Every node in a BigchainDB network has a full copy of all the stored data.
Everyone given access to a node via the BigchainDB HTTP API can find and read all the data stored by BigchainDB. The list of people with access might be quite short.
If the connection between an external user and a BigchainDB node isn’t encrypted (using HTTPS, for example), then a wiretapper can read all HTTP requests and responses in transit.
Storing Private Data Off-Chain
One can use BigchainDB to
Keep track of who has read permissions (or other permissions) in a third-party system.
Sadly, I may have overdone the literature survey in e943f16951c9981093508ba21831b30ed70a0995. It may be trimmed down later, but I believe this literature survey is informative.
20200207~20200212 Discussing blockchain databases in the literature survey
Useful links
BigchainDB, Privacy and Private Data
Basic Facts
Storing Private Data Off-Chain
One can use BigchainDB to
Further Notes