If your employer uses Gusto, your employer controls much of the data submitted about you, and your privacy rights may be shaped by both Gusto's policy and your employer's own privacy practices.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Employees have limited direct control over data their employer submits to Gusto, and they must navigate both Gusto's and their employer's privacy frameworks to understand their full rights.
Interpretive note: The practical scope of employee rights to independently exercise deletion or correction requests against Gusto, without employer authorization, is not fully specified in the policy and may depend on applicable state employment privacy law.
The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →The updated terms make explicit that using Gusto's background check service constitutes a binding agreement. Previously, the terms of the service relationship may have been less clearly stated. Now, the agreement clarifies that an authorized signatory represents they have authority to bind the organization, and that three actions trigger binding acceptance: checking a box, initiating a background check, or accessing the service. This means employers should ensure the person clicking through has actual authority to commit the organization to the full Background Check Customer Agreement before proceeding.
View change record →The updated terms now explicitly state that employers accept mandatory individual arbitration and waive the right to participate in class-action lawsuits or pursue relief in court with a jury trial. This significantly limits employers' ability to challenge Gusto's practices collectively or seek resolution through the court system. Any disputes employers have with Gusto must be resolved individually through arbitration, which typically involves private, binding proceedings with limited appeal options and discovery rights compared to court litigation.
View change record →This new provision explicitly states that employers control employee data and their privacy policies may apply, potentially creating dual privacy obligations and shifting responsibility for data protection to the employer rather than Gusto.
View full change record →As an employee, your payroll, tax, and HR data is submitted to Gusto by your employer, meaning Gusto's obligations run primarily to the employer rather than to you directly, which can limit your practical ability to request changes or deletions independently.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
Gusto has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When an Employer uses the Gusto Platform to manage its human resources and payroll functions, we collect personal information from or about Team Members in order to provide the Gusto Platform to Employers. If you are a Team Member, your Employer controls certain information you submit through the Gusto Platform, and your Employer's privacy policy and practices may also apply to your use of the Gusto Platform.— Excerpt from Gusto's Gusto Privacy Policy
1) REGULATORY LANDSCAPE: The employer-as-data-controller and Gusto-as-service-provider structure has direct implications under CCPA/CPRA, which distinguishes between a business's obligations to consumers and a service provider's obligations to the contracting business. Employee privacy in the workplace is also governed by state-specific employment privacy laws, particularly in California (which has enacted specific employee privacy protections) and New York. The FTC Act applies to unfair or deceptive practices affecting employees as data subjects. 2) GOVERNANCE EXPOSURE: High. The layered data relationship creates potential gaps in employee rights fulfillment: employees may submit rights requests to Gusto that Gusto is contractually constrained from fulfilling without employer authorization, leading to a situation where the practical exercise of privacy rights depends on employer cooperation. This structure is common in B2B HR platforms but creates meaningful employee-facing risk in jurisdictions with robust employee privacy laws. 3) JURISDICTION FLAGS: California Labor Code and California Consumer Privacy Act both provide protections for employees as data subjects; the interaction between employer control rights and employee CPRA rights creates heightened exposure for California-based employers using Gusto. Illinois Biometric Information Privacy Act and New York SHIELD Act may impose additional obligations on employers for data processed through third-party HR platforms. 4) CONTRACT AND VENDOR IMPLICATIONS: Employers should review their services agreement with Gusto to confirm Gusto's obligations when an employee submits a direct rights request, including whether Gusto will notify the employer, fulfill the request independently, or require employer authorization. Indemnification provisions should address liability for employee claims arising from Gusto's data handling. 5) COMPLIANCE CONSIDERATIONS: Employers should ensure their employee privacy notices explicitly disclose Gusto's role as a payroll and HR platform, the categories of data submitted, and the mechanism by which employees can exercise rights. HR and legal teams should establish a clear protocol for routing employee privacy rights requests that arrive at either the employer or Gusto.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Employees have limited direct control over data their employer submits to Gusto, and they must navigate both Gusto's and their employer's privacy frameworks to understand their full rights.
As an employee, your payroll, tax, and HR data is submitted to Gusto by your employer, meaning Gusto's obligations run primarily to the employer rather than to you directly, which can limit your practical ability to request changes or deletions independently.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.