A method implemented using one or more processors, comprising: receiving a free-form natural language text segment from a first user (140A, 101) via a client device (1061, 206, 406A) operated by the first user (140A, 101), wherein the free-form natural language text segment comprises a request pertaining to a second user; identifying at least first and second data sources (142-150, 252-256, 480-484) that are accessible by an automated assistant to retrieve data associated with the second user, wherein the first and second data sources (142-150, 252-256, 480-484) include sufficient data to respond to the request; determining a first privacy score associated with the first data source, wherein determining the first privacy score associated with the first data source includes determining that the first data source is local to a second client computing device operated by the second user; and determining a second privacy score associated with the second data source, wherein determining the second privacy score associated with the second data source includes determining that the second data source is available on one or more servers that are remote from any client computing device operated by the second user; determining an aggregate privacy score associated with responding to the request based on the first privacy score and the second privacy score, wherein the first privacy score has greater influence on the aggregate privacy score than the second privacy score; and causing the client device (1061, 206, 406A) operated by the first user (140A, 101) to respond to the request in response to a determination that the aggregate privacy score associated with responding to the request satisfies a privacy criterion established for the second user with respect to the first user (140A, 101). receiving a free-form natural language text segment from a first user (140A, 101) via a client device (1061, 206, 406A) operated by the first user (140A, 101), wherein the free-form natural language text segment comprises a request pertaining to a second user; identifying at least first and second data sources (142-150, 252-256, 480-484) that are accessible by an automated assistant to retrieve data associated with the second user, wherein the first and second data sources (142-150, 252-256, 480-484) include sufficient data to respond to the request; determining a first privacy score associated with the first data source, wherein determining the first privacy score associated with the first data source includes determining that the first data source is local to a second client computing device operated by the second user; and determining a second privacy score associated with the second data source, wherein determining the second privacy score associated with the second data source includes determining that the second data source is available on one or more servers that are remote from any client computing device operated by the second user; determining an aggregate privacy score associated with responding to the request based on the first privacy score and the second privacy score, wherein the first privacy score has greater influence on the aggregate privacy score than the second privacy score; and causing the client device (1061, 206, 406A) operated by the first user (140A, 101) to respond to the request in response to a determination that the aggregate privacy score associated with responding to the request satisfies a privacy criterion established for the second user with respect to the first user (140A, 101).