Third-Party Data Sharing

What it is

ADP shares your personal data with its related companies, business clients, outside vendors, government agencies when required, and with any company that acquires ADP or its business units.

Why it matters (compliance & governance perspective)

Your personal data including payroll figures and health information may be shared with a broad range of entities, and in the event of a merger or acquisition, it could transfer to a new owner whose privacy practices may differ.

This document changed recently

Consumer impact (what this means for users)

ADP's data sharing extends to subsidiaries, employer-clients, third-party service providers, and potential acquirers, meaning sensitive employment and financial data may be accessed by a wide network of entities with varying privacy standards.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Third-party data sharing engages GDPR Article 13 disclosure requirements, which require that data subjects be informed of recipients or categories of recipients at the time of collection. The authorization for sharing with business acquirers may constitute a new processing purpose requiring legal basis under GDPR. The FTC Act applies to deceptive or unfair sharing practices in the US. CCPA requires disclosure of categories of third parties with whom data is shared and imposes opt-out rights for sharing constituting sale. GOVERNANCE EXPOSURE: Medium. The scope of sharing described is broad but not atypical for a multinational B2B services provider. The merger and acquisition sharing provision is standard but may create a new processing purpose under GDPR requiring notification to data subjects if their data transfers to a materially different controller. Sub-processor sharing creates additional governance obligations under GDPR Article 28. JURISDICTION FLAGS: EU and UK require specific disclosure of third-party recipients or categories. California requires disclosure of categories of third parties and an opt-out mechanism for sharing that constitutes selling or cross-context behavioral advertising. Any sharing with entities in countries without adequate data protection requires a transfer mechanism. CONTRACT AND VENDOR IMPLICATIONS: Employer-clients should audit their DPA with ADP to confirm that sub-processor sharing is governed by appropriate contractual terms and that ADP provides advance notice of new sub-processors as required. M&A scenarios may require contract amendments or notifications to employees whose data transfers. COMPLIANCE CONSIDERATIONS: Data mapping exercises should trace all third-party sharing flows and confirm legal bases for each. Legal teams should assess whether any sharing arrangements constitute 'sale' under applicable state law. Employee notification obligations in M&A scenarios should be assessed in advance as part of transaction planning.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Controller vs Processor Dual Role high
• Sensitive Personal Data Processing high
• Cross-Border Data Transfers via Binding Corporate Rules medium
• California Consumer Privacy Act Rights medium
• Cookie and Tracking Technology Use medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.