Workday Adaptive Planning

GDPR overview

Implementation is documented in concrete terms rather than claimed in general. The privacy statement in force since 27 February 2026 names Workday Limited, Kings Building, 152-155 Church Street, Dublin 7, D07 A0TN, Ireland as the controller for the EEA, the UK and Switzerland, with the Irish Data Protection Commission as competent supervisory authority. Transfers rely on European Commission standard contractual clauses and on the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework. Binding Corporate Rules, a Universal Data Protection Exhibit and a subprocessor list are published. Workday Adaptive Planning is in scope for the EU Cloud Code of Conduct (Adherence ID 2019LVL02SCOPE001) and for ISO/IEC 27701 and 27018. Access, rectification, erasure, objection, restriction, portability and consent withdrawal are all listed; requests and the DPO go through an online form, with no published email address.

Who owns the data?

Two different documents apply. For the enterprise service, Workday describes a subscription model in which the customer organisation controls the data it and its users put into the platform and how that data is used; Workday acts as processor under its customer contract and states that it does not sell customer users' data or monetise it through advertising. For the public website and the Workday Community, the site terms apply instead: you keep the rights to content you post, but you grant Workday a perpetual, irrevocable, non-exclusive, royalty-free, worldwide and sublicensable licence to use, modify, translate, distribute and publicly display it. Site content itself remains owned by Workday or its licensors.

Reuse rights

Inside the planning platform, reuse is governed by the customer contract rather than by the public terms: the customer organisation decides how its data is used, and an individual employee who wants to access, correct or delete personal information is told to approach their own organisation, not Workday. Workday nonetheless collects systems usage information — which products are opened, when, and telemetry around performance — as a controller in its own right, and says this data does not identify users directly unless the customer organisation explicitly instructs otherwise. On the website and Community, anything you post can be reused very broadly by Workday under the licence described in the site terms.

Data retention & training

Hosting summary

No hosting country or region is published on any of the pages reviewed, including the pricing, privacy, terms, trust, compliance and subprocessor pages. What Workday does say is that it operates as a global business and may transfer, store or process personal information outside the user's own jurisdiction, applying safeguards when it does. For transfers out of the European Economic Area, the United Kingdom or Switzerland to the United States, it relies on standard contractual clauses approved by the European Commission, adding contractual, technical and organisational measures where needed, and it adheres to the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework. The controller is Workday Limited in Dublin for the EEA, the UK and Switzerland, and Workday, Inc. in the United States for everyone else. A subprocessor list is published and notifiable by subscription, and the vendor describes a multi-tenant environment with high levels of encryption. The dedicated security page was not reachable at the time of review, so technical hosting detail could not be verified.