Create and Run a Data Detect Policy

Introduction

You've learned about the power of Data Detect for identifying sensitive data across your Salesforce org. Now it's time to put that knowledge into action by creating your own data detect policy.

In this unit, you create a data detect policy, add detection rules, configure the scan scope, run the policy, and review the results. By the end, you'll have a working policy that identifies sensitive data patterns in your org.

Before you start, make sure you have a Trailhead Playground ready. If you need to create one, follow the instructions in Trailhead Playground Management.

This hands-on challenge requires the following prerequisites:

• A Trailhead Playground with Data Detect enabled
• System Administrator permissions
• Familiarity with Salesforce Setup (the previous unit covers the basics)

Create a Data Detect Policy

A data detect policy is a container that groups your detection rules and scan configurations together. Think of it as a project that defines what sensitive data to look for and where to look.

Follow these steps to create your first policy.

1. From Setup, enter Data Detect in the Quick Find box, then select Data Detect Policies.
2. Click New Policy.
3. For the policy name, enter Sensitive PII Detection.
4. For the description, enter Scans org data for personally identifiable information including SSN, email, and phone patterns.
5. Leave the status set to Draft.
6. Click Save.

Add Detection Rules

Detection rules define the sensitive data patterns your policy looks for. Each rule targets a specific type of data, like Social Security numbers, email addresses, or credit card numbers, using pattern matching.

Add three detection rules to your policy.

Rule 1: Social Security Number

1. On the policy detail page, click the Detection Rules tab.
2. Click Add Rule.
3. For the rule name, enter SSN Pattern.
4. For the detection type, select Regular Expression.
5. In the pattern field, enter the pattern below.
6. Set the sensitivity level to High.
7. Click Save.

\b\d{3}-\d{2}-\d{4}\b

Rule 2: Email Address

1. Click Add Rule again.
2. For the rule name, enter Email Pattern.
3. For the detection type, select Built-in Classifier.
4. From the classifier dropdown, select Email Address.
5. Set the sensitivity level to Medium.
6. Click Save.

Rule 3: Phone Number

1. Click Add Rule once more.
2. For the rule name, enter Phone Pattern.
3. For the detection type, select Built-in Classifier.
4. From the classifier dropdown, select Phone Number (US).
5. Set the sensitivity level to Medium.
6. Click Save.

You should now see three rules listed on the Detection Rules tab. Each rule shows its name, detection type, and sensitivity level.

Configure the Scan Scope

The scan scope tells Data Detect which objects and fields to scan. Rather than scanning everything in your org (which can take a long time), you target specific objects where sensitive data is most likely to live.

Configure the scan scope for your policy.

1. Click the Scan Scope tab on your policy.
2. Click Add Objects.
3. In the object search, find and select Contact.
4. Select the following fields to scan:
   • Description
   • Email
   • Phone
   • MailingStreet
5. Click Save.
6. Repeat the process to add the Lead object with the same field types: Description, Email, Phone, and Street.
7. Click Save.

Run the Policy

Now that your policy has detection rules and a scan scope, you're ready to activate and run it. When you run the policy, Data Detect scans the configured objects and fields for matches against your detection rules.

1. Navigate back to the Details tab of your policy.
2. Change the policy status from Draft to Active.
3. Click Save.
4. Click the Run Policy button in the upper-right corner.
5. In the confirmation dialog, review the scan scope summary, then click Run Now.
6. Wait for the scan to complete. You can monitor progress on the Scan History tab. The scan typically takes 1 to 3 minutes for a small org.

Review Results

After the scan completes, Data Detect presents the findings in a results dashboard. You can see how many matches were found, broken down by detection rule, object, and sensitivity level.

Review your scan results.

1. Click the Results tab on your policy.
2. Review the results summary at the top. Note the total number of matches and the breakdown by sensitivity level.
3. Click on the SSN Pattern rule in the results list to see which records matched.
4. For each match, Data Detect shows:
   • The object and field where the match was found
   • The record ID so you can navigate directly to it
   • The sensitivity level assigned by the detection rule
   • A confidence score indicating how closely the data matched the pattern
5. Navigate back to the results summary and verify that all three rules produced results.

If any rule shows zero matches, that's expected. It means your org's sample data doesn't contain that pattern. The important thing is that your policy ran successfully and produced a results report.

Resources

• Salesforce Help: Data Detect Overview
• Salesforce Help: Create Data Detect Policies
• Trailhead: User Access Fundamentals Superbadge