How do I know who has access to sensitive business data?

Create a list of the systems and locations where sensitive data is stored, then review the users, groups, shared links, and service accounts that can reach it. Compare that access with each person's actual job. Remove access that is not needed and repeat the review regularly.