Data Processing for CM

Find out more about data processing for CM.

Restrict Data Processing
To comply with certain data protection and privacy regulations, you may be required to restrict certain of your constituents' data within Salesforce, including for Case Management.

Restrict Data Processing

To comply with certain data protection and privacy regulations, you may be required to restrict certain of your constituents' data within Salesforce, including for Case Management.

We offer the following examples of common requests and considerations to help you plan how best to honor constituent requests around restrictions of data processing. These are only suggestions for your review, and not guaranteed steps for ensuring compliance with any legal rule.

Keep in mind that addressing constituent requests, including those provided for under the GDPR, can be challenging. A one-size-fits-all strategy may not always work, and you may need to adjust your approach when balancing organizational needs and legal obligations. For example, if exporting personal data to satisfy a GDPR data portability request may violate someone else’s rights, you might consider narrowing the fields in scope rather than exporting all data. If deleting personal data to satisfy a GDPR erasure request may conflict with other requirements around record preservation, you might consider anonymizing certain fields rather than wholesale deletion.

As always, there are pros and cons to each approach, including legal and business impacts and risks, and you are responsible for your own compliance obligations in your use of the Salesforce Services and Salesforce.org applications. You should work with your advisors, including legal counsel, to determine whether you are covered under a legal requirement, and come up with a compliance plan that’s best for your organization.

Salesforce resources:

Important Remember to review both Salesforce Platform documentation AND Salesforce.org product-specific documentation. In addition to the information in this table, review:

Common Constituent Request	Actions to Consider	Things to Consider
A client has reported that the personal data you have on file for her is inaccurate. Because of those errors, she wants you to stop processing her data until you’ve verified the data’s accuracy.	Export Data	Export the client's data to retain it. Then, delete her data from Salesforce. Work with your client to verify the data’s accuracy. Then, get her approval to resume processing her data.
A client has stopped receiving services from, or engaging with your organization and no longer needs his data. However, he asked that you keep his data because he’s involved in a legal proceeding that might require the data but does not want you to process the data.	Export Data	Personal data can exist in many different records and fields. Consider exporting these records and fields for your client: Contact Tasks Calendar events Personal data in unindexed, free-text fields You can find personal data in unindexed fields by exporting the data, and then searching for the information. You may also consider exporting: Case Plans Assessments Client Notes Program Engagements Service Deliveries Addresses Affiliations Cases Household Accounts Relationships Export the client's data to retain it. Then, delete his data from Salesforce. The export file should be in a structured, commonly used, machine-readable format that is transferable, such as a .csv. And if that person no longer wants you to keep the personal data you’ve collected, you can delete it. Note In order to preserve Case Plan history for reporting totals, consider assigning Case Plans, Client Notes, Assessments, Program Engagements, and Service Deliveries to an anonymous or placeholder Account. If you maintain a Sandbox environment, you may want to refresh the environment afterward to remove that constituent’s data from it, or log into the Sandbox and manually remove the data.

Common Constituent Request

Actions to Consider

Things to Consider

A client has reported that the personal data you have on file for her is inaccurate.

Because of those errors, she wants you to stop processing her data until you’ve verified the data’s accuracy.

Export Data

Export the client's data to retain it. Then, delete her data from Salesforce.

Work with your client to verify the data’s accuracy. Then, get her approval to resume processing her data.

A client has stopped receiving services from, or engaging with your organization and no longer needs his data. However, he asked that you keep his data because he’s involved in a legal proceeding that might require the data but does not want you to process the data.

Export Data

Personal data can exist in many different records and fields.

Consider exporting these records and fields for your client:

Contact
Tasks
Calendar events
Personal data in unindexed, free-text fields

You can find personal data in unindexed fields by exporting the data, and then searching for the information.

You may also consider exporting:

Case Plans
Assessments
Client Notes
Program Engagements
Service Deliveries
Addresses
Affiliations
Cases
Household Accounts
Relationships

Export the client's data to retain it. Then, delete his data from Salesforce. The export file should be in a structured, commonly used, machine-readable format that is transferable, such as a .csv.

And if that person no longer wants you to keep the personal data you’ve collected, you can delete it.

Note In order to preserve Case Plan history for reporting totals, consider assigning Case Plans, Client Notes, Assessments, Program Engagements, and Service Deliveries to an anonymous or placeholder Account.

If you maintain a Sandbox environment, you may want to refresh the environment afterward to remove that constituent’s data from it, or log into the Sandbox and manually remove the data.