AI Partners Use of User-Generated Content

What it is

Asana AI features that rely on AI Partners process metadata, personal information, and user-generated content such as task titles and task descriptions, in contrast to Asana's own AI features which are limited to metadata only.

Why it matters (compliance & governance perspective)

This provision distinguishes two categories of AI processing with materially different data scope: features powered by AI Partners access user-generated content and personal information, which may implicate subprocessor obligations, data minimization requirements, and consent mechanisms under GDPR and CCPA.

Consumer impact (what this means for users)

This provision establishes that certain Asana AI features, specifically those powered by AI Partners, process task titles, task descriptions, and personal information. Under these terms, organizations using AI Partner-powered features should account for this data scope in their internal data mapping and subprocessor records.

What you can do

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles on data minimization and subprocessor management (Article 28), CCPA service provider restrictions on secondary use of personal information, and APPI restrictions on third-party provision of personal information. The relevant enforcement authorities are the European Data Protection Authorities, the California Privacy Protection Agency, and Japan's Personal Information Protection Commission. Where AI Partners are located outside the EEA or Japan, cross-border transfer obligations may also apply. (2) GOVERNANCE EXPOSURE: High. The distinction between metadata-only processing and processing that includes personal information and user-generated content is material for GDPR data mapping, CCPA service provider agreements, and internal privacy impact assessments. Organizations must confirm that AI Partner subprocessors are listed in Asana's published subprocessor list and that appropriate contractual protections are in place. (3) JURISDICTION FLAGS: EU/EEA organizations face heightened exposure under GDPR data minimization and subprocessor notification obligations. California organizations must confirm that AI Partner processing does not constitute a sale or sharing of personal information under CCPA. Japan-based data subjects may be affected by APPI third-party transfer restrictions. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that Asana's subprocessor list identifies all AI Partners engaged for this processing, and that the DPA's subprocessor provisions require adequate notice of changes to AI Partner relationships. Vendor assessments should include review of AI Partner data retention and security practices. (5) COMPLIANCE CONSIDERATIONS: Organizations should update Records of Processing Activities to reflect AI Partner-driven processing of user-generated content, review consent mechanisms where personal information in tasks may relate to data subjects not party to the Asana agreement, and confirm that AI features using AI Partners can be selectively disabled via the admin console.

Applicable agencies

Provision details

Other risks in this policy

• AI Partners Access Metadata Personal Info and User Content high
• APPI Cross-Border Transfer Requires Contractual Compliance high
• Asana Acts as CCPA Service Provider high
• Asana Cooperates with Customer Deletion and Access Requests high
• CCPA Customer Data Processed Only for Agreed Purposes high
• Customer Cannot Substitute Own DPA high