Are long privacy role 'when' statements normal?

My developers didn’t set up privacy roles, so I’m doing that now. Is something like this okay…

…or would I be better to create a ‘list of users’ field in the data type to accomplish this?

Thanks!