The notice states that EU, UK, and California users are provided with specific data subject rights including access, deletion, correction, and portability, with request mechanisms described in the notice and linked sub-notices.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the data subject rights framework applicable to EU, UK, and California users, determining the procedural mechanisms and timelines through which users may exercise rights under GDPR, UK GDPR, and CCPA, and the obligations Smartsheet bears in responding to those requests.
Interpretive note: The specific procedural mechanisms and timelines for data subject rights requests are described in linked sub-notices rather than the main notice text, so the full operational detail cannot be confirmed from the main document alone.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →Detailed CCPA/CPRA and GDPR rights provisions were consolidated and replaced with a generic reference to the layered privacy notice structure that purportedly describes these rights separately.
View full change record →Under these terms, EU, UK, and California users may submit requests to access, delete, correct, or port their personal data through mechanisms described in the notice, with Smartsheet obligated to respond within timeframes established by applicable law. Users in other jurisdictions may have more limited statutory rights depending on local law.
How other platforms handle this
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
If you are an end user in a Workspace not owned by you and wish to update, delete, or receive any information we have about you, you may do so by contacting the organization who owns your ClickUp Workspace.
"The Smartsheet Privacy Notice ("Privacy Notice") consists of this page and the specific notices which describe how we collect, use, and share personal data and explain your related rights and choices.Excerpt from Smartsheet's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the data subject rights framework applicable to EU, UK, and California users, determining the procedural mechanisms and timelines through which users may exercise rights under GDPR, UK GDPR, and CCPA, and the obligations Smartsheet bears in responding to those requests.
Under these terms, EU, UK, and California users may submit requests to access, delete, correct, or port their personal data through mechanisms described in the notice, with Smartsheet obligated to respond within timeframes established by applicable law. Users in other jurisdictions may have more limited statutory rights depending on local law.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.