You are here:
Deselect Bypass Previewing for Data Management Policies Control
Forces preview mode for Data Management Policies, requiring admins to review impact on records before applying retention, masking, or deletion rules across large datasets.
Control Name
Data Management Policy Settings (De-select 'Bypass previewing for Data Management Policies').
Control Overview
Forces preview mode for Data Management Policies, requiring admins to review impact on records before applying retention, masking, or deletion rules across large datasets.
Description
When enabled (bypassed unchecked), policy execution shows a dry-run preview of affected records, counts, and samples before final commit. Prevents accidental bulk data loss or privacy violations from untested rules.
Recommended Configuration
De-select 'Bypass previewing for Data Management Policies' in Setup>Data Management Policy Settings to mandate reviews for all policies targeting high-volume objects.
Security Impact
Enforces deliberate review of data lifecycle actions, reducing risk of unintended PII exposure, premature deletion of audit evidence, or non-compliant retention enforcement.
Business Impact
Adds governance checkpoint for data policies, prevents operational disruptions from bad rules, and provides audit trail of policy reviews for compliance reporting.
Security Risk If Not Configured
Missing preview for data management and retention policies enables accidental execution of destructive or non-compliant rules without visibility.
Threat Scenarios
Misconfigured data management policies fail to enforce consent and data handling requirements, creating regulatory violations and user privacy breaches; insider errors or malicious bulk deletions bypass safeguards.
Estimated CVSS Score Range
High (7.0–8.9).
Risk Impact Considerations
Critical for orgs with data management requirements. Missing preview for data management and retention policies enables accidental execution of destructive or non-compliant rules without visibility.
Higher Risk When
Bulk policies on Person Accounts/Contacts with PII, automated execution schedules, delegated admin access without training, or complex matching rules.
Low Risk When
Small datasets, manual policy execution by trained admins, combined with Field Audit Trail and Event Monitoring for post-action verification.
Business and Integration Considerations
Select depending on the use case. Enable for production compliance, test policies in partial copy first.
Security Health Review Guidance
Select depending on the use case.
Who Is Impacted
Org admins creating or editing Data Management Policies, compliance teams reviewing retention rules, and data stewards managing lifecycle automation.
