ChatGPT and the GDPR: Which Plan a Business Can Use

OpenAI signs a GDPR data processing agreement for ChatGPT Business, ChatGPT Enterprise and its API, and for none of its individual plans. On Free, Go, Plus and Pro, OpenAI Ireland Limited is the controller of whatever staff type, and content is used for training unless each user opts out. That split, checked against OpenAI's own pages on 12 October 2026, decides whether a European company can put customer data into ChatGPT at all. This page sets out each plan's terms, what European data protection authorities have said, and what to set up before staff use it with client information.

ChatGPT is not one product under the GDPR. It is seven ways to buy it, with two different legal structures, and the plan an employee happens to use decides which structure applies.

This page compares those plans as OpenAI's own pages described them on 12 October 2026, then sets out what the European Data Protection Board, the Italian and German authorities and Hamburg's data protection commissioner have said.

This is not legal advice. Every claim carries its source and date, listed in the notes, so you or your data protection officer can check it.

Is ChatGPT GDPR compliant for business use?

As of 12 October 2026, ChatGPT can be used within the GDPR on three of its offerings and not on the other four. OpenAI signs a data processing addendum for ChatGPT Business, ChatGPT Enterprise and the API, acts as the company's processor, and does not train on that business data by default.[¹][⁴] On Free, Go, Plus and Pro, OpenAI Ireland Limited is the controller of what the user types, and content is used to train OpenAI's models unless that user opts out.[²][³]

The difference is not a setting. It is who carries responsibility for the data once it leaves your company.

With a processing agreement, OpenAI handles your customers' data on your instructions, and you remain the controller. Without one, you have handed the data to a separate company that decides for itself how to use it within its own privacy policy.

That second situation is very hard to justify for customer data. Hamburg's data protection commissioner put it plainly in a 2023 checklist: where the provider may process inputs for its own purposes, "It will generally not be possible to find a legal basis for this."[⁹]

Which ChatGPT plans come with a data processing agreement?

Three ChatGPT offerings come with OpenAI's data processing addendum, effective 1 January 2026: Business, Enterprise and the API.[¹][⁴] The table below sets out each plan's position as OpenAI's pricing page, enterprise privacy page and Europe privacy policy stated it on 12 October 2026.

The training column needs one qualification. On business plans, OpenAI says it may train on shared data where a customer "explicitly opted in", for example through feedback.[¹] Our comparison of which AI providers train on business data shows the same feedback exception across several providers.

Retention differs too. On Enterprise, workspace admins "control how long your data is retained", and deleted conversations are removed "within 30 days, unless we are legally required to retain them".[¹] On Business, admins can view, export and delete conversations, and deleted or unsaved ones are removed within 30 days unless longer retention is required by law or "reasonably necessary to protect our services".[¹]

Business has one detail worth reading twice. OpenAI's access to stored Business conversations is limited to authorised employees and "specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse".[¹] That is a disclosed, contracted review path, not a hidden one. Your records of processing should still mention it.

What changes when staff use their own ChatGPT accounts?

A personal ChatGPT account turns OpenAI from a possible processor into a second controller of your customers' data. OpenAI's Europe privacy policy, updated 24 August 2026, names OpenAI Ireland Limited as "the controller" for users in the EEA and Switzerland, and says it may use content "to train the models that power ChatGPT".[³]

For Free and Go users, the same policy lists a further purpose: "to personalise the ads you see on our Services".[³] An employee who pastes a client email into a free account is feeding a service that runs advertising.

The European Data Protection Board's ChatGPT taskforce addressed the employer's position directly. Its May 2024 report says responsibility for GDPR compliance should not be shifted onto users "by placing a clause in the Terms and Conditions that data subjects are responsible for their chat inputs", and that it "should be assumed that individuals will sooner or later input personal data".[⁶]

German and Hamburg guidance draw the practical conclusion. The DSK, the conference of Germany's data protection authorities, wrote in May 2024 that employers should provide devices and accounts for professional use of AI.[⁸] Hamburg's checklist says employees "should not create an account on their own using private data".[⁹]

Where does OpenAI process business data?

OpenAI processes most ChatGPT data in the United States, and for European customers that rests on standard contractual clauses rather than the EU–US Data Privacy Framework. OpenAI's processing addendum routes EEA customer data through OpenAI Ireland Limited and allows onward transfers "on the basis of agreements containing SCCs … or an adequacy decision".[⁴] On 12 October 2026, a search of the US government's Data Privacy Framework list returned no entry for OpenAI.[¹⁰]

Data residency is the exception, and it is narrow. OpenAI introduced European residency on 5 February 2025 for ChatGPT Enterprise, ChatGPT Edu and the API, so that "new ChatGPT Enterprise and Edu customers can choose to have customer content stored at rest in Europe".[⁵] The pricing page confirms the split: data residency is listed for Enterprise and not for Business.[²]

Three conditions limit it further:

• Only at set-up. OpenAI offers residency to new Enterprise and Edu workspaces, and states that existing API projects "cannot be updated" to European residency.[⁵] Plan the region before the workspace exists.
• Storage first, processing later. The 2025 announcement covered storage at rest. On 16 January 2026, OpenAI added "in-region GPU inference" for eligible Enterprise, Edu and Healthcare customers.[⁵]
• The API costs more in Europe. For the API, our page on whether AI data residency keeps data in Europe records OpenAI's 10% uplift for EU-resident processing on newer models.

For most small companies, that makes the realistic choice Business, with data stored in the United States under a processing agreement and standard contractual clauses. Enterprise residency exists but is sold through OpenAI's sales team, with no published price.[²]

What do European data protection authorities say about ChatGPT?

Four European authorities have published positions that bear on a company's use of ChatGPT, between November 2023 and March 2026. None of them bans business use. Each narrows how it can be done.

The Italian case is a good example of why dates matter. Many pages still cite the €15 million fine as settled. The Garante's own page now records that a Rome court upheld OpenAI's challenge in March 2026.[⁷] What that means for the fine on appeal, the Garante's page does not say.

The EDPB report matters more for a business than the Italian fine. It treats inaccurate output about people as a GDPR accuracy problem, not a quality issue. If ChatGPT invents something about a named customer and staff send it on, a warning label on the product does not settle that.

What does a processing agreement not cover?

A processing agreement makes OpenAI your processor under Article 28 GDPR. It leaves every controller duty with your company: the legal basis, accuracy, transparency to customers, a DPIA where needed and your records of processing. The DSK's May 2024 guidance assumes exactly that split, with the provider as processor and the company as controller.[⁸]

Four duties stay with you:

1. A legal basis for each purpose. Summarising a customer's email for a reply has a different basis from analysing a customer list. The agreement covers neither.
2. Accuracy. The EDPB says outputs "may be biased or made up" and are "likely to be taken as factually accurate".[⁶] Someone checks before anything about a person leaves the company.
3. A DPIA where the risk is high. The DSK expects one often ("vielfach") for AI applications.[⁸] Germany and the Netherlands both name employee monitoring on their lists; our comparison of national DPIA lists shows which processing always needs one.
4. Records and information. ChatGPT Business belongs in your record of processing activities, and your privacy notice should say that an AI service processes customer data.

The obligations for an AI agent acting in your systems go further than for a chat tool, because an agent also sends, writes and stores.

How do you set ChatGPT up before staff use it with client data?

Five steps, in this order, cover what OpenAI's processing addendum of 1 January 2026 and the DSK's May 2024 guidance require before customer data goes into ChatGPT. The order matters: the plan and the agreement come before any rule for staff, because a rule cannot fix a plan without a processing agreement.

Our one-page checklist covers the same five steps with the check dates: Download the ChatGPT client-data checklist (PDF).

When is ChatGPT the wrong tool for client data?

ChatGPT Business is a chat tool with a processing agreement. It is the wrong tool when the work needs data to stay in one country by default, needs strict separation between clients, or needs an approval step before anything leaves the company. The DSK's guidance of 6 May 2024 states the preference directly: technically closed systems are "vorzugswürdig", preferable, from a data protection perspective.[⁸]

Three situations point beyond a chat workspace:

• Client separation. An accountancy or agency handling several clients' files may need each client's data kept apart, with access logged per client. A shared chat workspace is not built for that.
• Actions, not answers. Once the AI should file, send or update something, the question becomes who approves the action. Our guide to approval workflows in an AI agent system covers where that gate sits.
• Region and model choice. A custom agent can run on a model and region you choose, including European hosting, instead of the defaults of one plan.

For a team drafting emails and summarising documents with a signed agreement and a clear rule, ChatGPT Business is often enough. When the work touches several clients' files and ends in an action, it usually is not.

Frequently asked questions

Is ChatGPT GDPR compliant for business use? It depends on the plan. For ChatGPT Business, ChatGPT Enterprise and the API, OpenAI signs a data processing agreement, acts as the company's processor and does not train on business data by default. For Free, Go, Plus and Pro, OpenAI Ireland is the controller of what users type and uses content for training unless the user opts out, so a company cannot sign a processing agreement for those plans. These terms were checked against OpenAI's pages on 12 October 2026.

Does OpenAI sign a data processing agreement (AVV) for ChatGPT Plus? No. OpenAI offers its data processing addendum for ChatGPT Business, ChatGPT Enterprise and the API Platform. ChatGPT Plus is an individual plan governed by OpenAI's consumer terms, under which OpenAI Ireland Limited is the controller for users in the EEA and Switzerland.

Can ChatGPT keep business data in the EU? Only on ChatGPT Enterprise and Edu, and only for workspaces created with European data residency. OpenAI's pricing page lists data residency for Enterprise but not for Business, and OpenAI offers it when a workspace is created. Data outside residency is processed in the United States, with transfers based on standard contractual clauses.

Do I need a DPIA before staff use ChatGPT with customer data? Often, yes. Germany's data protection conference wrote in May 2024 that a data protection impact assessment under Article 35 GDPR will often be required when AI applications process personal data. Whether yours does depends on the data, the purpose and your authority's published list of processing that always requires one.

Notes

1. OpenAI, Enterprise privacy at OpenAI, updated January 8, 2026, accessed October 12, 2026. Used for the products covered, the training default, the DPA offer for Business, Enterprise and the API, retention rules per plan, and access to Business conversations.
2. OpenAI, ChatGPT pricing, accessed October 12, 2026. Used for the plan list, the training rows, Business pricing, ads on Go, and data residency for Enterprise but not Business.
3. OpenAI, Europe privacy policy, updated August 24, 2026, accessed October 12, 2026. Used for OpenAI Ireland as controller, training use of content, ads for Free and Go users, deletion within 30 days, and transfers to the United States.
4. OpenAI, Data Processing Addendum, updated December 1, 2025, effective January 1, 2026, accessed October 12, 2026. Used for OpenAI's processor role, OpenAI Ireland as the EEA contracting party, sub-processors, audits and transfer mechanisms.
5. OpenAI, Introducing data residency in Europe, February 5, 2025, with updates to January 16, 2026, accessed October 12, 2026. Used for residency on new Enterprise, Edu and API projects and in-region inference.
6. European Data Protection Board, Report of the work undertaken by the ChatGPT Taskforce, May 23, 2024, paragraphs 7, 24, 25, 30 and 31, accessed October 12, 2026.
7. Garante per la protezione dei dati personali, press release on the ChatGPT investigation, December 20, 2024, accessed October 12, 2026. Used for the €15 million fine, decision 755 of November 2, 2024, and the note on Rome Tribunal judgment 4153/2026 of March 18, 2026.
8. Datenschutzkonferenz, Orientierungshilfe Künstliche Intelligenz und Datenschutz, May 6, 2024, version 1.0, paragraphs 20, 24, 32, 39 and 41, accessed October 12, 2026.
9. Hamburg Commissioner for Data Protection and Freedom of Information, Checklist for the use of LLM-based chatbots, November 13, 2023, items 1, 3, 5, 8 and 10, accessed October 12, 2026.
10. US Department of Commerce, Data Privacy Framework List, searched October 12, 2026. A search for OpenAI returned no results; Microsoft Corporation was listed as active.