[2-3] Access to sensitive HR records is restricted and regularly reviewed.