Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy enumerates GDPR data subject rights including access, rectification, erasure, restriction, portability, objection, consent withdrawal, and supervisory authority complaint, exercisable by contacting support@clickup.com or the postal address provided.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the GDPR data subject rights available to users and the mechanism for exercising them, which is relevant for EEA and UK users and for enterprise customers assessing ClickUp's compliance with GDPR processor obligations. The provision also notes the right to complain to the UK ICO directly.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →The agreement states that users may exercise GDPR data subject rights including access, erasure, portability, and objection by contacting support@clickup.com or by mail to ClickUp's San Diego address. UK users may also contact the Information Commissioner's Office at ico.org.uk or by phone at +44 (0)303 123 1113.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
ClickUp has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Under applicable data protection law (including GDPR), you have the following rights regarding your personal data: Right to Access: You may request a copy of the personal data we hold about you. Right to Rectification: You may request correction of inaccurate or incomplete personal data. Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Right to Restriction of Processing: You may request that we restrict processing of your personal data in certain circumstances. Right to Data Portability: You may request to receive your personal data in a structured, commonly used, machine-readable format. Right to Object: You may object to processing based on legitimate interests, direct marketing, or profiling. Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority.Excerpt from ClickUp's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR and UK GDPR data subject rights frameworks, enforced by EEA supervisory authorities and the UK Information Commissioner's Office respectively. The provision also references the right to lodge complaints with supervisory authorities, which is a mandatory GDPR disclosure requirement. GOVERNANCE EXPOSURE: Low for organizations operating only in the US. Medium for organizations with EEA or UK user populations, as the adequacy of ClickUp's response procedures for data subject requests is subject to regulatory assessment. JURISDICTION FLAGS: EEA and UK users are the primary affected population. Enterprise customers with EEA or UK employees or end users should ensure their Data Protection Addendum establishes response timelines and procedures consistent with GDPR requirements, including the 30-day response obligation. CONTRACT AND VENDOR IMPLICATIONS: B2B customers processing personal data of EEA or UK individuals through ClickUp should assess whether the DPA establishes appropriate procedures for fulfilling data subject requests, including timelines, verification procedures, and escalation paths. The policy's requirement for government identification to verify identity should be assessed for compliance with GDPR guidance on proportionate verification. COMPLIANCE CONSIDERATIONS: Compliance teams should document the process for receiving and fulfilling data subject requests routed through support@clickup.com and assess whether response timelines meet GDPR requirements. Organizations should also assess the identity verification requirement against GDPR guidance on proportionality.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses the GDPR data subject rights available to users and the mechanism for exercising them, which is relevant for EEA and UK users and for enterprise customers assessing ClickUp's compliance with GDPR processor obligations. The provision also notes the right to complain to the UK ICO directly.
The agreement states that users may exercise GDPR data subject rights including access, erasure, portability, and objection by contacting support@clickup.com or by mail to ClickUp's San Diego address. UK users may also contact the Information Commissioner's Office at ico.org.uk or by phone at +44 (0)303 123 1113.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.