The policy requests that users avoid submitting sensitive personal data categories including health information, biometrics, racial or ethnic origin, and criminal background through the service, but states that submission of such data in user-generated content constitutes consent to its processing under the policy.
This analysis describes what ClickUp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that consent to process sensitive personal data categories is obtained through the act of submission rather than through a distinct affirmative consent mechanism. This approach may require evaluation under GDPR Article 9, which requires explicit consent for processing special categories of personal data, and CCPA sensitive personal information provisions, which impose additional handling requirements.
Interpretive note: Whether consent obtained through the act of data submission satisfies GDPR Article 9 explicit consent requirements depends on regulatory interpretation and may vary across EEA jurisdictions.
The updated policy now explicitly recognizes eight distinct data subject rights, including rights to access, correct, delete, restrict processing, receive data in portable format, object to processing, withdraw consent, and lodge complaints with regulators. Previously, ClickUp described privacy controls through general opt-out options and data access procedures without formal legal framing. The revised language aligns with GDPR and similar data protection frameworks, providing clearer legal reference points for how users may exercise control over their personal data. You can exercise these rights by contacting ClickUp's support team.
View change record →Under this provision, if a user submits content containing sensitive personal data such as health information, biometric data, or racial or ethnic origin through the ClickUp platform, the agreement treats that submission as consent to processing of that data under the policy's terms. The policy does not establish a distinct opt-in mechanism for sensitive data processing separate from the act of submission.
Cross-platform context
See how other platforms handle Sensitive Personal Data User-Generated Content Consent and similar clauses.
Compare across platforms →"Subject to the next paragraph, we ask that you not send or disclose to us any sensitive personal data (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the ClickUp Services or otherwise. If you send or disclose any sensitive personal data to us when you submit user generated content to the ClickUp Services, you consent to our processing and use of such sensitive personal data in accordance with this policy. If you do not consent to our processing and use of such sensitive personal data, you must not submit such user generated content to our platform.Excerpt from ClickUp's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 9 (processing of special categories of personal data), CCPA and CPRA sensitive personal information provisions, Illinois BIPA (to the extent biometric data is submitted), and potentially HIPAA if …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that consent to process sensitive personal data categories is obtained through the act of submission rather than through a distinct affirmative consent mechanism. This approach may require evaluation under GDPR Article 9, which requires explicit consent for processing special categories of personal data, and CCPA sensitive personal information provisions, which impose additional handling requirements.
Under this provision, if a user submits content containing sensitive personal data such as health information, biometric data, or racial or ethnic origin through the ClickUp platform, the agreement treats that submission as consent to processing of that data under the policy's terms. The policy does not establish a distinct opt-in mechanism for sensitive data processing separate from the act …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ClickUp.