Every company is different, but anybody with access to the database or tools can do whatever they want. There might be a papertrail(that can sometimes be edite

Every company is different, but anybody with access to the database or tools can do whatever they want. There might be a papertrail(that can sometimes be edited if it's centralized and you have sufficient privileges) but there is much less "regulation" than you think. Nobody from the government comes over like some kind of health inspector to make sure Employee 93457X isn't spying on people.