The policy states that ADP uses EU Supervisory Authority-approved Binding Corporate Rules as the legal mechanism for transferring client employee data, business contact data, and associate data across ADP's global entity network.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
BCR approval is a regulatory authorization mechanism under GDPR Chapter V that requires ongoing supervisory authority oversight; this provision identifies the specific transfer mechanism ADP relies on for intra-group international data flows, which is operationally significant for client organizations evaluating the legality of their cross-border HR data transfers through ADP.
Interpretive note: The document asserts BCR approval but does not specify the lead supervisory authority, the approval date, or whether UK GDPR-specific BCR authorization has been obtained; these details are material to assessing current validity.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →This provision establishes that personal data transferred globally within ADP's corporate group is covered by a regulatory-approved BCR framework, which is the legal basis ADP asserts for those transfers under GDPR rather than requiring separate contractual clauses for each transfer.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"ADP has adopted Binding Corporate Rules (BCR) for processing Client employee data and business contact data and has implemented BCR for processing personal data of ADP Associates. ADP's BCR have been approved by the relevant EU supervisory authority.Excerpt from ADP's Privacy Statement
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 46 and 47, which govern binding corporate rules as a valid cross-border transfer mechanism.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
BCR approval is a regulatory authorization mechanism under GDPR Chapter V that requires ongoing supervisory authority oversight; this provision identifies the specific transfer mechanism ADP relies on for intra-group international data flows, which is operationally significant for client organizations evaluating the legality of their cross-border HR data transfers through ADP.
This provision establishes that personal data transferred globally within ADP's corporate group is covered by a regulatory-approved BCR framework, which is the legal basis ADP asserts for those transfers under GDPR rather than requiring separate contractual clauses for each transfer.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.