According to the AgentForce Data Governance and RAG Security Guidelines, when implementing retrieval-augmented generation (RAG) using Data Cloud search indexes, best practice is to ensure that personally identifiable information (PII) and other sensitive data are never indexed or embedded in the retrieval system.

The documented recommendation is to mask or exclude sensitive fields before creating embeddings or indexing content. This prevents the large language model (LLM) from accessing or generating responses that could inadvertently expose confidential information. Masking can include redacting names, IDs, contact details, or any regulated medical information.

Option A is incorrect because relying solely on prompt instructions does not prevent the retrieval layer from exposing sensitive content. Option B is also incorrect — encryption alone does not mitigate privacy risk since embeddings can still semantically reveal PII if indexed.

Therefore, the correct best practice is Option C – Mask sensitive fields and index only non-PII data, ensuring compliance with security and data privacy standards such as HIPAA and GDPR.