Which of the following examples is BEST to minimize the attack surface for a customer's private information?

Obfuscation makes data harder to interpret but does not reduce the volume of sensitive data stored or collected, leaving the same attack surface intact.

Collection limitation is a foundational privacy principle (enshrined in frameworks like GDPR and NIST Privacy Framework) that reduces attack surface by ensuring only the minimum necessary personal data is gathered and retained. Less data collected means less data available to be breached, stolen, or misused, directly shrinking the potential impact of a security incident.

Authentication controls who can access data but does not reduce the amount of private data collected or stored, so the attack surface of the data itself remains unchanged.

Data masking hides portions of data during display or processing but the underlying sensitive data still exists in storage, meaning the attack surface is not fundamentally reduced.