locked profiles

we have a one to one support worker who is employed by agency to give 1 resident one to one support daily. She is able to access all the care plans for all residents, and therefore goes against all GDPR guidance, can there not be a feature where you can lock profiles for certain users? or she is unable to document her care on our care plan.