International Data Transfers

Sharing Personal Data - As Required by Law

As noted in the Smartsheet Privacy Notice, Smartsheet may share personal data as required by law in accordance with a valid legal process, such as a subpoena or bankruptcy proceeding.

When receiving a request for access to or preservation of personal data, including a national security or other law enforcement request, Smartsheet will, to the extent permitted by law, object to such request and notify the customer to whom the data relates. However, in some instances, Smartsheet may be legally required to share such personal data in accordance with a valid legal order and without notification to customers of such requests. In any event, we will do so in accordance with our confidentiality obligations in the agreement governing a customer’s use of the Offerings (i.e., “Required Disclosures” of the User Agreement). 

Sharing Personal Data - To Third Party Service and Infrastructure Providers 

As noted in the Smartsheet Privacy Notice, Smartsheet may share personal data with our service and infrastructure providers. Smartsheet only engages such third party providers that have demonstrated an equal commitment to protecting our customers’ personal data, including meeting or exceeding our Vendor Privacy and Data Handling Expectations. Additionally, for those providers that qualify as a “subprocessor” under the GDPR, Smartsheet has ensured appropriate safeguards and contractual obligations are in place to protect personal data and meet its obligations under the law. Smartsheet’s list of current subprocessors is available here.

In all instances, if Smartsheet is sharing personal data with a third party provider, Smartsheet does so under a valid contract which includes appropriate data protection obligations and, if transferring data outside the EEA, the SCCs. 

Government Agency Access – Only When Compelled by Law

At times, Smartsheet will receive a request from a government agency or law enforcement authority seeking access to content belonging to a customer. When we receive such a request, our goal is to protect our customers, while complying with applicable laws. We will notify an affected customer unless we are explicitly prohibited from doing so by law. Where possible, we refer the requesting governmental agency to work with the affected customer directly. Smartsheet is not the controller of Customer Content and we strongly believe that any governmental agency seeking to access such content should address its request directly with the customer where possible.

We do not provide direct access to or disclose Customer Content to government agencies unless compelled by law and we challenge unlawful requests. We review each government request on a case-by-case basis and only comply if and to the extent we determine the request is lawful. When reviewing the lawfulness of a government request, we take into account all applicable laws, including the laws of other jurisdictions, where applicable. We require governmental agencies to follow the required legal process under applicable laws, such as issuing their request via a subpoena, court order, or search warrant. Where we believe a government request for Customer Content is invalid or unlawful, we try to challenge it.

With regard to US governmental agencies, the SCCs require Smartsheet (as the data importer) to promptly notify the data exporter of any legally binding request for disclosure of the personal data by a law enforcement authority, unless otherwise prohibited. In its history, Smartsheet has not received a FISA warrant or similar request for data processed by Smartsheet that would violate its obligations under the SCCs.