Hi,
epesi access rights (permissions) are managed via phpGACL (http://phpgacl.sourceforge.net). A developer specifies rights per module, here is an example from modules/CRM/Tasks/TasksInstall.php installation file:
$this->add_aco('browse tasks',array('Employee'));
$this->add_aco('view task',array('Employee'));
$this->add_aco('edit task',array('Employee'));
$this->add_aco('delete task',array('Employee Manager'));
$this->add_aco('view protected notes','Employee');
$this->add_aco('view public notes','Employee');
$this->add_aco('edit protected notes','Employee Administrator');
$this->add_aco('edit public notes','Employee');
It is possible to change those settings. Unfortunately at this moment we don't have GUI to adjust permissions via Admin's Control Panel.
Your question is not a technical one, but rather related to the way you want to control your business/organization. We had to make certain assumptions - Superadministrator for example can do anything, while Employee can not delete records that he/she did not create. But in principle data that is marked as private should remain private.
In reality an admin can still view a table or edit a record and change setting from private to public.