All domain registrars are required to keep the contact information of all domain owners on their WHOIS database. This information includes the name, email and/or phone number, and potentially physical or mailing address of the domain owner. Naturally, this information in itself is not especially harmful and most of the world can acquire it through other means, but the WHOIS links all this information to your domain, enabling advertisers to connect any domain you own with your methods of communication.
Since domain registrars always store your information, they are allowed to hide that information from public view by presenting their own generic contact information on their WHOIS database while keeping your records secure. This WHOIS Protection is often an additional service but keeps unwanted parties from observing your contact information and relationship with any domain while still facilitating the proper transfer of domains through the registrars. Of course this kind of protection is not necessary, but it is often a very affordable and convenient way to keep spammers out of your inbox and phone line.
Yes; WHOIS protection is always optional, and it would be provided by the registrar that supplied your domain. As long as the contact information in WHOIS is related in some way to the domain, there is no legal issue with what the database displays to the public. WHOIS is intended to ensure domain transfer and ownership is smooth and accurate, and it is perfectly legitimate for the domain registrar to supply its own contact information in the place of yours, even though you are the true owner of the domain.
Sensitive information is not and has never been stored in the WHOIS database. Even the username and password you setup with your domain registrar is kept private; only your contact information as an owner of the domain is supplied by the WHOIS to the internet. Spammers and annoying advertisements are always frustrating and can hamper business communication, but ultimately they have no real capacity to steal your sensitive information or break into your website. With all that being said, WHOIS Protection is affordable, easy to setup, and can streamline your online business and personal interactions by helping to limit unwanted traffic.
It is the responsibility of the domain registrar that supplied you with your domain to publish your information in their WHOIS. If your registrar offers WHOIS protection then their website or support team should be able to fill you in on any steps you need to take to get the protection you want up and running. When shopping for domains make sure to check what the domain registrars offer as far as WHOIS Protection goes, how much it costs, and what provisos (if any) may apply.