Zoho CRM data sharing rules: who can see which records, and why users see too much or too little

The starting point: default organization permissions

Zoho's sharing-rules page says sharing rules extend access to users in other roles and groups, and that you cannot restrict the access set in the organization's default permissions by writing a sharing rule; rules can only add visibility. Zoho also says that if the organization default for a module is Public Read/Write or Public Read/Write/Delete, role hierarchy and sharing rules are not applied. Zoho's manual-sharing page says record-level sharing applies only if the module's default is Private or Public Read.

The pages we read do not list every default level or say which one is the starting default, so check Setup, Security Control, Data Sharing Settings in your own account.

Source: Zoho Help: Setting up Data Sharing Rules, Zoho Help: Sharing Records

Sharing rules, per Zoho

• Users with the Manage Data Sharing permission can access the feature. Create a rule under Setup, Security Control, Data Sharing Settings, Sharing Rules tab, Create Sharing Rule.
• A rule can be based on the record owner (records owned by users in selected roles, roles and subordinates, or groups) or based on criteria (field conditions combined with AND or OR).
• You choose who receives access: roles, roles and subordinates, groups, or all users, at Read Only, Read/Write or Read/Write/Delete. A Superiors Allowed option extends access to superiors of the target role or group.
• Rules apply to organization modules, not team modules.
• Zoho says forecasts are always private, and that the organization-level sharing model is not yet implemented for Notes, Reports and Dashboards.
• Rules cannot be edited while their execution is in progress, and a deactivated rule stops applying to newly added records until reactivated.
• For very large modules (Zoho gives 4,000,000 or more records with 60% matching the criteria), existing records are not shared on save and Zoho says to contact support; new and updated matching records are still shared.

Source: Zoho Help: Setting up Data Sharing Rules

Manual record sharing, per Zoho

• Record owners and their superiors with access, or users with the Share permission for the module, can share a record from its ellipsis menu. Zoho says this is available in Enterprise and Ultimate editions.
• Access levels are Read Only, Read/Write and Full Access. Zoho says profile permissions override sharing: a user whose profile is read-only stays read-only even if Full Access is shared.
• Zoho states caps for private sharing: 10 users, 5 roles and 5 groups directly; indirect sharing through related lists allows up to 12 users, 5 roles and 5 groups.
• Records cannot be shared from the list view, only one at a time. Activities, linking-module records and team-module records cannot be shared this way, and some related items such as closed activities, products and campaigns are not shared.
• Revoke Sharing removes direct sharing, but access granted indirectly through a parent record may remain.

Source: Zoho Help: Sharing Records

Common pitfalls (practical advice)

This section is advice from experience, not vendor documentation.

• If users see everything, check the module's default before touching rules: a Public Read/Write default bypasses rules per Zoho.
• If users cannot see something, check in order: the default, the role hierarchy, then rules, then profile permissions.
• Prefer a few criteria-based rules with clear names over many one-off manual shares, which are hard to audit.
• Document who should see what before changing defaults, and test with a user in the target role in a sandbox first.
• Check feature availability for your edition before designing around rules.

Want your record access reviewed?

Skyfall Labs reviews roles, profiles and data sharing in Zoho CRM and configures them to match how your teams work. Because we are a Zoho Partner, treat our view with the interest we have disclosed.