A multinational client is implementing Sales Cloud across North America and Europe. During discovery, the European council demands strict compliance with regional data privacy laws that restrict sales reps from viewing certain prospect personal data stored in North America. Which consulting practice and Salesforce feature combination should be deployed?
Trap 1: Rely solely on user training and internal policy agreements to…
Policy and training create no technical enforcement, so out-of-region reps retain record access through sharing settings. It is tempting because it is cheap and fast, and it suits low-risk internal governance. The correct approach combines a data-protection consulting assessment with Salesforce Shield Platform Encryption and restriction rules.
Trap 2: Deploy custom Apex triggers to delete prospect records immediately…
Deleting prospect records on creation destroys legitimate North American pipeline data and breaches audit and retention obligations; it also fails to restrict viewing. It is tempting as a blunt enforcement mechanism. The correct combination is a privacy consulting assessment plus field-level security, restriction rules or Shield Platform Encryption.
Trap 3: Create a single global profile and assign all users to the same…
A single profile with one public group grants every user identical record visibility, directly violating the regional restriction the European council demands. It is tempting because it minimises role maintenance overhead. The correct approach uses role hierarchy, sharing rules and profiles scoped by region alongside a data-protection consulting assessment.
- A
Implement Restriction Rules combined with Org-Wide Defaults set to Private and Role Hierarchies to technically enforce regional data visibility boundaries.
Restriction Rules filter which records specific users can access, and combined with Org-Wide Defaults set to Private plus Role Hierarchies they enforce visibility boundaries at platform level. This satisfies the European council's requirement that North American prospect personal data be technically hidden from regional reps.
- B
Rely solely on user training and internal policy agreements to ensure reps do not access unauthorized regional data.
Why it fails: Policy and training create no technical enforcement, so out-of-region reps retain record access through sharing settings. It is tempting because it is cheap and fast, and it suits low-risk internal governance. The correct approach combines a data-protection consulting assessment with Salesforce Shield Platform Encryption and restriction rules.
- C
Deploy custom Apex triggers to delete prospect records immediately upon creation if created by out-of-region users.
Why it fails: Deleting prospect records on creation destroys legitimate North American pipeline data and breaches audit and retention obligations; it also fails to restrict viewing. It is tempting as a blunt enforcement mechanism. The correct combination is a privacy consulting assessment plus field-level security, restriction rules or Shield Platform Encryption.
- D
Create a single global profile and assign all users to the same public group to simplify role maintenance.
Why it fails: A single profile with one public group grants every user identical record visibility, directly violating the regional restriction the European council demands. It is tempting because it minimises role maintenance overhead. The correct approach uses role hierarchy, sharing rules and profiles scoped by region alongside a data-protection consulting assessment.