How do you stop people from accessing files they shouldn’t?

I’m running a small team, and not everyone should see every file. Do you have tips for making sure sensitive stuff stays private?