An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the purpose of their Job.
The 10,000 employee contracts cover an agreement with the Organisation that the Employee will not abuse any PII data.
Does the contract protect the Organisation, removing the need to implement Technical measures to restrict data access to the relevant 200 employees?