limit access to private files uploaded by webform to specific role
By default, users with the 'access all webform results' permission can view all webform private files.

If, for some reason you need them to be able to access the files but not the webform results, you could implement hook_file_download() - you could base your implementation on webform_file_download() in webform.module