Who is allowed to view personal files?

We are a non-profit organization who receives funding from grants. The State and Federal agencies we receive our funding from requests to view our personal records. Is there a law prohibiting a person/agencies to view the companies personal files?
Comments
Our personnel policy requires a court order for state or federal agencies to view the contents of personnel files.