Best Practices regarding custom role for Administrative purposes

Summary:

We have a customer that wants to have a custom role with just a few privileges/data roles in order to do certain administrative task so that HR or line managers do not have to perform these actions themselve. They don't want to give the certain person more access than needed because of the GDPR legislation.

What are the best pracitices regarding building a certain kind of role like this?

The person needs to be able to perform the following actions:

View and adjust:

• Personal details (only not the BSN);
• Contact information;
• Family and emergency contacts;
• Absence records;
• Oracle cloud learning.