This question can actually only be answered if you tell us where you are located.
Personally I consider the SysAdmin to be the person that is in charge of each and every bit of data, thus carries the largest risk when data is lost/exposed/abused (Even if you won't face legal consequences your boss will come to you and you will have to explain why on earth the data could get out of your company).
I personally make sure that:
- In case it's needed I can access each piece of information (everything, after all I'm the standing on the wrong side of the fan when shit hits it)
- I tell this to my boss
- I tell my boss that I won't access anything without permission
- I tell my boss that I will ask for another party to watch me and the requestor if I don't feel comfortable with the data access request
- I want all of the above signed and sealed in a written manner
Other things I make sure:
- Hear everything
- See everything
- Talk about nothing
These points aren't about snooping around in files or anything like that, it's just about the regular chatting with colleagues and co-workers and trying to fit together the different pieces.
Talk about nothing nothing means to not participate in the chatting from a certain point, people come to me regularly with requests about lost passwords, files to be restored or other stuff. That could lead back to ceertain opinions about otherwise hard working people, I don't want that.
- Tell everyone about the stuff my boss and I agreed over
This can be in terms of talking from person to person, company mails or posters with friendly reminders that there's a party in the company that could access all data.
These aren't exactly examples of laws colleagues or I stumbled over. But that is the part where "Talk about nothing" comes to play. Sorry to disappoint you with examples.