Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Zendesk collects sensitive personal data such as proof of vaccination and race and ethnicity on an optional basis where permitted by law, and may disclose this data to Zendesk Group affiliates, service providers, and entities involved in corporate transactions.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the collection and disclosure of special category data under GDPR terminology, including health-related data and racial or ethnic origin, which are subject to heightened protection requirements under GDPR Article 9 and equivalent national laws. The document states collection is optional and consent-based where required, but the disclosure scope includes corporate transaction parties.
Interpretive note: The adequacy of the consent mechanism for sensitive personal data under GDPR Article 9 depends on implementation details not fully described in the notice, including how consent is obtained, recorded, and withdrawn in practice.
Under this clause, individuals who optionally provide sensitive personal data such as vaccination status or race and ethnicity consent to its disclosure to Zendesk Group entities, service providers, and corporate transaction parties. The agreement states this data is not used to infer characteristics under California's sensitive personal information framework.
Cross-platform context
See how other platforms handle Sensitive Personal Data Collection and similar clauses.
Compare across platforms →Monitoring
Zendesk has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Sensitive Personal Data, such as proof of vaccination or race and ethnicity (optional) (where permissible under applicable law). Affiliates and subsidiaries within the Zendesk Group, which includes parent and ultimate holding companies, affiliates, subsidiaries, business units, and other companies that we acquire in the future after they are made part of the Zendesk Group; Service providers, such as platform vendors; Entities involved in a corporate transaction, including if we sell, acquire, or merge all or some of our assets; To which you have consented to the disclosure. We do not collect or process 'sensitive personal information,' as defined by California law, to infer characteristics about you. Zendesk only uses sensitive personal information consistent with the exceptions to the right to limit sensitive personal information.Excerpt from Zendesk's Privacy Policy
1. REGULATORY LANDSCAPE: Collection of race and ethnicity and health data implicates GDPR Article 9 (special categories of personal data), requiring explicit consent or another Article 9(2) exemption, enforced by EU data protection supervisory authorities. CCPA and CPRA classify race, ethnicity, and health information as sensitive personal information with associated opt-out and limitation rights. HIPAA is unlikely to apply in this context as Zendesk is not described as a covered entity in this notice. 2. GOVERNANCE EXPOSURE: Medium. Disclosure of sensitive personal data to entities involved in corporate transactions (sale, acquisition, or merger) requires evaluation under GDPR Article 9 and applicable national law to confirm that a valid legal basis exists for such onward transfer. The consent-based collection described in the notice must be documented with records of consent demonstrating GDPR Article 7 compliance. 3. JURISDICTION FLAGS: EU and EEA jurisdictions apply the strictest standards for processing special category data under GDPR Article 9. California's CPRA imposes distinct sensitive personal information obligations including the right to limit use. Illinois BIPA does not apply to the categories described, but other state-level health data protections may be relevant depending on user geography. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that Zendesk's DPA addresses the processing of special category data where Zendesk acts as Processor. Where Zendesk acts as Controller for this data (as described in this notice), organizations should assess whether collection of sensitive data through Zendesk-operated events or digital properties is adequately disclosed in their own privacy notices. 5. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that explicit consent mechanisms for sensitive personal data collection satisfy GDPR Article 7 and Article 9 requirements, including the ability to withdraw consent without detriment. Records of consent should be maintained. The disclosure of sensitive data to corporate transaction parties should be assessed against GDPR Article 9(2) to confirm a valid basis exists for such transfers.
This provision discloses the collection and disclosure of special category data under GDPR terminology, including health-related data and racial or ethnic origin, which are subject to heightened protection requirements under GDPR Article 9 and equivalent national laws. The document states collection is optional and consent-based where required, but the disclosure scope includes corporate transaction parties.
Under this clause, individuals who optionally provide sensitive personal data such as vaccination status or race and ethnicity consent to its disclosure to Zendesk Group entities, service providers, and corporate transaction parties. The agreement states this data is not used to infer characteristics under California's sensitive personal information framework.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.