In addition to the audit controls, some kind of permission controls or model. Not just the ACLs you've established internally for which personnel can do what,

In addition to the audit controls, some kind of permission controls or model. Not just the ACLs you've established internally for which personnel can do what, but ensuring that you have express permission of that particular customer to be looking at that particular data of theirs, on that occasion.