Company: ADP
Filing Date: 2025-08-06
Form Type: 10-K
Source: 0000008670-25-000037
Chunk: 23

Company: AUTOMATIC DATA PROCESSING INC
Filing Date: 2025-08-06
Form: 10-K
Item: Item 1A
Chunk 23
---
 processing, disclosure, use, security and retention and destruction of personal information; require notice to individuals of privacy practices; give individuals certain access and correction rights with respect to their personal information; and regulate the use or disclosure of personal information for secondary purposes such as marketing. Under certain circumstances, some of these laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators in the event of a data breach. In many cases, these laws apply not only to third-party transactions, but also to transfers of information among the Company and its subsidiaries. The European Union (the “EU”) General Data Protection Regulation (the “GDPR”), and state consumer privacy laws like the California Privacy Rights Act of 2020 (the “CPRA”), are among the most comprehensive of these laws, and more and more jurisdictions are adopting similarly comprehensive laws that impose new data privacy protection requirements and restrictions. As part of our overall data protection compliance program in connection with the GDPR, we implemented Binding 

17

Corporate Rules (“BCRs”) as both a data processor and data controller, which permits us to process and transfer personal data across borders in compliance with EU data protection laws.  In addition, the Department of Justice implemented a Data Security Program under Executive Order 14117 restricting certain transfers of U.S. persons’ sensitive data to “countries of concern” and we have taken  appropriate steps to comply. We believe that providing insights and content from data, including via AI and ML, will become increasingly important to the value that our solutions and services deliver to our clients. We are increasingly leveraging AI and ML in our solutions and service delivery and are exploring how best to integrate generative AI technologies and develop and deploy capabilities that are beneficial to our clients and their employees. However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad, most notably the European Union’s Artificial Intelligence Act. In addition, self-regulatory frameworks like the National Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation. As a result, the ability to provide data-driven insights and otherwise leverage AI and ML may be constrained by current or future laws (including product liability regimes), regulatory or self-regulatory requirements or ethical considerations, including our own published, guiding ethical principles regarding AI and ML, that could restrict or impose burdensome and costly requirements on our ability to leverage data and/or