PrivacySettings Metadata Type in SFDX

Architectural Overview#

Data privacy regulations—including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA)—require enterprises to manage consumer consent, track communication channels, and honor “Right to be Forgotten” requests. Salesforce addresses these requirements natively through data privacy objects anchored by the Individual entity.

The PrivacySettings metadata type controls organization-wide automation for data privacy and consent management. It governs automated creation of Individual records, enables data privacy masking policies, and activates ConsentEventStream to broadcast consent modifications across the enterprise architecture.

Deploying PrivacySettings through automated CI/CD pipelines ensures that privacy compliance controls are immutably replicated across all staging and production environments.

Directory and File Conventions#

In SFDX source format, PrivacySettings is managed as a settings singleton:

Key Metadata Fields#

The XML schema of PrivacySettings contains key regulatory switches:

Declarative XML and Package Manifest Examples#

Below is a production Privacy.settings-meta.xml configuration:

<?xml version="1.0" encoding="UTF-8"?>
<PrivacySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <enableConsentEventStream>true</enableConsentEventStream>
    <enableIndividualAutoCreate>true</enableIndividualAutoCreate>
    <enablePrivacyDataManagement>true</enablePrivacyDataManagement>
</PrivacySettings>

Scratch Org Definition Configuration#

{
  "orgName": "Privacy & Compliance Scratch Org",
  "edition": "Enterprise",
  "settings": {
    "privacySettings": {
      "enableIndividualAutoCreate": true,
      "enableConsentEventStream": true,
      "enablePrivacyDataManagement": true
    }
  }
}

Package Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Privacy</members>
        <name>Settings</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Manage PrivacySettings via the Salesforce CLI:

# Retrieve Privacy settings from the org
sf project retrieve start --metadata Settings:Privacy

# Deploy Privacy settings to target org
sf project deploy start --metadata Settings:Privacy

# Validate deployment into staging environment
sf project deploy validate --metadata Settings:Privacy

Architect Best Practices and Gotchas#

• DML Trigger Side-Effects: Enabling enableIndividualAutoCreate causes Salesforce to fire an implicit insert DML on Individual during Lead and Contact creation. Custom triggers and Flow definitions on Individual must be bulkified to prevent governor limit failures during bulk data imports.
• Event Bus Consumer Scalability: When enableConsentEventStream is active, mass consent updates (e.g., preference center batch updates) can generate large volumes of streaming events. Ensure external consumers handle high throughput without message loss.
• Storage Considerations: Individual records consume standard data storage. Large B2C orgs with millions of Leads should account for the additional record storage overhead.

Frequently asked questions

What regulatory frameworks are supported by PrivacySettings?

It supports data privacy compliance under GDPR, CCPA, CPRA, and HIPAA by governing consent management and Individual records.

Where is PrivacySettings stored in an SFDX project repository?

It resides at force-app/main/default/settings/Privacy.settings-meta.xml and is retrieved using the Settings:Privacy identifier.

What happens when enableIndividualAutoCreate is set to true?

Salesforce automatically provisions and links a corresponding Individual record whenever a new Lead, Contact, or Person Account is created.

What is the purpose of the ConsentEventStream feature?

It broadcasts real-time consent changes to external integration systems and data lakes via the high-volume streaming event bus.