Handling levels of data access

Ideally we want Zendesk to be a central source for information required for sales and support through a customer journey. How do people handle situations where you may want restricted access to certain profile information attached to a lead, contact or deal?

For example, perhaps there is personal or sensitive data that only certain agents can see at the final stage of a pipeline.