> How Workday handles employee and finance data, what cookies its website sets, and how GDPR consent, legal basis, and data transfers apply. > > Canonical: https://www.flowconsent.com/en/services/other/workday Other # Workday Marketing · [Official website](https://www.workday.com) Workday is a United States cloud platform for human capital management and finance used by large organisations. The application itself is a business backend that stores employee and financial records, while its public marketing website sets functional, analytics, and marketing cookies. Understanding both layers matters for accurate consent and privacy documentation. [Block Workday until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers United States, with European data centres available Overview ## What does Workday do? ## **What Workday is** Workday is an enterprise cloud suite for human capital management and finance, used by large employers to run payroll, recruiting, performance, and accounting. It is primarily a business to business backend that holds sensitive employee and financial data on behalf of the contracting organisation. Its public facing marketing website is a separate concern and behaves like any other corporate site. ## **Data and cookies involved** Inside the application, Workday processes detailed personal data such as names, identifiers, compensation, and performance information. On the public website, Workday sets strictly necessary functional cookies for sessions and load balancing, plus analytics and marketing cookies that measure visits and support advertising. The two contexts carry very different privacy expectations and should be documented separately. ## **GDPR and ePrivacy considerations** For the HR and finance application, the employer is the controller and Workday acts as a processor under a data processing agreement, with contract as the usual legal basis. For the public website, the ePrivacy rule on storing information in the browser applies, so analytics and marketing cookies require prior consent. Strictly necessary functional cookies are exempt from that consent requirement. ## **Consent and configuration** On the website, a consent banner should block analytics and marketing cookies until the visitor opts in, and respect later withdrawal. Within the application, lawful processing relies on the employment relationship and the processor contract rather than cookie consent. Clear separation of these mechanisms avoids treating employee data as if it depended on website consent. ## **International data transfers** Workday is headquartered in the United States and may process customer data there unless an EU data centre is contracted. Transfers outside the EEA rely on Standard Contractual Clauses together with supplementary measures where needed. Organisations handling sensitive HR data should confirm the contracted hosting region and document the transfer mechanism in their records. ## **Practical compliance steps** Sign and retain a data processing agreement, confirm the hosting region, and maintain records of processing for the application. For the website, deploy a compliant consent banner, categorise each cookie, and keep your cookie policy current. Review access controls and retention settings periodically to keep employee data protected. Compliance ## Workday and the GDPR Workday is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract for the HR and finance application (GDPR Art. 6(1)(b)); consent for website analytics and marketing cookies (Art. 6(1)(a), ePrivacy Art. 5(3)) - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A data protection impact assessment is often warranted because the application processes personal data on a large scale and can include sensitive categories. Key points to assess are (1) the volume and sensitivity of employee and financial records held in the system; (2) the legal basis for each processing activity, typically contract and legitimate interests for HR administration; (3) international transfers to the United States and the adequacy of Standard Contractual Clauses with supplementary measures; (4) access controls, role based permissions, and audit logging across the organisation; and (5) for the public website, the separate question of analytics and marketing cookies and whether consent is captured before they load. ### Sample text for your banner > We use analytics and marketing cookies on this site to understand traffic and improve our content. They load only if you accept. You can change your choice at any time. Cookies and trackers ## What Workday sets and contacts - Tracking method Functional cookies, with analytics and marketing cookies on public web properties - Server location United States, with European data centres available - Data transferred outside the EU Customer data may be processed in the United States unless an EU data centre is contracted; transfers rely on Standard Contractual Clauses. ### Cookies set (4) | Name | Type | Duration | Purpose | | ---------- | ---------- | -------- | ----------------------------------------------------------------------------------- | | JSESSIONID | Functional | Session | Maintains the authenticated user session within the application and website. | | wd-lb | Functional | Session | Load balancing cookie that routes requests to the correct server for stability. | | \_ga | Analytics | 2 years | Measures visits and usage on the public website to improve content and performance. | | \_gcl\_au | Marketing | 3 months | Supports advertising and conversion measurement on the public marketing website. | ### Third-party domains contacted (3) - `workday.com` - `myworkday.com` - `workdaycdn.com` Questions ## Frequently asked questions about Workday Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Workday set? On its public website Workday sets strictly necessary functional cookies for sessions and load balancing, plus analytics and marketing cookies. Inside the application, cookies are mainly functional and support authenticated sessions. The analytics and marketing cookies are the ones that require attention for consent. ### Is consent required to use Workday? Consent is required on the public website before analytics and marketing cookies load, since they are not strictly necessary. The HR and finance application does not rely on cookie consent; it is governed by the employment relationship and a processor contract. Strictly necessary functional cookies do not need consent. ### What is the legal basis for processing? For the application, the usual legal basis is contract under GDPR Art. 6(1)(b), with legitimate interests for some administrative functions. For website analytics and marketing cookies the basis is consent under Art. 6(1)(a) and ePrivacy Art. 5(3). The employer remains the controller for the HR data while Workday acts as processor. ### Does Workday transfer data to the United States? Yes, Workday is a United States company and may process customer data there unless an EU data centre is contracted. Such transfers rely on Standard Contractual Clauses with supplementary measures where appropriate. Organisations should confirm their contracted hosting region and document the transfer mechanism. ### Is a DPIA needed for Workday? A DPIA is often advisable because the application processes employee and financial data at scale and may include sensitive categories. The assessment should cover legal basis, access controls, retention, and transfers to the United States. The public website cookies should be assessed separately as a lower risk processing. ### How do we implement Workday compliantly? Sign a data processing agreement, confirm the hosting region, and keep records of processing for the application. Apply role based access, sensible retention, and audit logging to protect employee data. On the website, deploy a consent banner that blocks analytics and marketing cookies until the visitor opts in. ### Are there alternatives to Workday? Alternatives include other HCM and finance suites such as SAP SuccessFactors, Oracle Fusion, and various regional providers. Some offer EU based hosting that can simplify data transfer questions. The right choice depends on scale, integration needs, and your data residency requirements. ### How should we update our cookie policy? List each website cookie with its name, type, duration, and purpose, separating strictly necessary from analytics and marketing. State that analytics and marketing cookies load only after consent and that withdrawal is possible. Review the policy when Workday changes its site tooling or cookie set. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [JS.org](https://www.flowconsent.com/en/services/other/js-org) [JS.org is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. JS.org offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, JS.org empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/js-org) [Other](https://www.flowconsent.com/en/services/other/js-org) · ### [Breezy HR](https://www.flowconsent.com/en/services/other/breezy-hr) [Breezy HR is a human resources and recruitment platform that streamlines hiring, onboarding, and talent management processes. It provides applicant tracking, job board integration, employee management, and performance review tools. Breezy HR automates repetitive HR tasks, enabling teams to focus on strategic initiatives. With self-service portals, analytics dashboards, and compliance management, Breezy HR helps organizations attract, retain, and develop top talent efficiently.](https://www.flowconsent.com/en/services/other/breezy-hr) [Preferences](https://www.flowconsent.com/en/services/other/breezy-hr) · ### [MangezNotez](https://www.flowconsent.com/en/services/other/mangeznotez) [Mangeznotez is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mangeznotez supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mangeznotez ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/mangeznotez) [Preferences](https://www.flowconsent.com/en/services/other/mangeznotez) · ### [Infront](https://www.flowconsent.com/en/services/other/infront) [Infront is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Infront integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Infront helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/infront) [Other](https://www.flowconsent.com/en/services/other/infront) · ### [StatusCake](https://www.flowconsent.com/en/services/other/statuscake) [StatusCake is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. StatusCake offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, StatusCake empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/statuscake) [Other](https://www.flowconsent.com/en/services/other/statuscake) · ### [Crexi](https://www.flowconsent.com/en/services/other/crexi) [Crexi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Crexi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Crexi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/crexi) [Other](https://www.flowconsent.com/en/services/other/crexi) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)