Privacy-Preserving Retrieval over Enterprise Databases for RAG Systems: A Systematic Review and Research Agenda ^†

Abstract

Retrieval-augmented generation (RAG) is increasingly used in enterprise environments to support large language models with access to internal databases and knowledge sources. However, such integration introduces privacy risks related to retrieval leakage, prompt exposure, embedding leakage, and cross-boundary data disclosure. This paper presents a systematic review of privacy-preserving retrieval approaches for enterprise RAG systems. The analysis covers cryptographic methods, differential privacy, confidential computing, and hybrid protection architectures. A taxonomy and comparative perspective are provided, together with key research challenges and future directions. The findings show that layered and adaptive protection architectures offer the most promising path for privacy-aware enterprise RAG deployment.

1. Introduction

Retrieval-augmented generation (RAG) improves the factual grounding, contextual relevance, and domain specificity of large language model outputs by combining neural generation with retrieval from external knowledge sources [1,2]. Because retrieved knowledge can be updated independently of model training, RAG is especially attractive for enterprise environments where Large Language Model (LLM) based assistants must operate over internal and organization-specific data assets [3].

In enterprise settings, Retrieval-augmented generation (RAG) pipelines are increasingly connected to relational databases, document management systems, knowledge bases, data warehouses, and vector stores [1,2,3]. This model enables answers grounded in proprietary operational knowledge, but it also expands the privacy and security attack surface when the retrieved sources contain customer records, financial information, internal reports, legal documents, or intellectual property [4,5,6,7,8].

The privacy risks in enterprise RAG are not limited to direct exposure of stored data. Sensitive information may also be leaked through query intent, retrieved passages, metadata, embeddings, intermediate retrieval artifacts, and generated responses [4,5,6,7,8,9]. Recent research has shown that RAG systems may expose private information from the retrieval corpus under both untargeted and targeted attack settings, highlighting the need to protect not only the underlying database but also the retrieval process itself. This challenge is especially relevant in enterprise deployments, where retrieval components, vector indexes, middleware orchestrators, and external or semi-trusted LLM services may span multiple administrative and trust boundaries [3,6,10].

Traditional security mechanisms such as authentication, authorization, and encryption remain necessary, but they are not sufficient to address privacy leakage during retrieval and generation. As a result, increasing attention has been directed toward privacy-preserving retrieval techniques that protect sensitive enterprise data while preserving the utility of RAG workflows [6,7,11,12,13,14]. These techniques span several complementary directions, including searchable encryption and related cryptographic query mechanisms [11,13], confidential computing and trusted execution environments for protecting data in use [12], and differential privacy mechanisms adapted to retrieval-augmented generation settings [14]. Each of these directions provides distinct privacy guarantees and practical trade-offs with respect to retrieval quality, latency, scalability, and deployment feasibility.

Although the literature on RAG, secure retrieval, and privacy-preserving computation is growing rapidly, the specific problem of privacy-preserving retrieval over enterprise databases for RAG systems remains fragmented across multiple research communities. Existing work often examines isolated aspects of the problem without offering an integrated perspective centered on enterprise retrieval pipelines [3,4,6,7,8,10,11,12,13,14,15].

To address this gap, this paper presents a systematic review of privacy-preserving retrieval approaches applicable to enterprise databases in RAG systems. The review covers cryptographic, statistical, hardware-assisted, and hybrid approaches, and examines their suitability for enterprise deployment from the perspective of privacy guarantees, retrieval capability, system overhead, scalability, and practical integration constraints. Based on the reviewed literature, the paper also outlines a research agenda aimed at supporting the design of secure, privacy-aware, and operationally viable enterprise RAG architectures.

The main contributions of this paper are fourfold. It systematizes the emerging literature at the intersection of enterprise RAG, privacy-preserving retrieval, and secure database access; proposes a taxonomy of the main protection approaches; provides a comparative view of trade-offs between privacy strength, retrieval utility, and deployability; and outlines open challenges and future research directions for privacy-preserving enterprise RAG systems.

2. Related Works

The research landscape related to privacy-preserving retrieval for enterprise RAG systems spans retrieval-augmented generation, privacy risks in RAG pipelines, secure querying over protected data, and system-level mechanisms for protecting sensitive computation. Although these directions have advanced rapidly, they have largely evolved in parallel, and only limited work has examined them jointly from the perspective of enterprise database retrieval for RAG applications [3,4,6,13].

The literature was identified through searches in Google Scholar, Scopus, and the ACM Digital Library, using keyword combinations centered on retrieval-augmented generation, privacy-preserving retrieval, searchable encryption, confidential computing, differential privacy, and enterprise databases. Selection prioritized peer-reviewed journal articles and proceedings from established venues in the areas of AI, security, and information systems, supplemented by recent preprints where peer-reviewed alternatives were not yet available for emerging developments.

The first group of studies focuses on the foundations and development of retrieval-augmented generation. The original RAG paradigm was introduced as a framework that combines neural text generation with retrieval from external knowledge sources to improve factuality and knowledge grounding [1]. More recent review studies have expanded this perspective by analyzing RAG architectures, retriever designs, indexing approaches, and application domains [2,15]. However, in much of this literature, privacy and security are discussed only as secondary concerns rather than as core design requirements.

A second line of related work investigates privacy risks in RAG systems. Recent studies have shown that RAG pipelines may expose sensitive information contained in retrieval corpora through both direct and indirect mechanisms, including targeted extraction attempts and inference from generated outputs [4,5,7,8]. This research is especially relevant because it demonstrates that the privacy problem in RAG does not concern only the language model itself, but also the retrieval layer and the underlying knowledge sources. Nevertheless, these studies are mainly centered on vulnerability identification and attack evidence rather than on a broader synthesis of mitigation approaches suitable for enterprise database environments.

A third body of literature addresses cryptographic protection for search and query processing over protected data. Searchable symmetric encryption has been widely studied as a practical way to support search functionality over encrypted datasets, and recent survey work has systematized its main techniques, threat models, and leakage issues [11]. Closely related research on encrypted databases has also examined how SQL-like functionality can be supported over encrypted data and has compared different approaches according to security guarantees, supported query operations, and system efficiency [13]. These works are highly relevant to enterprise RAG because they address the central problem of enabling retrieval while reducing direct exposure of sensitive data. At the same time, most of them are not specifically designed for modern RAG pipelines that combine structured and unstructured retrieval, vector search, orchestration layers, and downstream prompting of LLMs [4,15].

Another important direction concerns hardware-assisted protection of data in use, particularly through trusted execution environments and confidential computing [12]. Recent survey literature has identified confidential computing as a promising approach for protecting sensitive workloads during execution by isolating code and data in trusted hardware-backed environments. From the perspective of enterprise RAG, this approach is attractive because it can support secure retrieval and context assembly without requiring all operations to be executed directly over encrypted data [5,10]. However, confidential computing alone does not fully address privacy threats such as query intent leakage, unsafe downstream context handling, or exposure through generated outputs [4,12].

A further emerging research line explores formal privacy guarantees for retrieval-augmented generation through differential privacy. Recent work has shown that privacy-preserving RAG can be designed under explicit privacy budgets, thus offering a mathematically grounded protection model [14]. This is particularly important because it moves beyond purely heuristic privacy measures and introduces a formal framework for balancing privacy and utility in retrieval-augmented generation. However, current studies remain relatively narrow in scope and do not yet provide a broader enterprise-oriented framework for combining differential privacy with secure database retrieval, access control, and hybrid protection architectures [6,7].

Overall, the existing literature provides valuable but fragmented insights. RAG research explains how retrieval improves generation [1,2,15]; privacy-focused RAG studies reveal new attack surfaces [4,5,7,8]; cryptographic and encrypted-database research contributes secure retrieval techniques [11,13]; confidential computing supports protected execution [5]; and differential privacy introduces formal privacy guarantees [14]. An integrated enterprise-focused synthesis remains missing, which motivates the present study.

3. Background on RAG Systems and Enterprise Databases

Retrieval-augmented generation combines the generative capabilities of large language models with external knowledge retrieval to improve factual grounding and domain relevance [1,2]. In a typical RAG pipeline, a user query is first processed by a retrieval component, which identifies relevant information from an external knowledge source. The retrieved content is then incorporated into the model input as contextual evidence, after which the language model generates a response conditioned on both the query and the retrieved material [1,2]. This architecture addresses one of the major limitations of purely parametric language models, namely their dependence on static knowledge acquired during training and their limited ability to provide up-to-date, domain-specific, and verifiable information.

In enterprise environments, RAG systems are particularly attractive because organizations increasingly seek to deploy LLM-based assistants over proprietary internal knowledge assets, including relational databases, document repositories, knowledge bases, vector databases, and internal content management systems. As a result, enterprise RAG typically operates as a multi-layer pipeline that combines retrieval, storage, indexing, context assembly, embedding-based processing, orchestration middleware, and downstream language model interaction. While this architecture improves flexibility and domain relevance, it also increases the number of points at which sensitive information may be exposed.

Another key characteristic of enterprise RAG is the coexistence of structured and unstructured retrieval. Classical databases are optimized for exact and declarative querying, while vector-based retrieval and semantic search operate over embeddings and similarity metrics. In many real-world enterprise deployments, both paradigms coexist within the same RAG pipeline [3,6,9,13]. For example, a user request may require information from a relational database, explanatory content from internal documentation, and semantic matching from a vector store. This hybrid retrieval setting complicates privacy protection because the relevant safeguards may differ substantially across structured SQL-style access, full-text document search, and approximate nearest-neighbor retrieval over embeddings [9,11,13].

To address these challenges, several families of protection mechanisms are relevant. Cryptographic approaches, such as searchable symmetric encryption and encrypted query processing, aim to support retrieval while minimizing direct exposure of the data [11,13]. Hardware-assisted techniques, particularly confidential computing, seek to protect data in use by isolating sensitive computation within trusted execution environments [12]. Statistical methods, including differential privacy, aim to limit information leakage in outputs or retrieval-dependent generation by enforcing formal privacy guarantees [14]. These approaches differ significantly in their security assumptions, privacy guarantees, implementation complexity, and suitability for enterprise-scale deployment, which makes a unified comparative perspective especially necessary.

The background outlined above shows that enterprise RAG is not merely an extension of conventional document retrieval for LLMs. It is a socio-technical system operating over sensitive and heterogeneous data infrastructures, where privacy-preserving retrieval becomes a central requirement rather than an optional enhancement [3,4,6]. This observation motivates the taxonomy presented in the next section.

The general architecture of privacy-preserving enterprise RAG is shown in Figure 1.

Figure 1. General architecture of privacy-preserving enterprise RAG.

4. Taxonomy of Privacy-Preserving Retrieval Approaches

Privacy-preserving retrieval for enterprise RAG systems can be organized into four broad categories: cryptographic approaches, differential privacy-based approaches, confidential computing approaches, and hybrid protection architectures [6,7,11,12,13,14]. The taxonomy is conceptual in nature and reflects a broader reading of the relevant literature that extends beyond the references cited in this paper; the reference list is constrained by the conference submission guidelines, which impose a maximum of 15 references for proceedings papers, and the cited works represent the most directly relevant sources for each category. This taxonomy reflects the fact that no single technical family is sufficient to address all privacy risks arising in enterprise RAG pipelines. Instead, each category protects different parts of the retrieval and generation process, relies on different trust assumptions, and introduces different trade-offs between privacy guarantees, retrieval utility, and deployment complexity [3,10,11,12,13,14,15].

The taxonomy of the identified privacy-preserving retrieval approaches is summarized in Figure 2.

Figure 2. Taxonomy of privacy-preserving retrieval approaches.

4.1. Cryptographic Approaches

Cryptographic approaches aim to enable retrieval while reducing direct exposure of sensitive enterprise data [11,13]. In this category, searchable symmetric encryption allows queries to be executed over encrypted datasets without requiring full decryption of the underlying content. Related techniques for encrypted databases extend this idea toward broader query support, including structured retrieval and selected SQL-like operations over protected data. These methods are particularly relevant to enterprise RAG because they address the core requirement of retrieving useful information from sensitive repositories while maintaining data confidentiality at the storage layer.

Within enterprise RAG settings, cryptographic retrieval mechanisms are attractive when the organization seeks strong protection of stored data and wishes to reduce trust in the storage provider or external infrastructure. However, such approaches often face practical limitations. Search functionality may be restricted, query expressiveness may be reduced compared with plaintext systems, and leakage through access patterns, query repetition, or metadata may remain a concern [11,13]. Moreover, the integration of cryptographic retrieval with semantic search, embedding-based retrieval, and multi-source orchestration remains an open challenge in many real-world RAG deployments [4,9].

4.2. Differential Privacy-Based Approaches

Differential privacy-based approaches seek to provide formal guarantees that the inclusion or exclusion of a specific sensitive record does not substantially affect the system’s observable output [14]. In the context of RAG, differential privacy may be applied to retrieval-dependent generation, response construction, or intermediate information release to limit leakage about the underlying enterprise data. This direction is conceptually important because it offers mathematically defined privacy guarantees rather than relying solely on heuristic protection or access control policies.

From the perspective of enterprise databases, differential privacy is particularly relevant when the system is expected to answer aggregate, analytic, or knowledge-oriented questions without exposing specific records. At the same time, its application to enterprise RAG is non-trivial. Privacy budgets must be managed carefully, excessive noise may reduce utility, and the balance between formal privacy guarantees and response quality becomes especially difficult in complex retrieval and generation workflows [7]. Consequently, while differential privacy is a powerful theoretical framework, its direct adoption in enterprise RAG often requires careful adaptation to the sensitivity level of the data, the nature of the query workload, and the acceptable degradation in output usefulness [14].

4.3. Confidential Computing Approaches

Confidential computing approaches protect data in use by executing sensitive workloads inside hardware-supported trusted execution environments or similar isolated runtime contexts. In enterprise RAG pipelines, this model can be used to protect retrieval, context construction, and selected orchestration functions without requiring all data operations to be performed directly over encrypted content [6,12]. This makes confidential computing an attractive practical option for organizations that need stronger runtime protection but also require acceptable latency and compatibility with existing enterprise infrastructure.

The main advantage of this category is its comparatively high practical deployability. Confidential computing can support existing software stacks more naturally than many fully cryptographic approaches and may therefore be easier to integrate into production RAG architectures [6,12]. However, it does not remove all privacy risks. Query intent may still be exposed outside the protected enclave boundary, unsafe downstream prompting may still leak retrieved content, and trust in the hardware, firmware, and attestation model remains necessary [4,10,12]. For this reason, confidential computing should be viewed as a strong system-level protection mechanism, but not as a complete substitute for retrieval-aware privacy design [4,12].

4.4. Hybrid Protection Architectures

Hybrid protection architectures combine multiple mechanisms to address privacy risks across different layers of the enterprise RAG pipeline [4,6,7,11,12,13,14]. For example, an enterprise system may use encrypted storage or searchable encryption for data at rest, confidential computing for sensitive retrieval or context assembly, access-control policies for user-level restrictions, and differential privacy for selected outputs or analytics-style responses. Such combinations are often more realistic than relying on a single protection mechanism because enterprise RAG typically spans heterogeneous data sources, retrieval modes, and trust boundaries.

Hybrid architecture is especially promising because it aligns with the layered nature of enterprise RAG. Structured database queries, document retrieval, vector search, context aggregation, and LLM prompting do not all require the same privacy mechanism, and forcing one method to cover the entire pipeline is usually inefficient or impractical [6]. Nevertheless, hybrid systems also introduce design complexity, additional integration overhead, and the challenge of coordinating multiple security assumptions within a single operational architecture. As a result, one of the main research questions is not simply which method is strongest in isolation, but which combinations provide the best balance of privacy, utility, and deployability in enterprise settings.

5. Comparative Analysis of the Identified Approaches

The identified categories of privacy-preserving retrieval approaches differ substantially in privacy guarantees, retrieval expressiveness, computational overhead, scalability, and practical suitability for enterprise deployment [4,6,7]. In enterprise RAG, selecting a protection mechanism depends not only on the required level of confidentiality but also on the data sources involved, query complexity, latency constraints, and organizational context.

A comparative summary of the identified protection categories is shown in Table 1.

Table 1. Comparative characteristics of privacy-preserving retrieval approaches for enterprise RAG.

Approach Category	Privacy Guarantee	Retrieval Capability	Scalability	Deployability	Main Limitations
Cryptographic approaches	Strong protection of stored and queried data; reduced exposure of raw content	Limited to moderate, depending on the supported encrypted search/query model	Moderate to low in complex retrieval settings	Limited to moderate due to integration complexity	Restricted query expressiveness, performance overhead, and possible access-pattern leakage
Differential privacy-based approaches	Formal privacy guarantees under explicit privacy budgets	Moderate for aggregate, analytic, or summary-oriented retrieval; limited for precise factual retrieval	Moderate	Moderate, but highly dependent on privacy budget design and task configuration	Utility degradation due to noise, difficulty in balancing privacy and response quality
Confidential computing approaches	Strong protection of data in use within trusted execution environments	High, since broader retrieval functionality can often be preserved	High to moderate	High compared with fully cryptographic methods	Dependence on hardware trust assumptions; risks remain outside the protected execution boundary
Hybrid protection architectures	Potentially strong, due to layered safeguards across the pipeline	High, as different mechanisms can be aligned with different retrieval tasks	Moderate to high, depending on the architectural design	Moderate	Increased system complexity, coordination overhead, and multiple security assumptions

To compare the identified approaches in a structured manner, several evaluation criteria should be considered. These include privacy guarantee strength, retrieval capability, computational overhead, scalability, integration complexity, and enterprise applicability [6,7]. Some methods primarily protect stored data, while others focus on limiting information disclosure during execution or response generation [11,12,14]. In enterprise RAG, this distinction is important because different parts of the pipeline may require different safeguards [10].

Cryptographic approaches generally provide strong protection of stored data and reduce direct exposure of sensitive information during retrieval [11,13]. They are particularly valuable in settings where the storage provider or infrastructure cannot be fully trusted. However, this protection often comes at the cost of limited query expressiveness, performance overhead, and residual leakage through access patterns or query repetition. As a result, cryptographic retrieval methods are well-suited to scenarios requiring strong confidentiality guarantees but may be less practical for highly dynamic, semantically rich, or low-latency enterprise RAG pipelines.

Differential privacy-based approaches occupy a different position in the design space [14]. Rather than protecting the retrieval mechanism itself in all cases, they aim to control the amount of information that may be inferred about specific records from outputs or retrieval-dependent responses [7]. Their main strength lies in the provision of formal privacy guarantees. However, these guarantees are achieved through privacy budgets and noise mechanisms that may reduce output accuracy or response utility. For this reason, differential privacy appears especially appropriate for analytic, aggregate, or summary-oriented enterprise RAG use cases but may be less suitable for settings where precise factual retrieval is required.

Confidential computing offers a more system-oriented form of protection [12]. Securing data during execution provides a practical means of reducing exposure in retrieval, processing, and context assembly stages without fully sacrificing system functionality [6]. Compared with purely cryptographic methods, confidential computing is often easier to integrate into existing enterprise infrastructures and may support broader retrieval functionality with lower redesign cost. However, it depends on trust in hardware-backed isolation mechanisms and does not inherently eliminate privacy risks associated with unsafe prompting, downstream misuse of retrieved context, or exposure outside the protected execution boundary.

Hybrid approaches appear to offer the most balanced solution for enterprise RAG [7]. Because enterprise retrieval pipelines are inherently multi-layered, combining multiple protection mechanisms often leads to a more realistic and adaptable architecture. For example, encrypted storage may protect sensitive repositories, confidential computing may secure context construction, and differential privacy may control disclosure in generated outputs [4,5]. Such layered protection is attractive because it aligns technical safeguards with the different attack surfaces of the enterprise RAG pipeline. At the same time, hybrid architecture introduces additional implementation complexity and requires careful coordination of trust assumptions, privacy goals, and operational requirements [6,7].

The comparison above reveals three central trade-offs: privacy strength versus retrieval utility, formal guarantees versus practical deployability, and architectural simplicity versus layered security. Stronger protection often limits retrieval flexibility or output fidelity, whereas more deployable solutions may leave residual leakage channels that must be addressed with complementary safeguards.

6. Privacy Risks and Threats in Enterprise RAG

Enterprise RAG systems introduce a broader privacy threat surface than conventional information retrieval pipelines because sensitive information may be exposed not only through direct database access, but also through retrieval results, prompts, embeddings, intermediate context construction, and generated outputs [4,5,6,7,8,9,14].

The main privacy risks and leakage points in enterprise RAG pipelines are summarized in Figure 3.

Figure 3. Privacy risks and leakage points in enterprise RAG.

6.1. Retrieval Leakage

A primary risk in enterprise RAG is retrieval leakage, where sensitive content from the underlying enterprise repository becomes exposed through retrieved passages or through the model response derived from them. Empirical studies have shown that attackers can induce RAG systems to reveal private content from the retrieval corpus, demonstrating that the retrieval layer itself becomes a direct privacy attack surface [4,5,6,7,8].

6.2. Prompt and Context Leakage

Another major threat concerns prompt and context leakage. In many practical RAG systems, retrieved documents or snippets are inserted into the final prompt provided to the language model. When this prompt is sent to an external or semi-trusted model provider, sensitive enterprise information may be exposed beyond the original data environment. Even when the underlying retrieval process is controlled, unsafe prompt construction or downstream handling of retrieved context can still lead to privacy violations [6,7].

6.3. Data Extraction Attacks

Enterprise RAG is also vulnerable to data extraction attacks, in which adversaries attempt to force the model to emit retrieved or memorized sensitive documents. Recent research has shown that compromised or manipulated components can be exploited to trigger document leakage from the retrieval database, including both verbatim and paraphrased extraction [5].

6.4. Embedding and Vector Leakage

A further emerging concern is embedding and vector leakage, especially in RAG architectures that rely on vector databases and embedding-based retrieval. Embeddings are often treated as less sensitive than raw text, yet recent work suggests that dense retrieval representations may still be vulnerable to privacy leakage, including text reconstruction from embeddings and related inversion risks. This issue is highly relevant for enterprise RAG because vector stores are frequently used as an integration layer for unstructured internal knowledge, and their privacy properties are often assumed rather than rigorously analyzed [8,9].

6.5. Inference and Cross-Boundary Risks

In enterprise environments, privacy threats are amplified by cross-boundary system design. A single RAG pipeline may involve internal databases, vector indexes, orchestration services, third-party APIs, and external language model providers [3,6,10]. As a result, even if individual components are partially secured, information may still leak through interactions between them. Recent enterprise-oriented systems have started to incorporate confidentiality-aware filtering and privacy-aware mitigation strategies precisely because uncontrolled augmentation can expose sensitive prompts and retrieved content to external components.

6.6. Implications for Enterprise Deployment

The risks outlined above indicate that enterprise RAG privacy cannot be reduced to a single issue, such as database encryption or model access control. Instead, privacy protection must account for the entire retrieval and generation lifecycle, including retrieval logic, prompt construction, embedding handling, model interaction, and output control. Recent mitigation-oriented work suggests that practical protection will likely require layered defenses rather than a single mechanism.

7. Research Challenges and Future Directions

Despite growing interest in privacy-preserving retrieval for RAG systems, several important challenges remain unresolved, especially in enterprise environments where sensitive data, heterogeneous infrastructures, and strict operational requirements coexist.

One central challenge is balancing privacy protection and retrieval utility [11,13,14]. Stronger protection mechanisms often restrict retrieval functionality, reduce query expressiveness, or degrade response quality. Future work should therefore seek methods that optimize the trade-off between privacy guarantees and retrieval effectiveness in enterprise settings.

A second challenge concerns heterogeneous enterprise data sources. Enterprise RAG commonly combines relational databases, document collections, vector stores, and internal knowledge bases in the same pipeline. Many existing solutions target only one of these settings, so unified protection models for hybrid retrieval remain an open problem.

Another unresolved issue concerns query privacy and access-pattern leakage [4,11]. Even when the underlying data is encrypted or otherwise protected, information may still be inferred from repeated queries, access frequencies, retrieval patterns, or contextual selections. This challenge is particularly relevant in enterprise deployments, where query intent may reveal sensitive operational priorities, legal matters, internal incidents, or commercial strategies.

The growing reliance on vector databases and dense retrieval creates a distinct set of privacy concerns that remain insufficiently understood [8,9]. Future work should therefore examine privacy-preserving vector retrieval, embedding minimization, safer representation learning, and stronger protection mechanisms for semantic indexing layers.

Enterprise RAG pipelines also span multiple trust domains, including internal data repositories, orchestration middleware, vector indexes, cloud services, and external model providers [3,6,10]. A key research direction is the development of secure orchestration frameworks that enforce privacy policies throughout retrieval, context assembly, model interaction, and output handling.

The reviewed literature further suggests that no single privacy mechanism is sufficient for all enterprise RAG scenarios [6,7,11]. Consequently, a major future direction is the design of layered and adaptive protection models that can dynamically select the most appropriate safeguards according to data sensitivity, query type, user role, and system context.

A further challenge is the lack of standardized evaluation frameworks for privacy-preserving enterprise RAG [2,11,14,15]. Existing studies often assess privacy, utility, and efficiency using incompatible metrics or isolated components of the pipeline. Shared benchmark suites would significantly improve comparability and practical relevance.

Finally, privacy-preserving enterprise RAG is not only a technical issue, but also a governance challenge. Enterprise deployments must operate under internal policies, contractual obligations, sector-specific regulations, and accountability requirements. Future research should therefore consider how privacy-preserving retrieval can be aligned with enterprise governance frameworks, including audit trails, policy enforcement, and demonstrable compliance mechanisms.

8. Conclusions

Retrieval-augmented generation has become an important architectural paradigm for connecting large language models to external knowledge sources, and its enterprise adoption is likely to expand further as organizations increasingly seek to operationalize domain-specific AI over internal data assets. However, when enterprise databases serve as retrieval sources, privacy protection becomes a central design requirement rather than a secondary system property.

This paper has presented a systematic review and research agenda for privacy-preserving retrieval over enterprise databases for RAG systems. The analysis has shown that existing approaches can be grouped into four broad categories: cryptographic approaches, differential privacy-based methods, confidential computing approaches, and hybrid protection architectures. Each category offers valuable capabilities, yet each also entails important limitations in terms of privacy guarantees, retrieval flexibility, computational overhead, scalability, and enterprise readiness.

A key finding of this study is that privacy-preserving retrieval for enterprise RAG cannot be adequately addressed through a single technical mechanism. Cryptographic methods provide strong protection of stored and queried data, but often at the cost of reduced query flexibility and higher overhead. Differential privacy offers formal guarantees, yet its practical adoption remains constrained by privacy–utility trade-offs. Confidential computing provides a more deployable systems-level solution, although it depends on hardware trust assumptions and does not eliminate all downstream leakage risks. In contrast, hybrid protection architectures appear to offer the most realistic balance for enterprise deployment, as they better reflect the layered and heterogeneous nature of real-world RAG pipelines.

The review has also shown that enterprise RAG introduces privacy risks extending beyond traditional database protection, including retrieval leakage, prompt and context leakage, document extraction attacks, embedding-related risks, and cross-boundary exposure across complex orchestration workflows. These risks make clear that end-to-end privacy protection in enterprise RAG must span not only data storage and query execution, but also representation, augmentation, generation, orchestration, and governance.

Beyond synthesizing the literature, this paper contributes a structured taxonomy, a comparative analytical perspective, and a research agenda focused on enterprise-specific challenges. In this sense, the study is intended not only as a review of existing work but also as a conceptual framework for guiding future research and practical design decisions in privacy-aware enterprise RAG.

Overall, the findings suggest that the most promising direction for future work lies in layered and adaptive protection architectures that combine complementary safeguards across the retrieval and generation lifecycle. Future research should therefore focus on unified evaluation frameworks, privacy-aware orchestration models, safer vector retrieval, and governance-aligned deployment strategies capable of supporting trustworthy enterprise RAG at scale. In summary, privacy-preserving retrieval should be regarded as a foundational design principle for enterprise RAG systems, and its effective realization will require continued integration of insights from cryptography, database security, confidential computing, privacy-preserving machine learning, and trustworthy AI.