Security forwards you a message Monday afternoon. A rep's Salesforce credentials were phished, and their account was active for most of the weekend. The question for you isn’t an easy one to answer: what did they open?
If your org holds personal data on people in the EU, that question has a clock on it. Under GDPR, a controller has to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put people at risk. Your GDPR breach notification has to describe the categories and approximate number of people and records involved. If you can't scope it, you either over-report everything the user could reach, under-report and hope, or miss the window while you argue about it.
What does GDPR Article 33 ask for?
GDPR doesn't tell you to log every record view in your CRM. That's worth saying plainly, because it isn't what the regulation requires. Your DPO or counsel decides what's notifiable.
What it does is define a personal data breach broadly. Unauthorised access counts, not only loss or theft, so a compromised account that only looked at records can still be in scope. Article 33 then asks you to describe the categories and approximate number of data subjects and records concerned, and to document the breach and what you did about it, in a way a regulator can check.
Those are questions about what happened to specific records. Most of the tooling admins have in Salesforce answers a different question.
What can Salesforce permissions, change history, and export logs tell you?
Permissions tell you what the compromised user was allowed to see. That's useful, but it's usually far more than they touched, and scoping the breach to everything a rep's profile reaches can mean notifying thousands of people who never had a record opened.
Change history tells you what was edited. Phishers in a hurry often don't edit anything.
So you can say what the account could see, and what it changed, but not what it actually viewed. We covered the departing-employee version of this gap in how to audit who viewed a sensitive Salesforce record, and a compromised account is the same hole with a shorter fuse.
Scoping a breach from a list of opened Salesforce records
This is the gap RecordWatch fills. Each time a record is viewed, RecordWatch creates a Record View tied to that record, stamped with the user and the date and time. Every record carries a related list of who has viewed it.
For Monday's problem, that changes the question you can ask. Instead of "what could this user see," you're building a report on what that user opened between Friday night and the moment the account was locked. That list maps onto what Article 33 asks for: which kinds of records were viewed, and roughly how many.
With RecordWatch, you can provide a list of Actual Accounts, Contacts, and Leads that were accessed by the compromised user. With report and dashboard tracking, you can take this a step further and provide a list of all of the reports they accessed (and the actual reports themselves to provide which records were included in them).
By Monday evening, the question has a real answer. You can tell your DPO which records were opened, by whom, and when, and the notification describes something specific instead of a worst case. The 72 hours go to deciding what to do instead of finding out what happened, and the next time a credential leaks, you aren't starting from permissions and a guess.
Frequently asked questions
Does GDPR require logging who views records in Salesforce?
No. The GDPR does not tell you to log every record view. It does require you to notify the supervisory authority of a personal data breach and to describe the categories and approximate number of people and records concerned, so being able to scope what a user accessed makes that much easier to do.
Is someone viewing personal data without authorization a GDPR breach?
It can be. The GDPR definition of a personal data breach covers unauthorised access to personal data, not just loss or theft. Whether a specific incident must be notified is a decision for your data protection officer or legal counsel.
How long do you have to report a personal data breach under GDPR?
The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people. A late notification must include the reasons for the delay.
What does a GDPR breach notification need to say about the data involved?
It must describe the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the likely consequences, and the measures taken or proposed to address it.
How can you see which records a Salesforce user viewed?
Permissions, change history and export logs show what a user could see, edited or downloaded, but not what they opened. RecordWatch creates a Record View for each view, showing the user and the date and time, and it tracks views going forward from installation.
