Handling Work Email and Personal Data in Security-Conscious Industries for Customer Marketing Tools

Hey folks, is anyone here in a security-conscious industry? Right now my company doesn't ingest end-user emails—we only use hashed IDs. That’s making it very hard to use any modern customer marketing tools, especially as we evaluate a CDP. I’m trying to make the case to our Chief Security Officer that ingesting work email + first name + last name, with clear opt-out controls, is a reasonable tradeoff. Is this generally considered standard practice in your world? I get that this is common for productivity SaaS, but I’m not sure how it plays in more security-sensitive environments. Would love to hear how your teams handle it.