ADP, LLC
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🟡 Approve with conditions
Privacy score 91.1% · band Good
Strong privacy posture (91.1%, Good); no violations. One mandatory gate is unaddressed (Q16 (AI & Model-Training)) — approve on the condition it's confirmed; Round 2 optional, not blocking. Coverage note: the policy addresses 9 of 16 questions (56%); a vendor cannot reach the Best band below 70% coverage.
Unaddressed gate(s): Q16 — not covered by the public policy. Confirm before relying on this.
Quote check: 12 of 13 quotes found in the vendor's document. 1 not found (Q2). Each of those answers is set to unclear and cannot support an approval.
Q8, Q18: the quote joins separate passages with "...". Every part is in the document.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE |
| 60.0% |
| Data Sharing GATE |
| 100.0% |
| Data Sold GATE |
| 100.0% |
| Data Rights |
| 100.0% |
| Retention |
| 100.0% |
| Data Security | n/a | — |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ | n/a | — |
| Jurisdiction & Residency |
| 100.0% |
| Contract & Assurance | n/a | — |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
✓ Good
T3
Answer: Yes
“We collect and use only the minimum personal data necessary to achieve the business purpose for which it was collected.”
Data minimization principle stated in Document 2.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
? Not addressed
T0
Answer: Unclear
Bank/payroll data mentioned; also references to sensitive data in context of proportional security. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “Personal Data also includes other information that may be associated with your Personal Data... creditworthiness, customer account information... bank account information”
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
✓ Good
T3
Answer: Yes
“If you are a Client employee or worker, ADP will process your data in accordance with the instructions that we receive from our Clients.”
Document 2 explicitly states ADP processes client employee data per client instructions.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“Development and improvement of products and/or services. ADP may process Personal Data to develop and improve ADP's products and/or services, and for research, development, analytics, and business intelligence.”
Document 1 Section 3(d) describes use of personal data for product analytics and business intelligence beyond service delivery.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
✓ Good
T3
Answer: Yes
“We limit our sharing of your Personal Data to: ADP Group Companies, which will only use your Personal Data for the purposes listed above. Our service providers, who are bound by law or contract to protect your Personal Data and only use your Personal Data in accordance with our instructions.”
Sharing limited to service providers and group companies acting on vendor's behalf.
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T0
Answer: Unclear
No published sub-processor list, no commitment to notify before adding sub-processors, and no cloud host named.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“ADP commits to not provide your Personal Data to Third Parties for their own marketing purposes.”
Policy explicitly states no sale or rental for third-party marketing purposes.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“ADP respects your right to access, correct, and delete your Personal Data, or object to the processing of your Personal Data. If you have an online account, you may log into your account to access update, or delete the information you have provided to us. Additionally, you may contact privacy@adp.com. to request access to your data... ADP will respond to requests as soon as possible and in accordance with applicable data protection laws and regulations.”
Process described; response time is 'as soon as possible' per applicable law, not a specific hour count.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
✓ Good
T3
Answer: Yes
“When the retention period has expired, records containing Personal Data will be securely deleted or destroyed, de-identified, or transferred to archive, in accordance with ADP's RIM Policy.”
Deletion/return at end of retention period stated; ownership language not explicit but deletion commitment present.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
✓ Good
T3
Answer: Yes
“ADP will only retain your information for as long as necessary for the Purposes for which the Personal Data is processed. ADP has implemented a Global Records Information Management (RIM) Policy and has established records retention schedules for all types of Personal Data that ADP processes.”
Retention schedules established; deletion described as per RIM Policy but specific period not stated in excerpt.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T3
Answer: Unclear
“ADP is committed to maintaining the appropriate organizational, technical, and physical controls to protect Personal Data entrusted to ADP.”
General security commitment stated but does not name encryption standards (TLS, AES), SSO/MFA, or independent attestation. Document 2 mentions ISO 27701 certification but not SOC 2 or ISO 27001 in the context of customer data.
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T3
Answer: Unclear
“ADP's incident response process is designed to ensure that any incidents involving your personal data are addressed, tracked and reported in a timely and effective manner and in accordance with ADP security policies, procedures, and legal requirements.”
Commitment to timely reporting stated but no specific hour or day count given for customer notification.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
— N/A
T0
Answer: N/A
not applicable to this product type
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
— N/A
T0
Answer: N/A
not applicable to this product type
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
— N/A
T0
Answer: N/A
not applicable to this product type
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
? Not addressed
T3
Answer: Unclear
“Development and improvement of products and/or services. ADP may process Personal Data to develop and improve ADP's products and/or services, and for research, development, analytics, and business intelligence.”
Policy mentions product improvement but does not explicitly state whether customer data is used to train AI/ML models or only for service improvement.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
? Not addressed
T0
Answer: Unclear
No disclosure of automated decision-making affecting staff (screening, scheduling, pay, access) or human review process.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
✓ Good
T3
Answer: Yes
“ADP is headquartered in the United States of America. Your Personal Data may be accessed by or transferred to our Group Companies and Suppliers in the United States or elsewhere in the world in accordance with the ADP Privacy Code for Business Data... In addition to the rights already listed in this Privacy Statement under Section 8, you also have the right to data portability, as well as the right to be notified of automated decision making or profiling related to your Personal Data... ADP will comply with applicable laws in case of transfer of personal data across country borders.”
Storage in US and worldwide mentioned; GDPR compliance referenced in Document 2.
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
? Not addressed
T0
Answer: Unclear
No explicit mention of a data-processing agreement (DPA) or data processing addendum available to customers in the provided documents.
Jurisdiction & residency — your footprint
Vendor named 0 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“ADP is headquartered in the United States of America. Your Personal Data may be accessed by or transferred to our Group Companies and Suppliers in the United States or elsewhere in the world... If you are a California resident, please see our California Consumer Privacy Statement... ADP will comply with applicable laws in case of transfer of personal data across country borders.”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |