ADP uses a set of internal rules approved by European data protection regulators to legally transfer your data from Europe to ADP offices and systems in other countries, including the United States.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
BCR are a recognized but operationally complex transfer mechanism. If regulators in any country determine that BCR do not provide adequate protection, data transfers relying on them could be suspended, potentially disrupting payroll and HR services.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →Personal data of employees in the EU, UK, and Switzerland may be transferred to ADP entities in countries with different privacy standards, with the BCR framework serving as the legal safeguard. If those safeguards are found inadequate, your data's cross-border protection could be affected.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"ADP has adopted Binding Corporate Rules (BCR) for processing Client employee data and business contact data and has implemented BCR for processing personal data of ADP Associates. The BCR allow ADP to transfer personal data from the European Economic Area (EEA), the United Kingdom, and Switzerland to ADP entities located outside these countries in a way that complies with European data protection requirements.Excerpt from ADP's Privacy Statement
REGULATORY LANDSCAPE: BCR are governed under GDPR Article 47 and require approval from a lead supervisory authority.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
BCR are a recognized but operationally complex transfer mechanism. If regulators in any country determine that BCR do not provide adequate protection, data transfers relying on them could be suspended, potentially disrupting payroll and HR services.
Personal data of employees in the EU, UK, and Switzerland may be transferred to ADP entities in countries with different privacy standards, with the BCR framework serving as the legal safeguard. If those safeguards are found inadequate, your data's cross-border protection could be affected.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.