The protection of personal data is our highest priority. Our data protection framework ensures that personal data relating to our customers and their employees are processed securely, lawfully and responsibly throughout the entire data life cycle, from collection and use to storage and deletion.
Data protection as an integral part of our products and services
We process personal data lawfully, transparently and for specified purposes only. We implement technical and organisational measures to ensure that such processing complies with the GDPR.
Use of Data Processors
To provide our services, we engage carefully selected subprocessors. These subprocessors are subject to binding requirements relating to data protection, information security and compliance.
Our principles governing the engagement of subprocessors:
- Before being engaged, subprocessors undergo a comprehensive review and risk assessment.
- Subprocessors are engaged on the basis of a valid data processing agreement (DPA) pursuant to Article 28 GDPR.
- We engage only subprocessors that can demonstrate appropriate technical and organisational measures to protect personal data.
- All subprocessors have their registered office and/or data centres within the EU/EEA.
- Customers are given in advance of the engagement of new subprocessors.
- A complete list of subprocessors is included in our data processing agreement (DPA).
Data centres
All data relating to our customers and their employees are processed exclusively in data centres located within the European Union. The data centres we use meet recognised international security standards and ensure, through an established information security management system (ISMS), a high level of data availability, integrity and confidentiality.
Our payroll software, Paychex Europe Payroll, is hosted on the cloud infrastructure of Amazon Web Services (AWS). Data is processed in AWS data centres in Germany. Both AWS and the Netic data centre we use are certified to ISO/IEC 27001. These certifications confirm that comprehensive technical and organisational security measures have been implemented and that continuous risk management is in place.
Further information on ISO/IEC 27001 certification:
No transfers of data to third countries
No personal data relating to our customers or their employees is transferred to third countries outside the EU/EEA. All data is stored and processed exclusively within the EU/EEA, in compliance with high security and data protection standards.
Where customer data is processed in our payroll software, Paychex Europe Payroll DE, such processing takes place exclusively on servers operated by Amazon Web Services (AWS) in Germany (see Data centres). We use only AWS services that are certified in accordance with CISPE or C5, as applicable.
The CISPE Code of Conduct was presented at the European Parliament on 27 September 2016. Beyond mandatory compliance with the GDPR, the Code ensures that customers may choose to have their data stored and processed exclusively in Europe.
The C5 criteria catalogue was first published in 2016 by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI). The C5 criteria catalogue (Cloud Computing Compliance Criteria Catalogue) specifies minimum requirements for secure cloud computing and is intended primarily for professional cloud providers, their auditors and their customers.
Legal notice: The content of this Trust Center is provided solely for general informational purposes and does not constitute legal advice. Data protection and security measures may change as our products and services continue to evolve.
