diff --git a/app/config.py b/app/config.py
index 378c4e7..ec22594 100644
--- a/app/config.py
+++ b/app/config.py
@@ -25,7 +25,9 @@
 IS_OT = IS_DEV or IS_TEST
 IS_AZ = os.getenv("IS_AZ", False)
 
-IS_SHOW_BSN_ENABLED = os.getenv("MKS_IS_SHOW_BSN_ENABLED", not IS_PRODUCTION)
+IS_SHOW_BSN_ENABLED = (
+    os.getenv("MKS_IS_SHOW_BSN_ENABLED", "false" if IS_PRODUCTION else "true") == "true"
+)
 
 # App constants
 VERIFY_JWT_SIGNATURE = os.getenv("VERIFY_JWT_SIGNATURE", IS_AP)
diff --git a/app/helpers.py b/app/helpers.py
index 24804ee..6fd34e5 100644
--- a/app/helpers.py
+++ b/app/helpers.py
@@ -44,3 +44,15 @@ def get_request_template(name):
     filename = os.path.join(SERVICES_DIR, f"{name}.jinja2")
     with open(filename) as fp:
         return Template(fp.read())
+
+
+def remove_attr(input, attr):
+    if isinstance(input, dict):
+        for key in list(input.keys()):
+            if key == attr:
+                input.pop(key)
+            else:
+                remove_attr(input[key], attr)
+    if isinstance(input, list):
+        for list_item in input:
+            remove_attr(list_item, attr)
diff --git a/app/server.py b/app/server.py
index d93156b..91f4377 100644
--- a/app/server.py
+++ b/app/server.py
@@ -15,7 +15,7 @@
     UpdatedJSONProvider,
     get_application_insights_connection_string,
 )
-from app.helpers import decrypt, error_response_json, success_response_json
+from app.helpers import decrypt, error_response_json, remove_attr, success_response_json
 from app.service import mks_client_02_04, mks_client_hr
 from app.service.adr_mks_client_02_04 import get_resident_count
 
@@ -29,22 +29,6 @@
 app.json = UpdatedJSONProvider(app)
 
 
-def loop_throug_and_remove_bsn(dict_list, keys):
-    for key in keys:
-        for dict in dict_list[key]:
-            remove_atr(dict, "bsn")
-
-
-def remove_atr(object, atr):
-    if isinstance(object, dict):
-        for key in list(object.keys()):
-            if key == atr:
-                object.pop(key)
-                return object
-            else:
-                remove_atr(object[key], atr)
-
-
 FlaskInstrumentor.instrument_app(app)
 
 
@@ -54,11 +38,9 @@ def get_brp():
     with tracer.start_as_current_span("/brp"):
         user = auth.get_current_user()
         brp = mks_client_02_04.get_0204(user["id"])
+
         if not IS_SHOW_BSN_ENABLED:
-            remove_atr(brp, "bsn")
-            loop_throug_and_remove_bsn(
-                brp, ["kinderen", "ouders", "verbintenisHistorisch"]
-            )
+            remove_attr(brp, "bsn")
 
         return success_response_json(brp)
 
diff --git a/app/test_server.py b/app/test_server.py
index c299adf..f274c7a 100644
--- a/app/test_server.py
+++ b/app/test_server.py
@@ -3,6 +3,7 @@
 from unittest.mock import patch
 
 from app.auth import PROFILE_TYPE_COMMERCIAL, FlaskServerTestCase
+from app.helpers import remove_attr
 from app.server import app
 from app.test_mks_client_bsn_hr import get_bsn_xml_response_fixture
 from .test_02_04_model import RESPONSE_PATH, BRP_RESPONSE
@@ -105,3 +106,29 @@ def test_get_mac_hr(self):
     def test_empty(self):
         response = self.get_secure("/brp/hr", profile_type=PROFILE_TYPE_COMMERCIAL)
         self.assertEqual(response.status_code, 200)
+
+
+@patch(
+    "app.server.IS_SHOW_BSN_ENABLED",
+    False,
+)
+class ApiTestsBSNRemoved(FlaskServerTestCase):
+
+    app = app
+
+    @patch(
+        "app.service.mks_client_02_04.get_0204_raw",
+        lambda bsn: get_bsn_xml_brp_response_fixture(),
+    )
+    def test_brp_show_bsn(self):
+        response = self.get_secure("/brp/brp")
+        self.assertEqual(response.status_code, 200)
+
+        self.assertRaises(KeyError, lambda: response.json["content"]["persoon"]["bsn"])
+
+    def test_remove_attr(self):
+        obj = {"bsn": "xxx", "kids": [{"bsn": "xxx", "grandkids": [{"bsn": "xxx"}]}]}
+
+        remove_attr(obj, "bsn")
+
+        self.assertEqual(obj, {"kids": [{"grandkids": [{}]}]})