Data security in ORC

Summary:

Would like to hear other people's opinions on this matter, but my organization has adopted ORC across all global regions and the question of user data in relation to GDPR has been raised.

Basically our managers has access to candidate search so in theory they can search for any candidate on our database and be able to view personal information.

Obviously we have GDPR policies that our employee's accept but would this be deemed as a risk to data management?

What's everyone's view on this matter?

Content (required):

23B

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):