Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document establishes Workday's privacy practices for individuals who visit its website, attend its events, or engage with its marketing activities. The statement specifies that for individuals whose employers use Workday's HR, payroll, or workforce management systems, data handling is governed by a separate data processing agreement between Workday and the employer organization, rather than this consumer-facing privacy statement. Individuals in this category are directed to their employer's data protection policies and Workday employee notices for information on how their workplace data is processed.
This document is Workday's public-facing Privacy Statement governing the collection, use, and sharing of personal information by Workday, Inc. in connection with its website and enterprise software platform interactions. The statement asserts that Workday treats privacy as a fundamental right and commits to transparency about data practices, though the document as provided was substantially truncated, limiting full assessment of its operative clauses. Based on available text, the statement addresses data collection from website visitors, prospective customers, and individuals who interact with Workday marketing channels, with Workday acting as a controller for this category of personal data, while separately acknowledging its role as a processor for customer-employer data held within its HCM and financial management platforms. Workday's dual role as both data controller and data processor creates structurally distinct obligations that compliance teams at enterprise customers must evaluate separately, particularly given the sensitivity of HR, payroll, and workforce data processed through the platform. The statement's stated global applicability and acknowledgment of privacy as a universal right engages GDPR, UK GDPR, CCPA, and potentially other regional frameworks, though the full scope of regional-specific disclosures, data subject rights mechanisms, and lawful basis assertions could not be fully assessed from the truncated document text.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trialMonitoring
Workday has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Controller vs. Processor Dual Role and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.