Demand response (DR) programs engage distributed demand-side resources, e.g., controllable residential and commercial loads, in providing ancillary services for electric power systems. Ensembles of these resources can help reducing system load peaks and meeting operational limits by adjusting their electric power consumption. To equip utilities or load aggregators with adequate decision-support tools for ensemble dispatch, we develop a Markov Decision Process (MDP) approach to optimally control load ensembles in a privacy-preserving manner. To this end, the concept of differential privacy is internalized into the MDP routine to protect transition probabilities and, thus, privacy of DR participants. The proposed approach also provides a tradeoff between solution optimality and privacy guarantees, and is analyzed using real-world data from DR events in the New York University microgrid in New York, NY.