Your data may be transferred to and stored in the United States or other countries with different privacy laws. For EU and UK users, Smartsheet states it uses approved legal mechanisms like Standard Contractual Clauses to make that transfer lawful.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Data transferred to the US is subject to US surveillance laws and may not receive the same legal protections as in the EU or UK, making the adequacy of transfer mechanisms a material compliance question for European organizations.
Interpretive note: The adequacy of Smartsheet's specific transfer impact assessments and supplementary measures is not disclosed in the notice, and the legal status of adequacy decisions may change, creating ongoing uncertainty about transfer lawfulness.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →Removal of explicit international data transfer disclosure eliminates important notice about cross-border data flows and differences in data protection standards, which is particularly significant for non-U.S. users.
View full change record →If you are located outside the US, including in the EU or UK, your personal data will be transferred to and processed in the United States, where data protection laws may provide fewer protections; Smartsheet states it uses Standard Contractual Clauses or adequacy decisions to authorize those transfers.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Smartsheet is based in the United States, and personal data we collect is governed by U.S. law. If you are accessing our Site or Services from outside the United States, please be aware that information collected through the Site or Services may be transferred to, processed, stored, and used in the United States and other countries. Data protection laws in the U.S. and other countries may differ from those in your country of residence. Where required, we rely on approved transfer mechanisms such as Standard Contractual Clauses or adequacy decisions to transfer personal data from the EEA and UK.Excerpt from Smartsheet's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V on international data transfers, including requirements for adequate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Data transferred to the US is subject to US surveillance laws and may not receive the same legal protections as in the EU or UK, making the adequacy of transfer mechanisms a material compliance question for European organizations.
If you are located outside the US, including in the EU or UK, your personal data will be transferred to and processed in the United States, where data protection laws may provide fewer protections; Smartsheet states it uses Standard Contractual Clauses or adequacy decisions to authorize those transfers.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.