...
The global permission Users and Permissions can indirectly give someone access to RDC data by elevating their own permissions. This one should be even more closely guarded than RDC permissions, but I mention it for the sake of completeness.
RDC Card Approvers
If you use subcontractor invoices, then your cost card approvers will be able to see hours worked and reimbursement amount.
...
The cost center permission Maintain Resources does not give you access to RDC data. Although you can edit everything else about a resource, you cannot view or edit RDC data.
Distributed Reports
Reports run by a user with RDC permissions that are distributed to other users can contain RDC data. Reports that are shared to other users may contain RDC fields, but the output will have RDC removed.
Reports
Reports can be distributed from users with access to RDC to users who do not have access to RDC. Ensure that your users with RDC access understand the implications of this and guard that data wisely.
...