Your employer — not Gusto — is legally responsible for deciding how your data is used when Gusto processes payroll on the employer's behalf. Gusto acts as the data processor carrying out those instructions.
Previous version had no excerpt; current version adds explicit clarification that Gusto is a data processor and employers are controllers determining processing purposes and means.
View full change record →Employees whose payroll is run through Gusto may need to contact their employer — not just Gusto — to exercise data privacy rights like access or deletion, because the employer is the legal data controller for employment-related data.
Cross-platform context
See how other platforms handle Employer as Data Controller; Employee Data Collected on Employer's Behalf and similar clauses.
Compare across platforms →Employees may assume Gusto is solely responsible for protecting their data, but in the employer-client context, both your employer and Gusto share responsibility, and your privacy rights may need to be exercised through your employer rather than directly with Gusto.
(1) REGULATORY FRAMEWORK: The controller-processor distinction is central to GDPR (Art. 4(7)-(8), Art. 28) and is increasingly adopted in U.S. CDPAs (California CPRA §1798.140(j); Virginia CDPA §59.1-575; Colorado CPA §6-1-1301). Under CPRA, the employer-client is the 'business' and Gusto is the 'service provider,' limiting how Gusto may use employee data. GLBA applies to Gusto as a financial institution handling employee financial data regardless of the controller-processor distinction. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.