This analysis describes what Upwork's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause operationalizes statutory data subject rights under CCPA and GDPR by establishing Upwork's procedural obligation to receive, evaluate, and act upon user requests according to the applicable legal frameworks governing each jurisdiction.
Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
View change record →The updated policy now explicitly states that Upwork complies with the U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to DPF principles when processing personal data from EU, UK, and Swiss residents. The policy establishes that if any conflict exists between Upwork's privacy policy and DPF principles, the DPF principles will govern. This creates an explicit legal hierarchy for data protection standards applicable to residents of those jurisdictions. Users from affected regions can visit https://www.dataprivacyframework.gov/ to view Upwork's certification and learn more about the DPF program.
View change record →Users in California and EU jurisdictions have a documented mechanism to exercise legally-available rights over their personal information through Upwork's designated contact process, with the company's obligation to handle requests according to applicable data protection law timelines and procedures.
How other platforms handle this
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
We may also collect your personal data from other people or companies.
Monitoring
Upwork has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Depending on where you are located, you may have certain rights regarding your personal information. These may include the right to: (i) request access and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) object to or restrict the processing of your personal information; (iv) if applicable, data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.— Excerpt from Upwork's Upwork Privacy Policy
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This clause operationalizes statutory data subject rights under CCPA and GDPR by establishing Upwork's procedural obligation to receive, evaluate, and act upon user requests according to the applicable legal frameworks governing each jurisdiction.
Users in California and EU jurisdictions have a documented mechanism to exercise legally-available rights over their personal information through Upwork's designated contact process, with the company's obligation to handle requests according to applicable data protection law timelines and procedures.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Upwork.