Notifications
Clear all
Topic starter
20/08/2026 5:53 pm
TL;DR: Salesforce does not reliably detect or delete PII in Cases, Email-to-Case, chats, files, or API records, so personal data can persist indefinitely unless teams automate cleanup, according to Strac. That exposes a retention and audit gap that privacy, IAM, and data security teams must treat as a governance issue, not a manual hygiene task.
NHIMG editorial — based on content published by Strac: How to Delete PII in Salesforce Automatically
Questions worth separating out
Q: How should organisations handle PII retention in Salesforce and similar CRMs?
A: Treat retention as a content-governance problem, not a manual cleanup task.
Q: Why do manual deletion processes fail for personal data in SaaS apps?
A: Manual deletion fails because personal data spreads across many objects and formats, including comments, attachments, screenshots, and integration-fed records.
Q: How do you know if a CRM retention control is actually working?
A: Look for consistent deletion coverage across all entry points, complete audit logs, and evidence that the same policy applied to text, files, and OCR-detected content.
Practitioner guidance
- Implement ingestion-time PII deletion Apply detection and delete policies at the moment data enters Cases, Email-to-Case, chat, file uploads, or API records so retention never depends on later cleanup.
- Extend policy coverage to attachments and images Enable OCR and file-content inspection so screenshots, scans, and PDFs are included in the same deletion workflow as text fields.
- Centralise deletion evidence Log every deletion event with timestamp, record source, and policy trigger so privacy teams can demonstrate retention enforcement during audits.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step configuration for detecting and deleting PII across Cases, Email-to-Case, Files, Chat, and API insertions.
- OCR and pattern-detection behaviour for PDFs, screenshots, and other image-based personal data.
- Admin notification and logging workflows that support GDPR and CPRA evidence requirements.
- Historical cleanup options for older Salesforce content and remediation of legacy records.
👉 Read Strac's guide to automatic PII deletion in Salesforce →
Salesforce PII retention gaps: what IAM and privacy teams need to know?
Explore further
20/08/2026 6:32 pm
CRM retention debt is the real governance failure here: once personal data lands in a system like Salesforce, the organisation often treats cleanup as an operational task instead of a policy outcome. That leaves comments, attachments, and integration-fed records exposed far longer than intended, especially when the data arrives outside a standard field. For identity and privacy programmes, the lesson is that retention controls must be enforced at the point of ingestion, not left to human memory.
A question worth separating out:
Q: Who is accountable when PII remains in a CRM longer than policy allows?
A: Accountability usually spans the data owner, the system owner, and the privacy or security function that defined the retention rule. If API paths, chat channels, or attachments are outside the policy scope, accountability also extends to integration owners and workflow administrators.
👉 Read our full editorial: Salesforce PII deletion exposes the retention gap in CRM governance
