If you use Smartsheet because your employer or another organization set it up, that organization controls your data inside the platform, not Smartsheet. Your privacy rights for that data must be directed to your employer, not Smartsheet.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Many employees who use Smartsheet at work assume they can ask Smartsheet to delete or access their data, but this clause means Smartsheet may redirect those requests to the employer, potentially limiting practical privacy recourse.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →Individual employees using Smartsheet through a workplace account may not be able to exercise GDPR or CCPA rights directly with Smartsheet for data submitted into the platform; they must contact their employer instead, which could complicate or delay privacy right fulfillment.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
You and your organization's administrator can access several types of Service Data directly from Google Cloud, including your account information, billing contact information, payment and transaction information, as well as product and communication settings and configurations.
to request that your data be transferred to a third party (data portability)
"When we provide the Service to our customers, we act as a data processor on behalf of those customers. Our customers are the data controllers, meaning that they determine the purposes and means of the processing of personal data that is submitted into the Service. If you are an end user of a customer's implementation of the Service and you have questions about how your personal data is processed in that context, please contact the relevant customer directly.Excerpt from Smartsheet's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28, which requires a written Data Processing Agreement between controller and processor, and CCPA service provider designation requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Many employees who use Smartsheet at work assume they can ask Smartsheet to delete or access their data, but this clause means Smartsheet may redirect those requests to the employer, potentially limiting practical privacy recourse.
Individual employees using Smartsheet through a workplace account may not be able to exercise GDPR or CCPA rights directly with Smartsheet for data submitted into the platform; they must contact their employer instead, which could complicate or delay privacy right fulfillment.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.