Is ChatGPT GDPR compliant? Plans, DPA and what is left to do

Is ChatGPT GDPR compliant?

There is no yes or no for the product as a whole. The GDPR regulates what a controller does with personal data, so the question is whether your use of ChatGPT meets your obligations: which plan, what data, which contract, which legal basis. The consumer plans and the business plans differ sharply on training and contracts, so every assessment starts with the plan your staff actually use. For the overall rollout, see use AI at work without leaking data; this page is about ChatGPT and the contract facts.

What does each ChatGPT plan offer?

The table reports what OpenAI itself writes. Where OpenAI says nothing about a plan, the cell says “not named”. That does not mean the feature does not exist; it means you would need to get it confirmed in writing.

Some additions. On the consumer plans, a thumbs up or down can lead to the entire associated conversation being used for training, and switching off data sharing does not delete saved chats. Temporary Chats are not used for training but may be kept for up to 30 days for safety purposes^[3]. On the API, abuse-monitoring logs are kept for up to 30 days by default, and zero data retention needs approval^[4]. Residency covers content stored at rest, not automatically every processing step: regional GPU processing is offered as an additional option^[1].

Is OpenAI a processor, and what does that mean for consumer plans?

For Business, Enterprise and the API, OpenAI offers a DPA, which makes the Article 28 GDPR set-up possible: a contract under which the provider processes personal data only on the controller’s documented instructions^[7]. What counts is the agreement you actually hold for your plan.

For the consumer plans OpenAI names no DPA, and that matters in practice. The Baden-Württemberg data protection authority points out that if a provider uses inputs for its own purposes, such as improving its models, that goes beyond processing on behalf of the customer^[6]. That is one authority’s view, not settled law. A company that enters personal data into a consumer plan therefore risks working without a contract basis and with training possible. The joint guidance of the German authorities (DSK) calls applications that do not train on inputs preferable and says a legal basis is needed for training use where there is no opt-out^[5]. For the contract itself, see the comparison of ChatGPT, Copilot, Claude and Gemini for how the other providers handle the same questions.

The European Data Protection Board has also addressed AI models in its Opinion 28/2024. It says that whether an AI model is anonymous must be assessed case by case, and it sets out a three-step test for legitimate interest as a legal basis for developing and deploying models^[15]. That opinion is mainly about providers training models, not about your prompts, but it shows the direction authorities take.

What is left to do after the DPA?

A DPA is necessary but not sufficient. At least seven tasks remain with you.

• Legal basis. The Baden-Württemberg authority describes a “double door” model: provider and user each need their own legal basis, and Article 6(1)(b) GDPR does not, as a rule, cover third parties’ data typed into prompts^[6]. In practice many organisations rely on legitimate interest with a documented balancing test. In Germany, for example, the general employee-data clause in § 26 BDSG is doubtful as a sole basis since the CJEU ruled on a comparable Hessian provision in case C-34/21; the Hessian authority names Article 6(1)(b), (c) and (f) as possible bases instead^[16]. The point is contested.
• Information for the people concerned. Where data does not come from the person, Article 14 GDPR requires you to name recipients or categories of recipients, at the latest within a month or on first disclosure to another recipient^[8]. Check your privacy notices.
• Transfers. See the next section.
• Records and impact assessment. Add the tool to your record of processing activities (Article 30)^[9] and document a threshold check for a data protection impact assessment (Article 35)^[10]. The DSK considers an impact assessment often necessary for AI use^[5].
• Employee representatives. Where a works council or similar body exists, involve it early; in Germany, for example, co-determination can apply to tools suited to monitoring behaviour or performance (§ 87(1) no. 6 BetrVG)^[18].
• Professional secrecy. A DPA does not lift professional confidentiality duties, which in some countries are stricter than the GDPR. In Germany, for example, the tax advisers’ chamber regards entering client data into public AI services without sufficient secrecy arrangements as a breach of confidentiality^[19]. Lawyers, tax advisers, doctors and similar professions should check their own rules first.
• Data minimisation. Even on a business plan, less is better: only data necessary for the purpose may be processed (Article 5(1)(c))^[14]. A prompt that improves a template does not need the customer’s name. No automatic method finds every detail, and a human check before sending stays necessary. How to replace identifiers beforehand is covered in anonymise data before ChatGPT.

What about transfers to the United States?

A transfer to a third country needs a basis from Chapter V of the GDPR, so that the level of protection is not undermined^[17]. For the US, that can be the Commission’s adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). On 3 September 2025 the General Court dismissed Philippe Latombe’s action against it in its entirety^[11]. An appeal, case C-703/25 P, is pending before the Court of Justice, and the decision remains in force. In your records, write “currently valid, appeal pending” and set a review date.

The framework only helps if the provider is certified under it. We did not check OpenAI’s certification status; ask, or have the DPA state which transfer mechanism applies, for example standard contractual clauses. For security, OpenAI names SOC 2 Type 2, ISO/IEC 27001, 27017, 27018 and 27701, plus AES-256 encryption at rest and TLS 1.2 or higher in transit^[1]. Those are the provider’s own statements, and you can ask for evidence as part of your selection.

Where does ChatGPT data go, and how much of that can you control?

Once a prompt or file has been sent, you cannot observe where OpenAI processes, copies or stores it. What you have is OpenAI’s documentation and, on business plans, a contract. Both are real, but they are commitments you read, not something you can measure, and the documentation names its own limits. Data residency is storage at rest, offered to eligible Enterprise, Edu, Healthcare and API customers; ChatGPT Business is not listed, and regional GPU processing is a separate option^[1]. On the API, abuse-monitoring logs are kept for up to 30 days by default^[4]. On Free, Plus and Pro, data sharing for training is on by default, and a thumbs rating can put the whole conversation into training^[3]. OpenAI may also engage further processors, so you deal with a chain of companies, not one^[7].

None of this shows that OpenAI breaks its promises; it shows where you can no longer check them. And it cannot be undone: deleting a chat or switching training off acts on the future, and OpenAI states that turning data sharing off does not delete saved chats^[3]. The one lever you hold with your own means is what leaves your device. Sending less and leaving out identifying details is data minimisation under Article 5(1)(c)^[14]. The wider picture, across providers, is in where your data goes when you use ChatGPT, Copilot, Claude or Gemini.

Have regulators acted against OpenAI or against employers?

We know of no fine or reprimand from a supervisory authority against a company for its employees’ use of ChatGPT; authorities have so far published guidance, such as the German DSK paper^[5] and the Hamburg checklist^[12]. As for the provider, Italy’s Garante fined OpenAI EUR 15 million. The Court of Rome annulled the decision on 18 March 2026, according to reports solely on competence grounds because Ireland is the lead authority, without examining the substance^[13]. That is neither a confirmation of the fine nor a clearance on the merits.

Which questions should you put to the vendor?

Get the answers in writing and file them with the DPA. For staff, the practical rules are in 12 rules for using AI at work; the DSK also advises employers to provide work accounts so staff need not use private ones^[5], and a shared policy is easier to enforce when you start from an AI acceptable use policy template.

Checklist for EU teams using ChatGPT

Next practical step: decide which data types may go into ChatGPT before you hand out accounts. Anonymise data before ChatGPT explains how to mask what remains, and the glossary defines the terms used here.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.