A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.