Technically, unless that data is encrypted with only the end user having access to the key or is being held/mediated by a third party, they do have access. It’s only company policy that’s preventing access, and a court can shred that policy with a court order on a case by case basis. Same goes for the third party. The end user has to be the only one with the key.