Smartsheet keeps your personal data for as long as it considers necessary for business, legal, or dispute purposes, without specifying a fixed maximum retention period in this notice.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Open-ended retention criteria mean personal data may be kept for extended periods, and users cannot easily predict when their data will be deleted without submitting a specific deletion request.
Interpretive note: The notice describes retention criteria rather than specific periods, making it difficult to assess in practice how long specific categories of personal data are retained without additional documentation from Smartsheet.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →Removal of detailed data retention explanation eliminates transparency about how long personal data is kept and the specific criteria used for retention decisions, reducing user understanding of data lifecycle management.
View full change record →Smartsheet does not commit to a specific maximum retention period for most personal data, retaining it based on business necessity, legal obligations, and dispute resolution needs, which means data may persist longer than users expect unless they actively submit a deletion request.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements. The criteria used to determine our retention periods include: the length of time we have an ongoing relationship with you; whether there is a legal obligation to which we are subject; and whether retention is advisable in light of our legal position.Excerpt from Smartsheet's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data be kept no longer than necessary for the specified purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Open-ended retention criteria mean personal data may be kept for extended periods, and users cannot easily predict when their data will be deleted without submitting a specific deletion request.
Smartsheet does not commit to a specific maximum retention period for most personal data, retaining it based on business necessity, legal obligations, and dispute resolution needs, which means data may persist longer than users expect unless they actively submit a deletion request.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.