Storing and organizing performance review data - SharePoint lists or something else?

While it CAN be done with SharePoint, the question is really one of SHOULD it be done. Personally, I think the complexity of managing all the permissions and the risks of getting it wrong are too great. It will be far easier and cheaper in the long run to get a purpose-built piece of software. Otherwise, this will become your entire life cuz it never stops with the initial "simple" request. Once you give them the one thing, then they want to expand and have something else and then they want to tie it to another thing. And "Hey can we use that data for X?" 

And then if it goes wrong and something gets out, it's a major privacy violation that I would not want to bear responsibility for. 

Trust me. Voice of experience. While it CAN be done, I don't think it SHOULD be done. Run screaming. Instead you can become the product owner for whatever system you buy and sleep well at night knowing that you won't be responsible for privacy violations.