How should you do your job so no employee has access to that information? I’m sure they could have been more careful, but the risk cannot be completely eliminated without going to impractical extremes...

Scope of Access Request is the usual implementation.

An employee should not be able to iterate millions of records without first asking for temporary powers.

You set the scope by measuring the usual required, and putting in a procedure for when and how much various supervisors can expand it.

Different departments will have different needs.

This stuff is already built in to industry standard software like SAP.

shakna already gave some good points, but a major one is the shared part.

Even if it's an admin that moves around a backup file from server a to server b, you don't allow anyone to bring in and connect USB drives. You don't allow personal laptops to access files (on that level - accessing a frontend is fine, see access limits) that leave the premises. That's not impractical, it's not extreme, it's just what you do when you handle very important data of millions of users.

Making sure nobody can access data wholesale is step one. You will fail at some point for some reason. Making sure no one can exfil large amounts of data is step two. If he wants to go James Bond on you and use a small camera to photograph his screen, good. Data leaks suck, but this way, it will affect a hundred people, not 2.9m.

Sure, but you need processes to get all the names and adresses every time you send statements by mail, for example. Someone somewhere needs to be able to access the data. Not “everyone”, but not “nobody” either. How do disable access from database admins? Do you keep all the listings in microfilms in a safe in a guarded room in the basement?

No, you do what he explained. Those DBs might have access to the customer DB, but no USB on those system.That access would also be logged at another location, listing date/time/user. It might also require a sign off from a manager/team that reviews record access of more than say 10,000 clients, etc. DBs would be informed of all these security factors, to desuade individuals from making bad choices.

Individually, none of the above would stop this kind of breach. Altogether, and it might be enough. You amply defense in depth