diff --git a/compose/rest.yaml b/compose/rest.yaml
index 12d48bc39..ea6e71428 100644
--- a/compose/rest.yaml
+++ b/compose/rest.yaml
@@ -985,6 +985,7 @@ endpoints:
       parameters:
         get:
           - { name: sensitivityLevelID, type: "uint64", title: "Sensitivity Level ID", required: false}
+          - { name: connectionID, type: "[]string", required: false, title: "Filter by connection ID"}
 
 - title: Charts
   path: "/namespace/{namespaceID}/chart"
diff --git a/compose/rest/data_privacy.go b/compose/rest/data_privacy.go
index 0a5fffb14..9d3707ab8 100644
--- a/compose/rest/data_privacy.go
+++ b/compose/rest/data_privacy.go
@@ -6,6 +6,8 @@ import (
 	"github.com/cortezaproject/corteza-server/compose/rest/request"
 	"github.com/cortezaproject/corteza-server/compose/service"
 	"github.com/cortezaproject/corteza-server/compose/types"
+	"github.com/cortezaproject/corteza-server/pkg/dal"
+	"github.com/cortezaproject/corteza-server/pkg/payload"
 )
 
 type (
@@ -49,6 +51,17 @@ func (DataPrivacy) New() *DataPrivacy {
 func (ctrl *DataPrivacy) ListSensitiveData(ctx context.Context, r *request.DataPrivacyListSensitiveData) (out interface{}, err error) {
 	outSet := sensitiveDataSetPayload{}
 
+	primaryConnID := dal.Service().PrimaryConnectionID(ctx)
+
+	reqConns := make(map[uint64]bool)
+	hasReqConns := len(r.ConnectionID) > 0
+	for _, connectionID := range payload.ParseUint64s(r.ConnectionID) {
+		if connectionID == 0 {
+			connectionID = primaryConnID
+		}
+		reqConns[connectionID] = true
+	}
+
 	// All namespaces
 	namespaces, _, err := ctrl.namespace.Find(ctx, types.NamespaceFilter{})
 	if err != nil {
@@ -64,6 +77,14 @@ func (ctrl *DataPrivacy) ListSensitiveData(ctx context.Context, r *request.DataP
 			return nil, err
 		}
 		for _, m := range modules {
+			conn := m.ModelConfig.ConnectionID
+			if conn == 0 {
+				conn = primaryConnID
+			}
+			if hasReqConns && !reqConns[conn] {
+				continue
+			}
+
 			// @todo ignoring this for now; revert after dev release
 			// if m.Privacy.SensitivityLevel == 0 {
 			// 	continue
@@ -87,6 +108,9 @@ func (ctrl *DataPrivacy) ListSensitiveData(ctx context.Context, r *request.DataP
 				Records: make([]sensitiveData, 0, len(sData)),
 			}
 			for _, a := range sData {
+				if len(a.Values) == 0 {
+					continue
+				}
 				nsMod.Records = append(nsMod.Records, sensitiveData{
 					RecordID: a.ID,
 					Values:   a.Values,
diff --git a/compose/rest/request/dataPrivacy.go b/compose/rest/request/dataPrivacy.go
index d16f7ab2d..b50658ab6 100644
--- a/compose/rest/request/dataPrivacy.go
+++ b/compose/rest/request/dataPrivacy.go
@@ -38,6 +38,11 @@ type (
 		//
 		// Sensitivity Level ID
 		SensitivityLevelID uint64 `json:",string"`
+
+		// ConnectionID GET parameter
+		//
+		// Filter by connection ID
+		ConnectionID []string
 	}
 )
 
@@ -50,6 +55,7 @@ func NewDataPrivacyListSensitiveData() *DataPrivacyListSensitiveData {
 func (r DataPrivacyListSensitiveData) Auditable() map[string]interface{} {
 	return map[string]interface{}{
 		"sensitivityLevelID": r.SensitivityLevelID,
+		"connectionID":       r.ConnectionID,
 	}
 }
 
@@ -58,6 +64,11 @@ func (r DataPrivacyListSensitiveData) GetSensitivityLevelID() uint64 {
 	return r.SensitivityLevelID
 }
 
+// Auditable returns all auditable/loggable parameters
+func (r DataPrivacyListSensitiveData) GetConnectionID() []string {
+	return r.ConnectionID
+}
+
 // Fill processes request and fills internal variables
 func (r *DataPrivacyListSensitiveData) Fill(req *http.Request) (err error) {
 
@@ -71,6 +82,17 @@ func (r *DataPrivacyListSensitiveData) Fill(req *http.Request) (err error) {
 				return err
 			}
 		}
+		if val, ok := tmp["connectionID[]"]; ok {
+			r.ConnectionID, err = val, nil
+			if err != nil {
+				return err
+			}
+		} else if val, ok := tmp["connectionID"]; ok {
+			r.ConnectionID, err = val, nil
+			if err != nil {
+				return err
+			}
+		}
 	}
 
 	return err
diff --git a/pkg/dal/service.go b/pkg/dal/service.go
index 6b1c33fb4..207c77d1e 100644
--- a/pkg/dal/service.go
+++ b/pkg/dal/service.go
@@ -225,6 +225,10 @@ func (svc *service) CreateConnection(ctx context.Context, connectionID uint64, c
 	return nil
 }
 
+func (svc *service) PrimaryConnectionID(ctx context.Context) uint64 {
+	return svc.primaryConnectionID
+}
+
 // DeleteConnection removes the given connection from the DAL
 func (svc *service) DeleteConnection(ctx context.Context, connectionID uint64) (err error) {
 	svc.logger.Debug("deleting connection", zap.Uint64("connectionID", connectionID))