Sales teams hold more customer data than they realize

What you actually have

A sales team member with normal access typically holds:

• CRM contacts — names, emails, phone numbers, employer, title, sometimes more
• Notes from calls — what customers said, who they spoke to, their challenges, sometimes pricing context
• Recordings and transcripts — Gong, Chorus, Zoom recordings of meetings
• Conference scans and badge data — names, emails, sometimes phone, sometimes home address
• Prospect intelligence tools — Apollo, ZoomInfo, LinkedIn Sales Navigator — extensive contact info
• Deal documents — proposals, NDAs, redlines, signed contracts
• Demo accounts — sometimes with real-looking data, sometimes with synthetic
• Customer references — quotes, case studies, sometimes pre-public
• Email threads — months of correspondence per account

This isn't "just sales data." It's customer personal data, often Confidential under your classification policy, sometimes Restricted depending on industry.

The regulations that hit sales specifically

• CAN-SPAM — US email marketing rules; misuse of email lists has FTC penalties
• GDPR / UK GDPR — for EU-based prospects and customers; consent and legitimate interest matter
• CCPA / CPRA — California right-to-know and right-to-delete; sales records are in scope
• TCPA — US robocall/text rules; SMS prospecting has compliance limits
• CASL (Canada Anti-Spam) — strict opt-in regime for Canadian prospects
• Industry-specific — financial services suitability rules, healthcare HIPAA-adjacent rules

You don't need to memorize these. You need to know that sending an email is sometimes a regulated activity, especially internationally.

Real cases

• Sales reps using personal email to keep customer contacts — repeatedly cited in trade-secret and customer-data lawsuits
• CRM exports during departure — one of the top sources of trade-secret litigation
• Conference badge data sold or shared — regulatory issue when consent wasn't proper
• Demo environments containing real customer data — repeated breach incidents from forgotten demo instances