Always return defensive copies of objects that aren't immutable if you don't intend for the user of your API to make changes to them.

In C#, structs are a value type so you don't need to make a defensive copy of them. You need to make clones and/or copy constructors of classes to make defensive copies.

However, collections in particular have a bunch of special methods to handle it: In C#

• Array.AsReadOnly(T[]) is a static method that will return a ReadOnlyCollection that is a wrapper around the array
• List has .AsReadOnly() to wrap it in a ReadOnlyCollection
• For Dictionaries, you can instantiate ReadOnlyDictionary directly; its constructor takes an IDictionary