diff --git a/system/service/user.go b/system/service/user.go
index 600e02f9b..ed257c5a3 100644
--- a/system/service/user.go
+++ b/system/service/user.go
@@ -130,6 +130,10 @@ func (svc user) FindByID(ctx context.Context, userID uint64) (u *types.User, err
 
 		uaProps.setUser(u)
 
+		if !svc.ac.CanReadUser(ctx, u) {
+			return UserErrNotAllowedToRead()
+		}
+
 		if err = label.Load(ctx, svc.store, u); err != nil {
 			return err
 		}
@@ -146,9 +150,6 @@ func (svc user) FindByEmail(ctx context.Context, email string) (u *types.User, e
 	)
 
 	err = func() error {
-		if !svc.ac.CanSearchUsers(ctx) {
-			return UserErrNotAllowedToSearch()
-		}
 
 		u, err = store.LookupUserByEmail(ctx, svc.store, email)
 		if u, err = svc.proc(ctx, u, err); err != nil {
@@ -157,6 +158,10 @@ func (svc user) FindByEmail(ctx context.Context, email string) (u *types.User, e
 
 		uaProps.setUser(u)
 
+		if !svc.ac.CanReadUser(ctx, u) {
+			return UserErrNotAllowedToRead()
+		}
+
 		if err = label.Load(ctx, svc.store, u); err != nil {
 			return err
 		}
@@ -180,6 +185,10 @@ func (svc user) FindByUsername(ctx context.Context, username string) (u *types.U
 
 		uaProps.setUser(u)
 
+		if !svc.ac.CanReadUser(ctx, u) {
+			return UserErrNotAllowedToRead()
+		}
+
 		if err = label.Load(ctx, svc.store, u); err != nil {
 			return err
 		}
@@ -203,6 +212,10 @@ func (svc user) FindByHandle(ctx context.Context, handle string) (u *types.User,
 
 		uaProps.setUser(u)
 
+		if !svc.ac.CanReadUser(ctx, u) {
+			return UserErrNotAllowedToRead()
+		}
+
 		if err = label.Load(ctx, svc.store, u); err != nil {
 			return err
 		}
diff --git a/tests/system/user_test.go b/tests/system/user_test.go
index 1f1200544..d2ce74b97 100644
--- a/tests/system/user_test.go
+++ b/tests/system/user_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/cortezaproject/corteza-server/system/service"
 	"github.com/cortezaproject/corteza-server/system/types"
 	"github.com/cortezaproject/corteza-server/tests/helpers"
-	"github.com/steinfletcher/apitest-jsonpath"
+	jsonpath "github.com/steinfletcher/apitest-jsonpath"
 	"github.com/stretchr/testify/require"
 )
 
@@ -84,6 +84,34 @@ func TestUserRead(t *testing.T) {
 		End()
 }
 
+func TestUserRead_forbiden(t *testing.T) {
+	h := newHelper(t)
+	h.clearUsers()
+
+	service.CurrentSettings.Privacy.Mask.Email = true
+	service.CurrentSettings.Privacy.Mask.Name = true
+	defer func() {
+		service.CurrentSettings.Privacy.Mask.Email = false
+		service.CurrentSettings.Privacy.Mask.Name = false
+	}()
+
+	u := h.createUser(&types.User{
+		Username:       "test",
+		Email:          "test@domain.tld",
+		Name:           "Name Here",
+		Handle:         "test_handle",
+		EmailConfirmed: true,
+	})
+
+	h.apiInit().
+		Get(fmt.Sprintf("/users/%d", u.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("user.errors.notAllowedToRead")).
+		End()
+}
+
 func TestUserListAll(t *testing.T) {
 	h := newHelper(t)
 	h.clearUsers()