Customer Control Over User Accounts and Data

What it is

If your Asana account is run through your employer or another organization, that organization controls your access and can view or export your account data, not you.

Why it matters (compliance & governance perspective)

Most people using Asana for work are on an employer-controlled account, meaning their work data belongs to the organization, not to them personally, and can be accessed by administrators.

Consumer impact (what this means for users)

This provision means that workspace content, task data, messages, and files stored in an employer-administered Asana account are accessible to and controlled by the employer. If you leave a job, the organization can retain, delete, or transfer that data without your consent.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates GDPR controller/processor distinctions, as the Customer acts as data controller for employee workspace data, and Asana as processor. EU supervisory authorities may scrutinize whether employees receive adequate notice of employer access under applicable national labor and privacy laws. In the US, the Electronic Communications Privacy Act and state equivalents may engage depending on the nature of communications stored in the platform. GOVERNANCE EXPOSURE: High. Organizations that administer Asana accounts must ensure that employees are notified of monitoring and access capabilities as required by applicable law. Failure to provide adequate notice may create employment law or privacy law exposure, particularly in EU/EEA jurisdictions where employee monitoring notice requirements are stringent. JURISDICTION FLAGS: EU/EEA jurisdictions impose specific requirements on employee monitoring and data access by employers, and the adequacy of notice may vary by country. California's Labor Code and California Consumer Privacy Act create additional considerations for California-resident employees. Healthcare and financial services sectors may face heightened scrutiny where sensitive data is stored in the platform. CONTRACT AND VENDOR IMPLICATIONS: Enterprises should ensure their acceptable use policies and employee agreements explicitly disclose that Asana workspace data is subject to employer access and monitoring. This provision creates a liability shift where Asana is indemnified for actions taken by the Customer as administrator, placing compliance responsibility on the employer. Procurement teams should confirm this provision is addressed in employee privacy notices and onboarding documentation. COMPLIANCE CONSIDERATIONS: Organizations should update employee privacy notices and acceptable use policies to reflect administrator access capabilities described in this provision. HR and legal teams should evaluate whether current employment agreements adequately address employer rights to access digital workspace content. GDPR Article 88 and applicable national implementing laws governing employee data should be reviewed for EU operations.

Applicable agencies

Provision details

Other risks in this policy

• Limitation of Liability medium
• Intellectual Property and Content License medium
• Service Modification and Termination medium
• Acceptable Use Restrictions low
• Governing Law and Jurisdiction medium
• Privacy and Data Collection medium