From the Ten Immutable Laws of Security:
Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as its decryption key
Reminders of fundamentals out of the way, the other guys here pretty much have it right. Without a domain, you will not be able to effectively protect
C:\SensitiveData from NormalAdmin. Even with a domain, if the information is stored locally on a system where NormalAdmin has Administrator permissions, protection of that data via file permissions may still be ineffective. Plus, depending on how really worried you are about NormalAdmin getting access to this data, there's still the "physical access" issue.
The only protection that will likely survive attacks involving physical access, or an attacker with Administrator rights to the system, is file encryption. This is where Law #7 comes into play. If you're going to encrypt the files, and don't want NormalAdmin to have access, make sure that the decryption key is protected by some mechanism that NormalAdmin does not have, or cannot casually acquire, access to.
Even with file encryption though, NormalAdmin could still get the data if he wanted to try hard enough. With unrestricted, unsupervised physical access to the system (and especially with pre-existing Administrator privileges) he can pretty much do whatever he wants to it. This includes installing keyloggers or other spyware that could facilitate him gaining access to locally-stored decryption keys. Or, he could write and install a script to copy off the sensitive data whenever a user decrypts it. Granted, these methods are much more invasive and require a good deal more effort than just casually changing file permissions. But the point is that the risk still remains. See Law #6.
NOTE: All of the above is really only discussing access to the files in general - an all-or-nothing permissions scheme. If you want to get down to a scheme that allows NormalAdmin to have read access, but effectively prevents him from gaining write access, the problem gets even harder (if not impossible).