Requests to access victims' personal records can only be granted when necessary and proportionate, under new guidance.