Anyone out there have good prior art on internal organizational policies about access to user data?

(Like, if you're a tech company with users, who in the company has access to user data & under what circumstances? What's the written policy?)