Require Customize Application Permission for Direct Read Access to Custom Settings (Critical Update, Postponed)
Where: This change applies to Lightning Experience and Salesforce Classic in Contact Manager, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
Why: This critical update revokes API read access to custom settings from users without the Customize Application permission and will be enforced on January 3, 2020 as part of the Spring ’20 release.
How: You can activate the critical update in the Summer ’19 release or later. For the Winter ’20 release, new permissions allow direct read access to custom settings through profiles or permission sets for users without Customize Application permission.