The notice states that Smartsheet acts as a data controller for personal data collected through its website and marketing activities, and as a data processor for content and data submitted by enterprise customers through the platform, with the terms of processor activities governed by separate customer agreements.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision determines the allocation of direct regulatory obligations between Smartsheet and its enterprise customers under GDPR and CCPA. Where Smartsheet acts as a processor, enterprise customers bear primary controller obligations for data subject rights fulfilment and breach notification, and must have Data Processing Agreements in place.
Interpretive note: The full text of the processor-specific terms is contained in separate customer agreements not reproduced in this notice, so the complete scope of processor obligations cannot be assessed from this document alone.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →The provision was substantially rewritten from a specific explanation of processor/controller roles to a general introductory statement defining Smartsheet's identity and the layered structure of the privacy notice, and severity increased from medium to high.
View full change record →Under this distinction, individual users whose data is submitted to the platform by an enterprise employer or client may need to direct data subject rights requests to the enterprise customer rather than directly to Smartsheet, depending on the applicable contractual and regulatory framework.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"On our website, including www.smartsheet.com ("Site"), "we" (or "our," "us") refers to Smartsheet Inc. The Smartsheet Privacy Notice ("Privacy Notice") consists of this page and the specific notices which describe how we collect, use, and share personal data and explain your related rights and choices.Excerpt from Smartsheet's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision determines the allocation of direct regulatory obligations between Smartsheet and its enterprise customers under GDPR and CCPA. Where Smartsheet acts as a processor, enterprise customers bear primary controller obligations for data subject rights fulfilment and breach notification, and must have Data Processing Agreements in place.
Under this distinction, individual users whose data is submitted to the platform by an enterprise employer or client may need to direct data subject rights requests to the enterprise customer rather than directly to Smartsheet, depending on the applicable contractual and regulatory framework.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.