Org setup to turn on Compliant Data Sharing for an object
Key Takeaway
To use Compliant Data Sharing for an object, set the object's org-wide default to Private or Public Read Only. Then turn on the "Compliant Data Sharing for CRM Users" toggle for that object in "Object Enablement Settings".
Compliant Data Sharing gives specific users, called participants, access to individual records beyond what the org-wide defaults allow. A team can then see sensitive records, such as deals that contain material non-public information, while other users can't. Before Compliant Data Sharing works for an object, you prepare the org in a set order: restrictive org-wide defaults, the object turned on, permissions assigned, and access to the parent object granted.
How Compliant Data Sharing adds access
Compliant Data Sharing only adds access on top of the org-wide default. Participants are the users given access to a record through Compliant Data Sharing. Participant roles set the participants' default access levels.
Because Compliant Data Sharing only adds access, the object's starting default matters. If the default is Public Read/Write, everyone can already access the records, so Compliant Data Sharing has no effect on a participant's access.
Your org keeps confidential pitch books in a custom object, and that object's org-wide default is Public Read/Write. You make Tomas a participant on one pitch book. Every user, Tomas included, could already open that record, so his participant access changes nothing. After you set the default to Private, the record is no longer open to everyone, and Tomas reaches it through Compliant Data Sharing.