Global Data Privacy
Workday and our customers must comply with complex global privacy laws and regulations. Workday demonstrates compliance with international privacy regulations by maintaining a comprehensive global data protection program that contains technical and organizational safeguards designed to prevent unauthorized access to and use or disclosure of customer data. Workday remains committed to global privacy standards, as shown by our dedication to programs such as the Privacy Shield, implementation of Binding Corporate Rules (BCR), and Asia-Pacific Economic Cooperation Privacy Rules for Processors. Our applications are designed to allow you to achieve differentiated configurations to help you meet your country’s specific laws.
EU Data Privacy
On May 25, 2018, the General Data Protection Regulation (GDPR) significantly changed the European data privacy landscape. The GDPR harmonized the patchwork of data protection laws in Europe. Workday is confident that we can process our customers’ personal data in alignment with the GDPR.
Some highlights of how Workday’s robust privacy and security practices support GDPR compliance include:
- Reoccurring role-based employee training on security and privacy practices
- Well-developed processes to capture Privacy Impact Assessments
- Offering data transfer mechanisms to legalize transfers of personal data outside of the European Economic Area, including the Workday BCRs
- Maintaining records of processing activities
- Providing configurable privacy and compliance features to our customers
In addition, Privacy by Design and Privacy by Default are concepts deeply enshrined in the Workday Service. Workday continues to monitor guidance that EU supervisory authorities issue to ensure that our compliance program remains up-to-date.
Workday understands that not only is it important for our own organization to be compliant with GDPR as a data processor, but also for our customers to be able to use the Workday Service to help with their internal compliance requirements. This is why Workday offers tools to help meet their Customers’ GDPR obligations. Learn more about how we enable our customers to meet their GDPR obligations.
Data Transfer Mechanisms
Workday offers our customers various data transfer mechanisms. Workday’s agreement includes the European Commission’s Standard Contractual Clauses (SCC), which enable the transfer of personal data from the European Economic Area to the United States. In addition, Workday offers customers Processor Binding Corporate Rules (BCRs) as an additional transfer mechanism. Workday’s BCR are available here.
Additional Compliance Commitments
Workday signed up for the Privacy Shield on the first day the U.S. Department of Commerce launched the Privacy Shield certification process, demonstrating our strong, ongoing commitment to privacy and protecting our customers’ data. Even though the Privacy Shield is no longer a valid data transfer framework, Workday continues to certify to the Department of Commerce that we adhere to the Privacy Shield Principles. While companies can self-certify to the Privacy Shield, Workday uses TRUSTe as our third-party verification agent to further demonstrate our compliance. Read more about our TRUSTe verification status to Privacy Shield.
Workday was the first cloud service provider to declare adherence to the EU Cloud Code of Conduct (CCoC), which consists of a set of requirements that enable cloud service providers (CSPs) to demonstrate their capability to comply with GDPR. Annual reviews take place by the independent monitoring body. Verify Workday’s adherence to the CCoC.
Workday has certified to both the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules (APEC CBPR) and Privacy Rules for Processors (APEC PRP). The APEC certifications are a voluntary set of privacy standards developed for data controllers and processors, respectively, to facilitate data transfers among APEC economies. These certifications demonstrate compliance with high standards of privacy compliance throughout the Asia-Pacific region.
Workday was one of the first companies to be certified to the APEC CBPR in March 2014, and the first to be certified for APEC PRP in September 2018. We have received a third-party certification from TRUSTe, which is the APEC Accountability Agent for the United States.