Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Greenhouse requires affirmative express consent before disclosing or repurposing sensitive categories of personal information, including health conditions, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and sexual life data.
This analysis describes what Greenhouse's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an opt-in consent requirement for sensitive personal information that applies regardless of geographic jurisdiction, providing a baseline protection for sensitive data categories that aligns with GDPR Article 9 requirements and extends a similar protection to non-EEA users.
Under this clause, Greenhouse requires affirmative express consent before disclosing or using sensitive personal information such as health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sexual life information for purposes beyond those originally collected. This protection applies to data received from third parties where that third party has identified it as sensitive.
Cross-platform context
See how other platforms handle Sensitive Information Opt-In Consent Requirement and similar clauses.
Compare across platforms →Monitoring
Greenhouse has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In any event, unless Greenhouse has affirmative express consent from you, Greenhouse will not (i) disclose sensitive information (i.e., personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), or (ii) use sensitive personal information for a purpose other than those for which it was originally collected or subsequently authorized by you through the exercise of opt-in-choice. Greenhouse will treat as sensitive any Personal Information received from a third party where the third party identifies and treats it as sensitive.Excerpt from Greenhouse's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly reflects GDPR Article 9 special category data protections and is consistent with equivalent provisions under UK GDPR and CPRA's sensitive personal information framework. The explicit enumeration of categories mirrors GDPR Article 9(1) categories, and the opt-in consent requirement reflects GDPR Article 9(2)(a). The FTC's general consumer protection authority is also relevant. 2. GOVERNANCE EXPOSURE: Low. The provision establishes protections consistent with or exceeding applicable legal requirements for sensitive data categories. The extension of sensitive data treatment to third-party-sourced data where the third party identifies it as sensitive is a proactive data governance practice that reduces regulatory exposure. 3. JURISDICTION FLAGS: EEA and UK users benefit from GDPR and UK GDPR enforcement of these protections. California residents benefit from CPRA's sensitive personal information framework. The policy's extension of these protections globally, not limited to specific jurisdictions, reduces differentiated compliance risk across Greenhouse's user base. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers who transmit sensitive category data to Greenhouse through recruiting workflows should ensure that their Data Processing Addenda and candidate consent mechanisms account for this provision. Vendors providing Greenhouse with data from third-party sources should be contractually required to flag sensitive data consistent with this policy's stated practice. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that consent capture mechanisms for sensitive data are documented and auditable, particularly for any recruitment use cases where health, disability, or demographic data may be submitted by candidates. Data mapping should identify all inbound data flows from third parties that may include sensitive categories to ensure the flagging and treatment obligations described in this provision are operationally implemented.
This provision establishes an opt-in consent requirement for sensitive personal information that applies regardless of geographic jurisdiction, providing a baseline protection for sensitive data categories that aligns with GDPR Article 9 requirements and extends a similar protection to non-EEA users.
Under this clause, Greenhouse requires affirmative express consent before disclosing or using sensitive personal information such as health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sexual life information for purposes beyond those originally collected. This protection applies to data received from third parties where that third party has identified it as sensitive.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Greenhouse.