ADP keeps your personal data for as long as needed to provide services and comply with legal requirements, with the specific length of time determined by the type of data and applicable law.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without specific retention timelines for each data category, it is difficult for individuals or employers to predict when their data will be deleted, which affects the practical ability to enforce deletion rights.
Interpretive note: The policy describes criteria for retention rather than specific timelines, leaving the actual retention period for most data categories unclear and context-dependent.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →ADP does not commit to specific retention periods for most data categories in this policy, meaning payroll, health, and financial data may be retained for extended periods at ADP's discretion within legal bounds, limiting the practical effectiveness of deletion requests.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal data for as long as necessary to fulfill the purposes outlined in this Privacy Statement, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include: the length of time we have an ongoing relationship with you and provide services to you; whether there is a legal obligation to which we are subject; and whether retention is advisable in light of our legal position.Excerpt from ADP's Privacy Statement
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires personal data to be kept in a form that permits identification no longer than necessary for the specified purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Without specific retention timelines for each data category, it is difficult for individuals or employers to predict when their data will be deleted, which affects the practical ability to enforce deletion rights.
ADP does not commit to specific retention periods for most data categories in this policy, meaning payroll, health, and financial data may be retained for extended periods at ADP's discretion within legal bounds, limiting the practical effectiveness of deletion requests.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.