Is Workday safe with your data?
Workday
Workday, Inc.
Weak disclosure · grade D is 35–47 · high confidence
Scored 35 ± 5 (range 30–40)
That range crosses the D/F cut, so read this app as D or F rather than firmly either. How we grade
Workday earns a D (35/100) because it leaves much about its data practices unstated.
#173
of 216 apps ranked
35
score · HR & recruiting avg 50
-15
vs category average
Workday's privacy statement covers only the company's own websites and marketing relationships, so the data most people put into Workday sits under their employer's contract rather than this policy, which names standard contractual clauses and the EU-U.S. Data Privacy Framework for its own transfers but sets no retention period.
What Workday's privacy policy and terms of service say about your data
Your HR data is governed elsewhere
When you use Workday through an employer, that organization is the controller and Workday acts as a processor, so this statement does not apply and rights requests must go to the employer.
Community forum posts carry a broad licence
The separate Workday Community terms, which cover the public forums rather than any HR record, take a perpetual, irrevocable, worldwide and sublicensable licence over what you post there, including your name and likeness, with no compensation.
Retention has no clock
The policy keeps personal information for as long as there is a legitimate business need and names no retention period or deletion deadline.
Transfer safeguards are named
International transfers rely on named mechanisms rather than a general assurance: standard contractual clauses approved by the European Commission, the EU-U.S. Data Privacy Framework with its UK and Swiss extensions, and the APEC Cross-Border Privacy Rules system.
Ad opt-out is spelled out
Targeted-advertising sharing is treated as a sale or share, with an opt-out through the Your Privacy Choices and Cookie Preferences links and support for the Global Privacy Control signal.
What the policy is silent or vague on
- Not stated: keeping user inputs out of model training
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
Workday privacy rating
Details
- Category
- HR & recruiting
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-02-27
- Region scored
- Global / US-default
- Last assessed
- 2026-10-13
Documents examined
Other hr & recruiting apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.