The policy states that ADP processes client employee HR, payroll, and benefits data as a data processor acting under employer instruction, and directs employees to contact their employer to exercise data rights rather than contacting ADP.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that the employing organization, not ADP, bears the primary data controller obligations for employee data processed through ADP's platforms, creating a structural redirection of individual data subject rights requests and determining which entity is accountable under GDPR and equivalent frameworks.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →Under this clause, employees whose payroll, tax, benefits, or HR data is processed through ADP cannot direct access, correction, or deletion requests to ADP and must instead contact their employer, who retains controller responsibility for determining how that data is used and disclosed.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"ADP acts as a data processor for the personal data of our clients' employees. This means that ADP processes personal data on behalf of our clients (the data controllers) and in accordance with their instructions. If you are an employee of one of our clients and would like to exercise your data protection rights or have questions about how your data is being used, please contact your employer directly.Excerpt from ADP's Privacy Statement
1) REGULATORY LANDSCAPE: This provision engages GDPR Article 4 (definitions of controller and processor), Article 28 (processor obligations), and Articles 15-22 (data subject rights).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that the employing organization, not ADP, bears the primary data controller obligations for employee data processed through ADP's platforms, creating a structural redirection of individual data subject rights requests and determining which entity is accountable under GDPR and equivalent frameworks.
Under this clause, employees whose payroll, tax, benefits, or HR data is processed through ADP cannot direct access, correction, or deletion requests to ADP and must instead contact their employer, who retains controller responsibility for determining how that data is used and disclosed.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.