To meet the HR team's requirements, the best approach is to create a shared drive for non-confidential files, give the HR team content manager access, and give view access to the organization. This setup ensures that the HR team can edit documents while the entire organization can view them. Confidential documents can be stored in a separate location with restricted access to mitigate risks.
Reference:
Google Workspace Admin Help - Create shared drives
Google Workspace Admin Help - Shared drives access levels

Granting delegated access allows the executive administrator to manage the executive's emails without requiring access to the executive's password. This solution ensures security and privacy by limiting the permissions to email management only, while keeping the executive's account secure. The executive administrator will be able to send, read, and delete emails on behalf of the executive, but they won't have access to other aspects of the account.

To provide the security team with access to the Security Investigation Tool, the appropriate privileges must be granted through a custom admin role.
Create Custom Admin Role:
In the Google Admin console, navigate to Admin roles.
Click on Create new role.
Assign Security Center Privileges:
Name the role appropriately, such as "Security Investigator".
Under Privileges, expand the Security Center section.
Select the necessary privileges, including access to the Security Investigation Tool.
Assign Role to Users:
After creating the role, go to the Admin roles section.
Click on Assign users and add the relevant security team members to this custom role.
Save and Verify:
Save the role and verify that the assigned users have the correct access.
Creating a custom admin role with specific security privileges ensures that the security team has the necessary tools to perform their duties without granting excessive permissions.
Reference:
Manage admin roles
Security Center overview

By activating OCR, the compliance rule set will work properly in order to reject the sensitive information captured in the image sent.

* Create Organizational Units (OUs):
* In the Google Workspace Admin console, go to "Directory" > "Organizational units".
* Create separate OUs for each country.
* Assign Admin Roles:
* Go to "Admin roles" in the Admin console.
* Create custom admin roles with permissions restricted to managing users, groups, and settings within their specific OU.
* Ensure that the role does not grant permissions to manage other OUs.
* Assign Country-Specific Admins:
* Assign the newly created admin roles to the appropriate administrators, ensuring they have control only over their respective country's OU.
References
* Google Workspace Admin Help: Create and manage organizational units
* Google Workspace Admin Help: Admin roles