Thanks Genevieve, unfortunately this info is primarily about how Smartsheets manages my, and other customers', PII. It does not (directly at least), cover information provided to my organization by our customers.

I have sent in a ticket & was referred to the privacy team, but they only sent a canned response that does not actually address the fact that it is not ok to have customer's PII sitting in the Activity Log for all time. Disappointing, let's see if they come back with more.

By the way, their only suggestion was to copy the sheet to get a fresh activity log, delete the old one, then apparently spend a day rebuilding reports, WorkApps, Dynamic Views from the new sheet. Not good, to say the least.

I don't really understand the casual nature of the approach here, this is essentially making Every Smartsheet user that collects PII for any reason to be non-compliant with GDPR unless they use the 'delete the entire sheet' approach any time a single individual requests that their info be removed. This is a big deal & needs attention.

Thanks!