The privacy rules are set by data type and field are more to do with protecting data and access to fields at the database level. To manage access to records, you should either have a permissions field, or have a separate permissions data type to manage permissions for each record. you will likely also want to manage who can manage the permissions on each record.