Is ChatGPT GDPR compliant? DPA and EU data guide

The data protection officer asks about the processor contract, the IT lead asks where chats are stored, and a sales lead has already pasted three customer emails into ChatGPT. That is usually when someone searches "is ChatGPT GDPR compliant", and the honest answer splits into what OpenAI's contract covers and what stays with you.

Every fact below comes from a primary source checked on 4 November 2026, from OpenAI's contract to the GDPR and the European Data Protection Board. Nothing here is legal advice.

---

Is ChatGPT GDPR compliant? The short answer

ChatGPT fits a GDPR compliant setup on ChatGPT Business, ChatGPT Enterprise and the API, if your business does its half of the work.¹ The GDPR puts its duties on the controller, meaning the business that decides why and how personal data is processed, so a tool adds paperwork to your proof or leaves a gap.² OpenAI's part works like a hire firm that services and insures the car, while your business still drives it and pays any parking fine.

Business plans come with the processor contract, which means OpenAI handles your data on your instructions and does not train on it by default.¹³ Personal Free, Plus and Pro accounts run on OpenAI's own privacy policy with OpenAI Ireland as controller, so your business holds no contract that covers what staff paste in.⁴ Close those work accounts first.

What is OpenAI's DPA, and how do you sign it?

A DPA, short for Data Processing Addendum, is the contract Article 28 of the GDPR requires before a processor, meaning a supplier that handles personal data on your instructions, touches your data.² OpenAI's DPA covers ChatGPT Business, ChatGPT Enterprise and the API, and the current text, which took effect on 1 January 2026, replaced the version from February 2024.⁵¹ Customers in the European Economic Area (EEA) or Switzerland sign it with OpenAI Ireland Ltd, which keeps the contract inside the EU.⁵

Signing takes no separate step, because the DPA is part of the OpenAI Services Agreement, and clicking "I agree" or using the service accepts it.⁵ Lawyers who want a named copy use the Execute Data Processing Agreement form that the DPA page links to.⁵

Sub-processors, meaning the suppliers OpenAI itself passes data to, deserve a line in your records, since the list of 14 October 2026 includes moderators in the Philippines who review flagged Business content.⁶

Where is your data stored in ChatGPT Business and Enterprise?

ChatGPT Business: a storage region picked at checkout

ChatGPT Business lets the buyer pick a storage region during checkout, which decides where saved prompts and responses sit at rest, although OpenAI is still rolling the option out.⁷ The region covers storage only, not processing, and a copy of every prompt and response stays in the US for a limited time for abuse monitoring.⁷ Admins can view, export and delete members' chats, and deleted chats leave OpenAI's systems within 30 days unless the law or the protection of its services requires longer.¹

ChatGPT Enterprise: storage and inference in Europe

New ChatGPT Enterprise and Edu workspaces can store content at rest in Europe, meaning the EEA plus Switzerland, at no extra cost.⁸ Eligible customers add inference residency, meaning the model's work on that content also runs in Europe, while sign-in, routing and text extraction from uploaded files may still happen elsewhere.⁸ Enterprise also gives admins an audit log of conversations through the Compliance API, which Business lacks.¹⁹

Workspace name, billing details and logins can sit outside the region even with residency on, and data sent to a connected app follows that provider's terms.⁸ Our ChatGPT Enterprise guide for Europe shows when it pays off against Business.

ChatGPT Free and Plus: consumer terms

Training on personal Free and Plus accounts stays on until each user switches off Improve the model for everyone under Data controls, which leaves the choice with every employee.¹⁰ The only DPA OpenAI offers individuals covers data that a published ChatGPT Site collects from visitors, and it excludes the prompts and files in the chat itself.¹¹

The transfer to the US: SCCs, the TIA and the DPF list

Sending personal data outside the EU needs a tool from Chapter V of the GDPR, which runs from Article 44 to Article 49.² The simplest one for the US is the EU-US Data Privacy Framework, or DPF, meaning a Commission decision that covers only US companies that certify under it.¹² We searched the official DPF list on 4 November 2026 and found no OpenAI entry, while Microsoft Corporation showed as active.¹²

Standard Contractual Clauses, or SCCs, are the Commission's model contract for transfers under Article 46, which OpenAI Ireland uses with the US affiliates it passes data to.²⁵⁶

Clauses alone are not enough, because the European Data Protection Board, or EDPB, asks for a transfer impact assessment, or TIA, meaning a written check that US law does not undercut them.¹³ Articles 24 and 28 keep your business accountable for its choice of processor even though OpenAI Ireland sends the data out, so write the assessment anyway.² Our guide to how EU firms assess American AI tools walks through it.

What do European regulators say, and what must you do yourselves?

OpenAI has had a single EU establishment in Ireland since 15 February 2024, so the Irish Data Protection Commission now leads GDPR cases about ChatGPT.¹⁴¹⁵ Availability, languages and invoicing for European teams are covered in our guide to ChatGPT in Europe.

The Italian authority, the Garante, had announced a €15 million fine against OpenAI on 20 December 2024, when it closed an investigation opened in March 2023.¹⁵ It found that OpenAI had trained ChatGPT on users' data without a proper legal basis and had not reported a breach from March 2023.¹⁵ The Court of Rome upheld OpenAI's appeal in judgment 4153/2026, published on 18 March 2026, and the Garante has temporarily removed the decision from its website.¹⁵ Its training finding concerned the consumer service, which is the use a business plan switches off by default.³

The EDPB's ChatGPT taskforce report of 23 May 2024 adds two points worth copying into your prompt rule.¹⁴ First, the duty to comply cannot be pushed onto users through a clause that makes them responsible for their own chat inputs.¹⁴ Second, ChatGPT's answers may be biased or made up while readers tend to take them as fact, and the accuracy principle in Article 5 still applies.¹⁴² A person checks any answer about a named individual before it is used.

For a business on ChatGPT Business, the GDPR then asks for four documents of its own, each tied to one article:²

1. Legal basis under Article 6 for each kind of data that staff type in.
2. Processor contract under Article 28, which Business or Enterprise already gives you.
3. Record of processing under Article 30, with a line that names OpenAI Ireland and the transfer countries.
4. DPIA screening, short for data protection impact assessment, under Article 35 for processing that is likely to put people at high risk.

Take an illustrative case: a sales lead at a 30-person building supplier pastes a whole email thread, with names, phone numbers and a home address, into a personal Plus account. After the move to the company's Business workspace, the same person types "customer in construction, wants answers to three objections on price" and gets the same help. A person still decides what counts as personal data in each thread, because no model makes that call for you.

Checklist: ChatGPT and the GDPR in five steps

1. Move everyone who uses ChatGPT for work into a Business or Enterprise workspace that the company owns, after counting the personal Plus accounts in use.
2. Save a dated copy of the DPA, or run the Execute Data Processing Agreement form, and subscribe to sub-processor notices, since you get 30 days to object.⁵⁶
3. Write the transfer impact assessment for the US copy, which takes two pages for ordinary office use.
4. Set Europe as the storage region if checkout offers it, then decide which apps members may connect and who may share custom GPTs.³⁷
5. Hand staff a one-page prompt rule on what never goes into ChatGPT, which our AI policy template gives a home.

What does ChatGPT cost with the agreement in place?

The DPA costs nothing extra because it comes with the agreement, so the money goes on seats.⁵ Bought direct, a Standard seat costs $20 per user per month billed annually or $25 billed monthly, about €18 or €22, and Premium costs $100 or $125, about €88 or €110.⁹ Self-serve Business takes cards only, with no invoice or purchase order, which our guide to buying ChatGPT Business licences works through.¹⁶

satori-chatgpt costs €490 once for the setup, then €22 per user per month for a Standard licence or €110 for Premium, plus €14 per user per month for running the workspace. The setup covers roles, connectors, data controls and the storage region, and we help you write the rule for what may be typed in, at fixed prices that exclude VAT. EU business customers with a valid VAT number are invoiced without Swedish VAT under the reverse charge. Customers in Sweden pay Swedish VAT.

For ten Standard users that comes to €360 a month plus the one-time €490, against $250 a month, about €219, for ten monthly seats bought direct on one person's card.

When Claude fits better

satori. sells both while most of what we build runs on Claude, and on the GDPR the two come out closer than most buyers expect. Anthropic had no DPF entry either when we searched on 4 November 2026, and Claude Team stores commercial data in the US with no EU setting.¹²¹⁷ That puts ChatGPT Business ahead for a staff chat window that must keep content at rest in Europe.

Claude suits a developer team already on AWS or Google Cloud, since EU cross-region inference on Amazon Bedrock or the EU multi-region endpoint on Google Cloud keeps processing in the EU.¹⁸¹⁹ Anthropic's DPA also promises a breach notice within 48 hours, while OpenAI's says without undue delay, which matters when you plan around the 72-hour deadline in Article 33.²⁰⁵²

Teams that work through contracts and reports running to hundreds of pages usually land on satori-claude, and our Claude GDPR guide answers the same questions for Anthropic. A team that already works in ChatGPT with its files in Google Drive or SharePoint should pick Business with Europe as the storage region.

Summary and next step

ChatGPT can be used in line with the GDPR when three things are in place: the right plan, the right contract and a written prompt rule. Talk to us on a free 30-minute call if you want a second reader on the setup before the workspace opens.

Open ChatGPT on your work laptop, go to Settings and read which plan the account runs on, because Free, Go, Plus or Pro at work marks step one of the checklist. Then list the colleagues you have seen using ChatGPT for work, and within twenty minutes you hold a list of names and one number that sizes the workspace you need.

---

Sources

Footnotes

1. OpenAI (2026). Enterprise privacy at OpenAI, updated 8 January 2026. https://openai.com/enterprise-privacy/ ↩ ↩² ↩³ ↩⁴ ↩⁵

2. European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5, 6, 24, 28, 30, 33, 35 and 44 to 49. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

3. OpenAI (2026). Business data privacy, security, and compliance, checked 4 November 2026. https://openai.com/business-data/ ↩ ↩² ↩³

4. OpenAI (2026). EU Privacy Policy, updated 24 August 2026. https://openai.com/policies/eu-privacy-policy/ ↩

5. OpenAI (2025). OpenAI Data Processing Addendum, updated 1 December 2025, effective 1 January 2026. https://openai.com/policies/data-processing-addendum/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

6. OpenAI (2026). OpenAI Sub-processor list, last updated 14 October 2026. https://platform.openai.com/subprocessors ↩ ↩² ↩³

7. OpenAI Help Center (2026). Where your ChatGPT Business content is stored. https://help.openai.com/en/articles/20001418-where-your-chatgpt-business-content-is-stored ↩ ↩² ↩³

8. OpenAI Help Center (2026). Data residency and inference residency for ChatGPT. https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt ↩ ↩² ↩³

9. OpenAI (2026). ChatGPT Business and Enterprise pricing, plan comparison checked 4 November 2026. https://openai.com/business/pricing/ ↩ ↩²

10. OpenAI Help Center (2026). Data controls in ChatGPT, checked 4 November 2026. https://help.openai.com/en/articles/7730893-data-controls-faq ↩

11. OpenAI (2026). ChatGPT Sites Data Processing Addendum, published 9 July 2026. https://openai.com/policies/chatgpt-sites-data-processing-addendum/ ↩

12. International Trade Administration, US Department of Commerce (2026). Data Privacy Framework List, searched for OpenAI, Anthropic and Microsoft on 4 November 2026. https://www.dataprivacyframework.gov/list ↩ ↩² ↩³

13. European Data Protection Board (2021). Recommendations 01/2020 on measures that supplement transfer tools, version 2.0. https://www.edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf ↩

14. European Data Protection Board (2024). Report of the work undertaken by the ChatGPT Taskforce, 23 May 2024. https://www.edpb.europa.eu/system/files/2024-05/edpb_20240523_report_chatgpt_taskforce_en.pdf ↩ ↩² ↩³ ↩⁴

15. Garante per la protezione dei dati personali (2024). ChatGPT, the Italian Data Protection Authority closes the preliminary investigation, press release of 20 December 2024 with the note on judgment 4153/2026 of the Court of Rome. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432 ↩ ↩² ↩³ ↩⁴

16. OpenAI Help Center (2026). Managing billing and seats in ChatGPT Business. https://help.openai.com/en/articles/8792536-managing-billing-and-seats-in-chatgpt-business ↩

17. Anthropic (2026). Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers ↩

18. Amazon Web Services (2026). Route model inference requests across AWS Regions with cross-Region inference. https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html ↩

19. Google Cloud (2026). Data residency. Gemini Enterprise Agent Platform documentation. https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency ↩

20. Anthropic (2025). Data Processing Addendum, effective 24 February 2025. https://www.anthropic.com/legal/data-processing-addendum ↩