Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data is retained only as long as necessary for stated business purposes, legal compliance, or applicable statutes of limitations, following ADP's Global Records Information Management Policy, and is securely deleted, destroyed, de-identified, or archived at the end of the retention period.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The retention framework references ADP's internal Global RIM Policy and records retention schedules as the governing mechanism, but those schedules are not published or disclosed in this document. The stated disposal methods include archiving as an alternative to deletion, which may affect the practical exercise of erasure rights.
Interpretive note: The specific retention periods established in ADP's Global RIM Policy are not disclosed in this document, limiting the ability to assess whether retention practices satisfy GDPR storage limitation and CCPA/CPRA disclosure requirements.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →Under this clause, personal data will be retained according to internal retention schedules not disclosed in the policy, and may be transferred to archive rather than deleted at the end of the retention period. Individuals seeking to exercise erasure rights should be aware that archiving is listed as an alternative disposal method alongside secure deletion.
Cross-platform context
See how other platforms handle Data Retention and Records Management and similar clauses.
Compare across platforms →Monitoring
ADP has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"ADP will only retain your information for as long as necessary for the Purposes for which the Personal Data is processed. ADP has implemented a Global Records Information Management (RIM) Policy and has established records retention schedules for all types of Personal Data that ADP processes. Personal Data is retained in accordance with the records retention schedules to ensure that records containing Personal Data are retained as needed to fulfill the applicable Business Purposes, to comply with applicable laws, or as advisable in light of applicable statutes of limitations. When the retention period has expired, records containing Personal Data will be securely deleted or destroyed, de-identified, or transferred to archive, in accordance with ADP's RIM Policy.Excerpt from ADP's Privacy Statement
REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e) (storage limitation principle), which requires that personal data be kept no longer than necessary for the purpose of processing. CCPA/CPRA similarly requires that data retention periods be disclosed and proportionate. The relevant enforcement authorities are EU national DPAs and the California Privacy Protection Agency. The policy does not disclose the specific retention periods established in ADP's RIM Policy, which may be required for full GDPR transparency compliance. GOVERNANCE EXPOSURE: Medium. The use of archiving as an alternative to deletion may limit the practical effect of individual erasure requests if archived data remains accessible or identifiable. GDPR generally permits archiving for public interest, scientific, or historical research purposes under specific conditions, but commercial archiving as a general retention alternative may require additional legal basis documentation. JURISDICTION FLAGS: GDPR requires that retention periods or the criteria used to determine them be disclosed to data subjects. The absence of specific retention schedules in this document may engage transparency requirements under GDPR Article 13 and 14. California's CPRA requires disclosure of the period for which each category of personal information will be retained. CONTRACT AND VENDOR IMPLICATIONS: Organizations engaging ADP as a data processor should request disclosure of the applicable retention schedules for the specific categories of personal data processed on their behalf, to confirm alignment with their own retention obligations and deletion timelines. COMPLIANCE CONSIDERATIONS: Compliance teams should request ADP's retention schedule documentation for all categories of personal data relevant to their engagement and confirm that archiving procedures do not circumvent erasure rights. Data processing agreements should specify the retention periods applicable to employee data processed by ADP on behalf of the organization.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The retention framework references ADP's internal Global RIM Policy and records retention schedules as the governing mechanism, but those schedules are not published or disclosed in this document. The stated disposal methods include archiving as an alternative to deletion, which may affect the practical exercise of erasure rights.
Under this clause, personal data will be retained according to internal retention schedules not disclosed in the policy, and may be transferred to archive rather than deleted at the end of the retention period. Individuals seeking to exercise erasure rights should be aware that archiving is listed as an alternative disposal method alongside secure deletion.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.