You should just install the Cumulative Updates, instead. CUs are primarily a collection of security hotfixes month-to-month for SharePoint 2013, now. I recommend CUs over individual hotfixes as there have been issues with hotfix dependencies causing things to break if you didn't apply the correct ones, or newer hotfixes depending on a previous hotfix, etc.
For your issue, I will assume Survey in SharePoint 2013 will be good options for you.
Quote from your requirements:
someone from one organisation mustn't be able to see data from
another organisation 2) they shouldn't be able to see data from their
own organisation if they leave their organisation or change their job
It is a problem more related to ...
It's by design when you use the SharePoint online UI "Share site" button.
If we create a new permission level named TestPermission which contains "Manage Permissions" and replace the default Edit permission of the Member group:
Then the Share site will not work in UI:
Therefore, only the site owner can choose to grant permissions.
I did a test on my end and got the same result as yours. Seems that the Minimum level of activity "Accessed File" is site collection level. It's impssible to limit the policy to document library level.
As a workaround, I would suggest you create individual site collection for this library.
Agree with the @CarlF's answer. Just adding my 2 cents here.
Site collection administrators will always have access to all subsites, lists, libraries, folders and documents with no restrictions whatsoever.
Site collection admins should ideally be a small group of people. For example, limit them to the Service Desk AD group. Depends on the size of your ...
You can't. Even if you could, the Site Collection Administrators could just add themselves back.
The only actual way to keep documents secret from administrators, in almost any system, is to encrypt them on a different system before uploading, and only share the keys with the team you want to have access.