Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that deletion requests will be honored for actively used databases and readily searchable media, but that copies of personal data may persist in backup systems in a form that is difficult or impossible to locate or remove.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies a limitation on deletion request fulfillment, noting that backup copies of personal data may persist after a deletion request is processed. This limitation may require evaluation against GDPR's right to erasure requirements and CCPA deletion obligations, which may recognize technical impossibility exceptions but impose requirements on how such exceptions are documented and communicated.
Interpretive note: Whether the backup persistence limitation satisfies GDPR Article 17 erasure requirements and CCPA deletion obligations depends on regulatory interpretation and the specific backup management practices implemented, which are not fully described in the policy.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →Under this provision, a deletion request will result in removal from actively used databases, but the agreement states that copies in backup systems may persist in a form that is difficult or impossible to locate. Users submitting deletion requests should be aware that complete removal from all systems may not be technically achievable under the terms as stated.
Cross-platform context
See how other platforms handle Residual Data Persistence After Deletion Request and similar clauses.
Compare across platforms →Monitoring
ClickUp has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You should be aware that it is not technologically possible to remove each and every record of the information you have provided to us from our system. The need to back up our systems to protect information from inadvertent loss means that a copy of in a non-erasable form that will be difficult or impossible for us to locate. Promptly after receiving your request, all personal information stored in databases we actively use, and other readily searchable media will be updated, corrected, changed or deleted, as appropriate, as soon as and to the extent reasonably and technically practicable.Excerpt from ClickUp's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 17 (right to erasure), CCPA deletion obligations, and UK GDPR erasure rights. Both GDPR and CCPA recognize that technical limitations may affect the completeness of deletion in backup systems, but regulatory guidance generally requires organizations to document such limitations, apply backup data to appropriate retention schedules, and ensure backup copies are not restored into active use after a deletion request. The policy's acknowledgment that backup copies may be impossible to locate raises questions about the adequacy of backup data management practices. GOVERNANCE EXPOSURE: Medium. The backup persistence limitation is recognized in industry practice and regulatory guidance, but the policy's description of backup copies as difficult or impossible to locate may indicate gaps in data mapping or backup management practices that could create exposure in a regulatory inquiry or data subject complaint. JURISDICTION FLAGS: EEA and UK users exercising GDPR erasure rights are most directly affected. California residents exercising CCPA deletion rights are also affected. Regulated-industry customers in healthcare or financial services may face sector-specific requirements for backup data retention and deletion that create heightened exposure. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with contractual deletion timelines in their Data Protection Addendum should assess whether backup persistence provisions in the policy are consistent with their contracted deletion obligations. The policy's acknowledgment of backup limitations should be reviewed against DPA terms to identify any inconsistencies. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether ClickUp's backup management practices include scheduled purging of deleted data from backup systems and whether the organization can demonstrate to regulators that backup copies of deleted data are not restored into active use. Data mapping updates should document the backup systems that may retain personal data following a deletion request.
This provision identifies a limitation on deletion request fulfillment, noting that backup copies of personal data may persist after a deletion request is processed. This limitation may require evaluation against GDPR's right to erasure requirements and CCPA deletion obligations, which may recognize technical impossibility exceptions but impose requirements on how such exceptions are documented and communicated.
Under this provision, a deletion request will result in removal from actively used databases, but the agreement states that copies in backup systems may persist in a form that is difficult or impossible to locate. Users submitting deletion requests should be aware that complete removal from all systems may not be technically achievable under the terms as stated.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.