best way to configure security roles to restrict access to confidential HR data

What’s the best way to configure security roles to restrict access to confidential HR data for certain employee groups?

We want to protect specific HR data fields (e.g., salaries, performance reviews) so that only authorized HR team members can view or edit them. However, other HR personnel should still access general information.