This analysis describes what Upwork's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision defines the operational framework for data lifecycle management post-closure, establishing that retention duration depends on identification of legitimate business purposes rather than a fixed timeline, and creates obligations for either deletion, anonymization, or secure isolation as alternatives.
Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
View change record →The updated policy now explicitly states that Upwork complies with the U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to DPF principles when processing personal data from EU, UK, and Swiss residents. The policy establishes that if any conflict exists between Upwork's privacy policy and DPF principles, the DPF principles will govern. This creates an explicit legal hierarchy for data protection standards applicable to residents of those jurisdictions. Users from affected regions can visit https://www.dataprivacyframework.gov/ to view Upwork's certification and learn more about the DPF program.
View change record →Users' personal information may be retained after account closure for the duration of any ongoing legitimate business need identified by Upwork, with deletion or anonymization occurring only after such needs no longer exist. The specific retention period is not fixed and depends on Upwork's determination of legitimate business purposes.
How other platforms handle this
You may request deletion of your account at any time. When you request account deletion, we will delete or anonymize your personal information unless we are required to retain it by law, or unless we need to retain it for legitimate business purposes such as resolving disputes, enforcing our agreeme...
We generally retain your personal data as long as you keep your account open or as needed to provide you Services. This includes data you or others provided to us and data generated or inferred from your use of our Services. In some cases we choose to retain certain information (e.g., insights about...
We will retain your personal information for as long as your Account is open, or as needed to provide you services. Some information may be retained after your Account is closed. We may also retain information as required by law or regulation, for fraud prevention, to resolve disputes, to enforce ou...
Monitoring
Upwork has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible, then we will securely store your information and isolate it from any further processing until deletion is possible.— Excerpt from Upwork's Upwork Privacy Policy
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The provision defines the operational framework for data lifecycle management post-closure, establishing that retention duration depends on identification of legitimate business purposes rather than a fixed timeline, and creates obligations for either deletion, anonymization, or secure isolation as alternatives.
Users' personal information may be retained after account closure for the duration of any ongoing legitimate business need identified by Upwork, with deletion or anonymization occurring only after such needs no longer exist. The specific retention period is not fixed and depends on Upwork's determination of legitimate business purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Upwork.