Visibility beyond Sharing Rules?

Question

our Org has a private Wide default settings. One custom profile doesn't have visibility on a particular Account recordtype (i.e. user with that profile can't read,cread,edit no records with that recordtype). The problem is this: users with that profile have visibility of some cases that are connected to account with that recordtype. In this way automatically the system gives visibility to that account even if the user should not see it.

How can I prevent this from happening?

The problem is connect with GDPR regulations. Thanks for help.

Answer 1

This behavior is called Implicit Sharing.

Access to a parent account—If you have access to an account’s child record, you have implicit Read Only access to that account.

Here, "child record" means

opportunities, cases, and contacts

You cannot disable implicit sharing at the level of record-level visibility. You can, of course, deny Field-Level Security at the Account level for sensitive fields, but this will apply across all records.

As an additional note, I want to point out that

user with that profile can't read,cread,edit no records with that recordtype

may be inaccurate. You do not control record-level access with record type settings. You may, however, have implemented Sharing Rules based on the Account's record type, which would provide access on that basis.