1

I created a "Read Only" custom profile. I have a "Private" Record Type for the Contact Object. I would like to hide PII fields in the "Private" contact records for the "Read Only" custom profile. Use case: User with "Read Only" profile, can see a "Private" Contact named "Person 1" in a Related List. When they click the Contact record, they cannot see the PII info, but they can see a field called "Interests" (something that does not count as PII).

If the user with the "Read Only" profile opens another Contact with another record type, they get to see PII information.

Does anyone know about an out of the box feature in Salesforce that can allow me to do that? I though of creating a Page Layout without the PII fields assigned to the Read Only user, but I was wondering if there's an alternative. I read about Compliance Categorization, but it does not help me to do so!

Improve this question

2 Answers 2

Reset to default
0

You may find some of what you are looking for with Dynamic Forms.

That said, Dynamic Forms is a presentation-layer feature which uses visibility rules to determine whether or not a field or component is displayed on the UI, not a security feature which is enforced everywhere on the platform such as those enforced also on API calls.

The two features work together well, just do not presume that because a field isn't on the dynamic layout that the user cannot access it via some other mechanism.

Improve this answer
1
  • N.B. Dynamic Forms for Contacts is V56 (Winter 23)
    – cropredy
    Sep 14, 2022 at 0:49
0

Formula fields could be your answer to field visibility “at runtime” since existing FLS mechanisms do not dynamically change based on the record being viewed/queried. But formulas are evaluated when being queried/viewed so you can enforce this security everywhere in salesforce, not just record pages.

Try this:

  1. Remove all visibility to the existing PII fields from the Read Only Profile.

  2. Create a new formula field for each PII field. Assign visibility to the formula fields on the Read Only profile.

  3. In each formula field, output the PII field, or just blank text, when the criteria of record type name and current user profile are met. You will need to use advanced formula editor to access some of those merge fields.

The solution is based around the behavior of FLS not being enforced within a formula field calculation.

The downside is that the field label will still be visible, but the content at least is hidden when necessary. This will also not work if the field being passed through is an encrypted field type,

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .