Compliant Data Sharing on custom objects and mixed public and private records
Key Takeaway
Compliant Data Sharing only adds access, and it works only when the object's org-wide default is Private or Public Read-Only. For an object with mostly public records and a few private ones, use a Private default, a criteria-based sharing rule for the public records, and participant records for the private ones.
Compliant Data Sharing lets admins and compliance managers control who can see a record. They give a user or participant group a participant role on that record. The role sets the access level. Compliant Data Sharing works on accounts, opportunities and custom objects. Because it adds access on top of the org-wide default, the default you choose decides whether participant roles do anything.
How a record gets shared
Compliant Data Sharing shares a record by creating a participant record. A participant record links a user or participant group, a participant role, and the record being shared. The object that holds the participant record depends on what you share.
| Shared record | Object that holds the participant record |
|---|---|
| Account | Account Participant (a junction object) |
| Opportunity | Opportunity Participant (a junction object) |
| Custom object record | Participant |
When a participant role is assigned to a participant, Compliant Data Sharing creates share table entries for the record. These entries carry the sharing reason Compliant Data Sharing.