Controller vs Processor Dual Role

What it is

When your employer uses ADP for payroll or HR, ADP follows your employer's instructions for handling your data, and your employer is legally responsible for most data decisions. If you want to know how your data is used or want to change it, you generally need to ask your employer, not ADP.

Why it matters (compliance & governance perspective)

This provision determines who you can hold accountable for your data. For most employees, ADP is not the primary point of contact for data rights, which can make exercising those rights slower or more complex.

This document changed recently

Consumer impact (what this means for users)

Employees whose companies use ADP for payroll or HR may find that ADP redirects their requests to their employer, meaning accessing, correcting, or deleting payroll and benefits data requires going through your employer's HR department rather than contacting ADP directly.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 4(7) and 4(8) defining controller and processor roles, and Article 28 requiring a written data processing agreement between controller and processor. The applicable enforcement authorities are EU national data protection authorities and the UK ICO. The allocation of responsibility to the employer-client as controller does not fully eliminate ADP's compliance obligations as a processor, including security, sub-processor management, and breach notification duties. GOVERNANCE EXPOSURE: High. The dual-role structure creates compliance complexity because ADP's obligations to data subjects differ significantly depending on context. If ADP inadvertently acts as a controller in situations it characterizes as processor engagements, or if employer-clients have inadequate DPAs, both parties face regulatory exposure. The redirection of individual rights requests to employers may not satisfy regulatory expectations if employers are unresponsive or if ADP cannot demonstrate a compliant DPA is in place. JURISDICTION FLAGS: EU and UK jurisdictions create the highest exposure given GDPR and UK GDPR Article 28 requirements for documented DPAs. California creates additional exposure under CCPA's service provider framework, which similarly requires contractual restrictions on downstream data use. Illinois BIPA may apply independently of this controller/processor distinction for biometric data. CONTRACT AND VENDOR IMPLICATIONS: Employer-clients procuring ADP services must confirm that their master service agreements include a compliant data processing addendum. Procurement teams should audit whether ADP's standard DPA covers all relevant processing activities, sub-processors, and transfer mechanisms. The policy's redirection of employee rights to employers means HR teams must have processes to handle these requests. COMPLIANCE CONSIDERATIONS: Legal teams should map which ADP processing activities fall under controller versus processor roles for their organization. Organizations should verify that ADP provides timely sub-processor change notifications as required under GDPR Article 28(2). HR policy updates may be needed to route employee data requests appropriately.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sensitive Personal Data Processing high
• Cross-Border Data Transfers via Binding Corporate Rules medium
• California Consumer Privacy Act Rights medium
• Cookie and Tracking Technology Use medium
• Data Retention medium
• Third-Party Data Sharing medium

Related Analysis

• What 38 AI Companies Actually Say About Your Data (2026)

  We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.