Regardless of regulations, I feel you can’t really stop what the employees do with the data. For every company, there is an employee who have the key to your data just doing their jobs, be it devs verifying data to sysadmins managing the backups. Sure you can have better auditing procedures and analyzing logs, but if its the group of guys especially at the head, its hard to prevent that. Social hacking is happening without us knowing it and that is what worries me more.