A system and method for applying a privacy policy to an application is provided. The system comprises a data store adapted to defining at least one privacy policy. The system also comprises an interceptor logic component operable to authorize access to information based on the at least one privacy policy. The system further comprises a middleware mechanism operable to receive a request for a service provided by the application, wherein the request relates to private data, to request the interceptor logic component to authorize the request, and to reject the request for the service for an unauthorized request.