Salesforce Docs Portal

Create a Data Detect Policy and Run a Scan

Data Detect scans search for sensitive ‌data across selected objects and fields. Create multiple policies that help you find sensitive data that users inadvertently enter into fields across your Salesforce org.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, Unlimited, and Developer Editions

Data Detect requires the Salesforce Shield add-on subscription.

User Permissions Needed
To create, edit, and view Data Detect policies Manage user access to Data Detect feature
Note
Note When creating a scan policy, know your limits. These limits include no account objects in orgs with person accounts enabled. Users can only view and scan objects that they have access to. For selected objects, Data Detect scans ‌these fields: text, long text, long text area, text (encrypted), and rich text (only plain text is scanned for sensitive information) in standard and custom objects.
Note
Note To enable a user to view scan results for fields that use Classic Encryption, assign the View Encrypted Data user permission. Because encrypted data is processed differently than standard data, scanning these fields takes longer. Including encrypted fields in a scan configuration can increase the total scan duration.
  1. From the App Launcher, select Data Detect.
  2. Select the Policies tab and select New. The Policies tab is where your policies reside after they’re created.
  3. Select the type of data the policy scans.
    • Salesforce Data Org: Scan objects in your Salesforce org.
    • Data 360 Data: Scan Data Lake Objects (DLOs) from Salesforce Data 360. The following steps refer to objects, but apply to DLOs too. For Salesforce Data 360, time frame and frequency, object filters, and keywords aren't available. Skip the steps that include them.
  4. On the Policy Details page, enter a name for your policy. The policy name can contain characters A–Z, a–z, 0–9, Hyphen (-), and Underscore (_). Optionally, add a description.
  5. On the Scan Scheduler page, set the policy’s time frame and frequency.
    1. Select whether your scan runs one time or recurs on an automated schedule. For recurring scans, select the time interval to scan and how often to repeat the scan.
    2. For a time frame, select a duration in the past to scan for your data. Select a custom time frame or choose from the last: 30 or 90 days; 6 or 12 months, or all time. All time goes back to the date that the org was created.
    3. Review the summary to confirm the schedule is correct.
    Data Detect scans for any new or changed data made within the selected time frame. You can select a random time frame to collect a historical subsection of sensitive data.
  6. On the Select Objects to Scan page, select what objects to scan for data, and what filters to apply to refine your scan.
    1. In the Filters section, select fields to exclude from your scan.
      • Encrypted Fields: Select whether to scan encrypted fields.
      • Sensitivity Level: Select what sensitivity levels to exclude from your scan. For example, exclude Internal and Confidential level objects if you know that they always contain sensitive data.
      • Compliance Classification: Select what compliance acts, definitions, or regulations are related to the field's data, so you can exclude fields that are already identified with sensitive data, such as GDPR or PII.
      • Data Type: Select what types of data to exclude to reduce scan time.
      • Field Usage: Select what fields to include based on how frequently they're used.
    2. In the Select Objects section, select specific objects to scan. Select up to 100 objects (that you have access to) per scan.
  7. On the Detection Criteria page, select what information your scan detects.
    • Sensitive Data Categories: Pre-defined categories of recognized patterns for sensitive data. Reduce scan time by selecting only the categories that you need. Refer to Sensitive Data Categories for the complete list of categories.
    • Custom Patterns: If your data has known patterns for sensitive data, add a regular expression (regex) pattern to scan for in your data. Add up to 10 regex patterns.
    • Keywords: If you have known constant strings to identify as sensitive data, add them as keywords. Either manually enter up to 10 keywords, or upload a .csv file containing a dictionary of keywords.
  8. On the Review page, confirm your policy settings and click Save. To start the scan immediately, click Save & Run a Scan. If your scan is recurring, click Save & Schedule Scan.

Your policy is added to the Policies list. Run your scan manually by selecting it from the list and clicking Scan Policy.

After you've started a scan, view its status by selecting the job ID in the Job Sessions tab or by selecting the policy from the Policies list.