minimization. Do not return fields the consumer does not need. An endpoint that returns the whole user record because it was easier to serialize the model is a privacy incident waiting to happen, and it is the single most common design mistake in this area. Design responses around what the operation is for, and keep the sensitive fields behind a scope that has to be requested explicitly.
After that: scope access narrowly, log who accessed what, redact personal data out of your logs and traces, set retention deliberately and enforce it, and make sure your schema tells you which fields are personal so tooling can act on it. That last one — marking PII in the schema — is what turns privacy from a review meeting into something a linter and a gateway can enforce.
GDPR did the industry a genuine favor by forcing questions nobody had asked about their own data: what do we hold, where does it flow, who can reach it, on what basis. Those are API questions, and organizations with a mapped landscape and real contracts answered them far faster than everyone else.
