Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes processing of racial or ethnic data for supplier diversity programs, physical or mental health data for disability accommodation and emergency health needs, and religious beliefs data for accommodation purposes such as dietary and holiday requests, without requiring prior explicit consent for these listed uses.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Processing of racial or ethnic origin, health, and religious beliefs data constitutes processing of special categories of personal data under GDPR Article 9, requiring an explicit legal basis such as explicit consent, vital interests, or other Article 9(2) grounds. The policy states prior explicit consent is required only for uses outside the listed categories, while asserting these enumerated uses are covered under the BCR framework.
Interpretive note: The adequacy of the legal basis for processing racial, health, and religious data under each enumerated purpose — particularly for EU/EEA individuals under GDPR Article 9(2) — depends on jurisdiction-specific legal analysis and applicable national implementing legislation not detailed in this document.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →Under this clause, ADP may process racial or ethnic origin data, health data, and religious beliefs data for the stated accommodation and diversity purposes. The policy requires prior explicit consent only for processing of these categories beyond the listed purposes.
Cross-platform context
See how other platforms handle Special Categories of Data — Racial, Health, and Religious Data Processing and similar clauses.
Compare across platforms →Monitoring
ADP has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Racial or ethnic data. ADP may Process racial and ethnic data as needed to facilitate Supplier and other diversity programs. Physical or mental health data. ADP may Process physical or mental health data as needed to accommodate a person's disability or dietary needs, address emergency health needs, or in similar circumstances. Religion or beliefs. ADP may Process data pertaining to religion or beliefs as needed to meet an Individual's specific needs, such as accommodating dietary requests (for kosher or halal meals) or respecting religious holidays.Excerpt from ADP's Privacy Statement
REGULATORY LANDSCAPE: This provision engages GDPR Article 9, which prohibits processing of racial or ethnic origin, health data, and religious beliefs data except under specific conditions including explicit consent, vital interests, or substantial public interest with a basis in EU or member state law. The relevant enforcement authorities are EU national DPAs. In the United States, state privacy laws including CCPA/CPRA classify racial or ethnic origin, health data, and religious beliefs as sensitive personal information requiring opt-in consent or opt-out mechanisms depending on the processing context. GOVERNANCE EXPOSURE: Medium. The policy's enumeration of specific purposes for processing these categories (diversity programs, disability accommodation, religious observance) aligns with recognized Article 9(2) bases such as substantial public interest and vital interests. However, the adequacy of the legal basis for each specific use — particularly racial or ethnic data for supplier diversity programs — may require jurisdiction-specific assessment. JURISDICTION FLAGS: EU member states vary in their national implementing legislation for Article 9(2) substantial public interest bases. California's CPRA classifies racial origin and health data as sensitive personal information, requiring a link to a prominent opt-out of use or disclosure for targeted advertising contexts, and opt-in consent for certain uses. Organizations subject to US state privacy laws should assess whether ADP's processing of employee racial, health, or religious data for the stated purposes satisfies applicable state consent requirements. CONTRACT AND VENDOR IMPLICATIONS: Organizations that provide ADP with employee racial, health, or religious data through HR systems should confirm that their own data processing agreements with employees authorize the onward processing described in this policy. Supplier diversity programs involving racial or ethnic data may require specific legal basis documentation under GDPR. COMPLIANCE CONSIDERATIONS: Legal teams should map which specific data flows involve racial, health, or religious data and confirm the applicable Article 9(2) legal basis for each. US organizations subject to CCPA/CPRA should assess whether employee exemptions or other carve-outs apply to these data categories in the ADP processing context. Consent mechanism audits should confirm that explicit consent is obtained where required.
Processing of racial or ethnic origin, health, and religious beliefs data constitutes processing of special categories of personal data under GDPR Article 9, requiring an explicit legal basis such as explicit consent, vital interests, or other Article 9(2) grounds. The policy states prior explicit consent is required only for uses outside the listed categories, while asserting these enumerated uses are …
Under this clause, ADP may process racial or ethnic origin data, health data, and religious beliefs data for the stated accommodation and diversity purposes. The policy requires prior explicit consent only for processing of these categories beyond the listed purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.