they have access to the private data, by definition. the entire point is that it's not exposed nor is it used. clearly you've never worked at one of the companies in question lol. when you're on-call you might need to actually access private data.
true data sovereignty products are something countries in the EU are wanting USA companies to implement though, so then it's simply inaccessible, not public or private.
the industry is moving in this direction with things like AWS Outposts
When I was on-call and had to dive deep to solve customers' issues at one of those companies, we could only access anonymized data stripped of all PII (including emails and even IP addresses), to the point where the only non-scrambled things we could get were timestamps and error stacktraces/executed commands (which were also stripped of all PII, which made debugging a bit more difficult).
And every instance of access to that anonymized no-PII data required a physical authenticator, and it would automatically send an email to your manager (and some mailing group, i forgot) and create a special log that indicated "such and such was trying to access this anonymized ABC data for XYZ stated purpose".