Short answer
Merging records in Salesforce requires Delete permission on the object, so most firms end up giving delete rights to people who only need to merge. Take Delete off base profiles, grant it through a permission set to a small data stewardship group, and know your recovery path, because the Recycle Bin keeps deleted records for 15 days.
Why this comes up
Salesforce treats a merge as a delete of the losing records, so a user needs Delete on the object to merge Accounts, Contacts or Leads. Teams that want users to clean up duplicates often hand out Delete broadly, and then records disappear.
The standard
- Remove Delete from base profiles for Accounts, Contacts, Leads and Opportunities.
- Create a "Data stewardship" permission set with Delete on those objects and assign it to a few trained people.
- Route merge requests to that group through a simple request process, such as a case type, a Slack channel or a flag field.
- Use duplicate rules to warn or block at entry, so fewer merges are needed.
- Review the assignment each quarter with your other access reviews.
Hiding the Delete button on page layouts only slows people down. The permission is what controls it.
Recovery
- Deleted records stay in the Recycle Bin for 15 days, subject to storage limits, and can be restored with their related records.
- Merges can't be undone with a click. Keep the losing record IDs, and check that your backup tool captures the pre-merge state.
- The Setup Audit Trail tracks configuration changes, not record deletions. Use Field History Tracking, event monitoring or your backup tool to show who deleted what.
Emergency access
Keep one documented break-glass admin account for urgent fixes, with its use logged and reviewed. Don't solve emergencies by giving everyone more access.
Official documentation
Frequently asked questions
Why do users need Delete permission to merge records in Salesforce?
A merge keeps one record and deletes the others, so Salesforce requires Delete on the object. Grant it through a permission set to a small, trained group instead of on every profile.
How long can deleted Salesforce records be restored?
Deleted records stay in the Recycle Bin for 15 days, subject to your org's storage limits. After that you need a backup to recover them.
Salesforce, HubSpot, Anthropic and OpenAI change their products often. Check the official documentation before you rely on a specific setting, limit or price.