Use a custom group to control who can view their own profile details — beyond the default setup.
The All People – Own Data permission group is meant to give all employees access to view their own basic information. If you need to provide additional access to some employees (or restrict access for others), you can do this by creating a custom permission group with self-access rules.
This guide walks you through how to create a permission group that includes only the employees you want to allow, while leaving others restricted.
To restrict self-access for specific employees:
-
Remove default category permissions
-
Go to System settings > Account > Permission groups
-
Select All People – Own Data
-
In the People’s data tab, remove permissions for the category you want to restrict
This removes self-access for all employees by default.
-
-
Create a new permission group
-
Click + Add group
-
Name the group (e.g., “Self-access – allowed”)
-
Go to Group actions > Edit details
-
In the Members section, choose Select by condition
-
Set conditions to include everyone except the employees you want to restrict (e.g., by location, employment type, etc.)
-
-
Restrict visibility to "self only"
-
In the new group’s People’s data tab, add the condition:
-
Email = Same as viewer
-
This ensures group members can only view their own profiles.
-
-
Reassign category access to the new group
-
Go to the relevant category settings
-
Grant view/edit access to the new permission group you created
-
-
Test the configuration
-
Log in as an employee in the new group: they should see only their own profile
-
Log in as an employee excluded from the group: they should not be able to view their own profile
-