ClickUp distinguishes between content you or your team upload to the platform (which ClickUp processes on your instructions) and behavioral and usage data ClickUp collects about you independently for its own purposes.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
For business users, this distinction determines who controls your data and what rights apply: workspace content is governed by your agreement with ClickUp as a processor, while separately collected behavioral data is governed by ClickUp's own controller decisions.
Interpretive note: The boundary between Customer Data and ClickUp-controlled behavioral data is not exhaustively defined in the policy, leaving some ambiguity about which specific data types fall under each regime.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →Business account holders and workspace administrators maintain more control over content they upload, but ClickUp independently collects and controls behavioral and usage data about all users regardless of account type, creating two parallel data relationships with different governance implications.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Our customers may use the Services to upload, transmit, store, or otherwise process personal information of their own customers, employees, or other third parties ('Customer Data'). We process Customer Data on behalf of customers as a data processor. ClickUp may also collect certain information about how customers and their authorized users interact with the Services, which ClickUp processes as a data controller for its own purposes.Excerpt from ClickUp's Privacy Policy
(1) REGULATORY LANDSCAPE: This controller-processor distinction is fundamental to GDPR compliance under Articles 4, 28, and 29.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
For business users, this distinction determines who controls your data and what rights apply: workspace content is governed by your agreement with ClickUp as a processor, while separately collected behavioral data is governed by ClickUp's own controller decisions.
Business account holders and workspace administrators maintain more control over content they upload, but ClickUp independently collects and controls behavioral and usage data about all users regardless of account type, creating two parallel data relationships with different governance implications.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.