A company is designing a new database for employee data. The database will store employment age, medical history, education, job history, performance reports, salary, increases and bonuses, and…

A company is designing a new database for employee data. The database will store employment age, medical history, education, job history, performance reports, salary, increases and bonuses, and location. The HR department wants to mine the information for patterns of different age groups, pay levels, locations, and so forth. The architect is concerned about some of this data being collected and stored in one central database and who has access to it. Where should the architect look for definitions on what information is controlled and what technical protections need to be employed?