that's not entirely true - it's possible for all the data of that nature to be in an audit-logged data store, and to require specific business cases for access to the data. So you can only see a user's private information if there's a specific bug you're working on, and even then the access is audited.

I mean, the data is still accessible, it's just not easy to get it willy-nilly without setting off alarms.

Someone needs to build and maintain the audit log software.

True, but you don't need access to production data to build an audit logger. And any commits to it should involve code review.

Backup/restore of audit data can make things complicated. eg the ability to overwrite incorrect/damaged audit data (etc)

So far, I've not yet come across a system where some level of direct admin access isn't needed for at least "last resort" situations. (obviously, only available to a very specific set of trusted people)