OpenAI compliance: GDPR, AI Act, DPA, training, transfers

TL;DR. API and ChatGPT business products: contractually no training by default since 2023-03-01. ChatGPT Plus consumer: trains on conversations unless the user opts out - the dominant unmanaged risk for any organisation with knowledge workers. Default API processing is not EU-resident; EU residency is available to approved customers who also hold abuse-monitoring controls, and the UK region stores data without processing it there. ZDR is approval-gated through sales. OpenAI maintains an ISO/IEC 42001:2023 AI management system.

DPO action: map staff use of consumer ChatGPT, configure EU residency for any EU-subject processing, apply for ZDR if data sensitivity warrants, and sign a BAA before any PHI. A BAA is available on the API, on sales-managed ChatGPT Enterprise and Edu accounts, on ChatGPT for Healthcare and, for individual US clinicians, on ChatGPT for Clinicians, but not on ChatGPT Business (formerly ChatGPT Team).

Primary-source evidence. For the ChatGPT Business plan specifically, the ChatGPT Business Data Protection File records what OpenAI's own Business Terms, DPA, enterprise-privacy FAQ and privacy policy say, every answer a dated verbatim quote, with the documented gaps flagged. This profile is the analysis; that File is the receipts.

What the tool does

OpenAI runs ChatGPT (consumer and business products) and the API behind it. Most enterprise buyers will be looking at one of three things: the API (for building your own apps), ChatGPT Business or ChatGPT Enterprise (for staff use), or ChatGPT Edu (for education). The terms, training defaults and data residency position differ for each, so an answer for one cannot be assumed to apply to another.

Data processed

You will typically pass through some or all of:

• The text the user types (which can include any personal data your staff or product feeds in)
• Document content (if you upload files for analysis)
• Voice input (Whisper / Realtime API)
• Image content (GPT-4o vision)
• Embeddings of customer or proprietary data (RAG patterns)

Special-category likelihood: High if your use case touches health, legal, HR, or any sector where staff might paste sensitive content. Article 9 (UK GDPR) processing is a real risk and most buyers underestimate how often it happens in practice. A DPIA is rarely optional.

Default geographic processing: OpenAI's pages do not state where a project without data residency is processed. EU residency is not the default and has to be set up for each project, as described below.

DPA availability

OpenAI's Data Processing Addendum, updated 1 December 2025 and effective 1 January 2026, "supplements, and is incorporated into, the OpenAI Services Agreement", which covers the API and the ChatGPT business products. Section 5.3 of the Services Agreement provides that "If Customer uses the Services to process Personal Data, OpenAI and Customer will comply with the DPA, which is incorporated by this reference into the Agreement." No separate signature is needed, although the DPA page also offers a link for customers who want to execute a copy.

• Contracting entity: OpenAI Ireland Ltd. for customers in the EEA or Switzerland, and OpenAI OpCo, LLC for customers elsewhere, including the UK
• Governing law: the laws of Ireland for customers in the EEA, Switzerland or the UK, and California law for other customers
• The earlier Business Terms URL now redirects to the Services Agreement
• ChatGPT Edu is handled differently: OpenAI's enterprise privacy page states, "For ChatGPT Edu and for Teachers, we process your data pursuant to our Student Data Privacy Agreement"

If a buyer is using ChatGPT free/Plus consumer tier, the consumer terms apply, which are not equivalent to a DPA - this is an extremely common mistake in SME deployments.

Subprocessor list

OpenAI's DPA defines the Sub-Processor List as the list at https://platform.openai.com/subprocessors. That address could not be captured on 15 October 2026, so this profile relies on the list OpenAI publishes at https://openai.com/policies/sub-processor-list/, last updated on 14 October 2026. For the API, the cloud infrastructure entries are Microsoft, CoreWeave, Oracle Cloud Infrastructure, Google Cloud Platform, Amazon Web Services and Cerebras, alongside Cloudflare as content delivery network (and, for the ChatGPT business products, web hosting of ChatGPT Sites), and the list also names support, data and moderation providers. The identity and infrastructure-management providers, WorkOS and Merge, are listed for ChatGPT Enterprise, Edu and Business only, not for the API, and apply at the customer's election. Snowflake and Cinder are used for the API "Except where Zero Data Retention (ZDR) is used".

Under the DPA, OpenAI notifies changes by blog post, in the service, or by email to customers who subscribe, and a customer "may object to the use of such additional Sub-processor within 30 days of receiving notice of the change". If the objection is not resolved within 30 days, either party may terminate the affected services.

Training-on-customer-data position

API and business products: not used for training by default. OpenAI states (verbatim from openai.com/business-data/):

"By default, we do not use data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu, ChatGPT for Healthcare, ChatGPT for Teachers, or our API platform — including inputs or outputs — for training or improving our models."

This default has applied to API customers since 2023-03-01.

Consumer ChatGPT (free / Plus): conversations may be used to improve models unless the user opts out via settings. Most enterprises have staff using ChatGPT Plus on personal accounts - assume this is happening unless you've actively prevented it.

Default abuse monitoring retention: "By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm." Eligible customers can apply through OpenAI's sales team for Modified Abuse Monitoring or Zero Data Retention (ZDR), both of which are subject to prior approval. Each keeps customer content out of the abuse-monitoring logs, and ZDR also forces the store parameter to false. Neither stops application state from being stored on endpoints OpenAI lists as not eligible, which include Assistants, threads, vector stores, files, batches, fine-tuning, evals and conversations. Separately, "the Responses API has a 30 day Application State retention period by default", and Assistants objects that are not deleted are "retained indefinitely". OpenAI's deprecations page states that developers were notified on 26 August 2025 of the Assistants API's "deprecation and removal from the API one year later, on August 26, 2026", but its data-controls page, read on 15 October 2026, still lists the Assistants endpoints and their retention.

The no-training default is well established for the paid API and business tiers, although the 30-day abuse-monitoring window and the application state kept by some endpoints are retention periods that a DPIA needs to record. - My read

EU / UK transfer position

The DPA treats EEA and Swiss data differently from UK data. For EEA and Swiss data, the customer instructs OpenAI Ireland Limited to process it. OpenAI Ireland's onward transfers outside the EEA or Switzerland run "on the basis of agreements containing SCCs that ensure appropriate safeguards for the protection of Customer Data are in place or an adequacy decision issued by the European Commission under Article 45 GDPR". The DPA does not enter into SCCs between the customer and OpenAI for that data, and it contains no Swiss addendum.

For UK data, the customer instructs OpenAI OpCo, LLC to process it under "the SCCs as amended by the UK Addendum, which are deemed entered into". Module Two applies where the customer is a controller and Module Three where it is a processor. These clauses are governed by the law of England and Wales, and the supervisory authority is the UK regulator, now the Information Commission.

OpenAI holds no Data Privacy Framework certification. The official participant registry at dataprivacyframework.gov was searched again on 15 October 2026, active list and inactive list, with a control query that returned Microsoft, and returned nothing for OpenAI. The alphabetical enumeration was checked too, not only the search box (98 active and 102 inactive organisations file under O, and OpenAI is not among them). Its own privacy policy carries no mention of the framework either. Annex I of the adequacy decision would require that disclosure of a participant.

A record of processing activities that names the DPF against OpenAI is therefore inaccurate. For UK data the transfer rests on the SCCs as amended by the UK Addendum, and for EEA and Swiss data on OpenAI Ireland's onward-transfer arrangements, so a transfer impact assessment is required.

API data residency. Data residency is available to eligible customers, and OpenAI asks you to contact its sales team to confirm eligibility. Its documentation states: "To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment." Residency endpoints carry a 10% uplift for eligible models released on or after 5 March 2026. You set residency for each new project, or for an individual request through the regional domain.

The Europe region (EEA and Switzerland, eu.api.openai.com) offers regional storage and regional processing. The United Kingdom region (gb.api.openai.com) offers regional storage only. Where a region does not support regional processing, OpenAI "may also process and temporarily store Customer Content outside of the Region to deliver the services."

Residency does not apply to system data such as billing information and structured output schemas, or to products offered by third parties through the service. Files and vector stores are stored in Europe without regional processing. Default API processing is not EU-resident, and buyers often miss this.

Security documentation

OpenAI's security and privacy page and its product compliance status page (version 1.1, updated 4 August 2026) state:

• SOC 2 Type 2: "OpenAI has undergone an independent SOC 2 Type 2 examination of controls relevant to Security, Availability, Confidentiality, and Privacy for its API and ChatGPT business product services."
• ISO/IEC 27001:2022 and ISO/IEC 27701:2019: certifications for "the information security and privacy management systems supporting the OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services". The product compliance status page ticks the API Platform for SOC 2 Type 2, ISO/IEC 27701:2019 and ISO/IEC 27001:2022.
• ISO/IEC 27017 and 27018: the security page names them in a heading ("ISO 27001, 27017, 27018, and 27701"), but the certification sentence beneath it names only ISO/IEC 27001:2022 and ISO/IEC 27701:2019, and the product compliance status page does not list them. OpenAI's trust portal (read 15 October 2026) lists ISO/IEC 27017:2015 and ISO/IEC 27018:2019 and states "Our products are also ISO 27001, 27017, 27018, and 27701 certified." Its announcement of the ISO/IEC 27001 certificate explains that "Control implementation also conforms to additional control sets of ISO/IEC 27017:2015 and ISO/IEC 27018:2019", so the two are covered through the scope of that certificate.
• ISO/IEC 42001:2023: "OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI's consumer and business AI products and models in its role as an AI producer and AI provider." The security page does not describe it as certified. The trust portal, read on 15 October 2026, lists ISO/IEC 42001:2023 among its compliance items.
• CSA STAR Level 1 for the ChatGPT business products and the API Platform.
• PCI DSS: limited to "the components of ChatGPT that support delegated payment processing", so it does not cover the API.
• FedRAMP: listed separately for the OpenAI API for US government.

HIPAA & BAA position

US healthcare buyers ask this first, so to be direct: OpenAI will sign a HIPAA Business Associate Agreement (BAA), and it covers more surfaces than buyers expect.

• OpenAI API: an enterprise agreement is not required. An organisation admin accepts OpenAI's standard BAA in the API Platform settings, and "Self-serve enrollment requires an established history of API usage." An organisation that is not yet eligible can try again later or contact baa@openai.com. Accept the BAA before any PHI is sent.
• ChatGPT Enterprise and ChatGPT Edu: a BAA is available for sales-managed accounts through OpenAI's sales team.
• ChatGPT for Healthcare: OpenAI's healthcare-specific product, launched January 2026, is built for this and is BAA-covered.
• ChatGPT for Clinicians: free for verified clinicians in the United States, and an eligible individual clinician can sign a BAA for their own workspace in the product (Settings > Agreements). A BAA covering several users requires ChatGPT for Healthcare.
• Not eligible: OpenAI states "We do not offer a BAA for ChatGPT Business." (ChatGPT Business was called ChatGPT Team until 29 August 2025.) The consumer plans (Free, Go, Plus and Pro) are not among OpenAI's BAA routes either. Staff pasting PHI into a personal ChatGPT Plus account is the same shadow-AI risk flagged above, now with HIPAA exposure on top.

Azure OpenAI is the other route US healthcare buyers take. The same OpenAI models run on Microsoft Azure as a HIPAA-eligible service, and Microsoft makes its BAA available by default, with no separate BAA to sign, to all customers who are covered entities or business associates under HIPAA. The BAA is part of the Microsoft Products and Services Data Protection Addendum (the May 2026 DPA), which Microsoft's HIPAA offering page still calls by its former name, the Microsoft Online Services Data Protection Addendum. Before sending PHI to a particular model or modality, confirm that it is within the services Microsoft lists as covered.

The BAA is the contractual piece. HIPAA's Security Rule (risk analysis, minimum-necessary, workforce training, audit controls, breach notification) still falls on the covered entity. See HIPAA for AI tools for the full BAA-and-Security-Rule walkthrough across vendors.

AI Act role + risk classification

• Role: OpenAI is a provider of general-purpose AI models (Article 51-55 GPAI obligations apply to OpenAI as the model maker) and the provider of ChatGPT as an AI system.
• Your role as a buyer: you are a deployer when your staff use ChatGPT under your authority (Article 3(4)). If you build your own AI system on the API and place it on the market or put it into service under your own name, you are the provider of that system (Article 3(3)) and a downstream provider, which the Act defines as "a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided by themselves and vertically integrated or provided by another entity based on contractual relations" (Article 3(68)). Your obligations differ from OpenAI's in either role.
• Risk tier for typical SME use cases: most chatbot, summarisation, and document-processing uses fall in limited risk (transparency obligations) or minimal risk. High-risk (Annex III) is triggered if the use case touches employment decisions, creditworthiness, education access, or other Annex III categories. From 2 December 2027 (a fixed date set by Article 113 as amended by Regulation (EU) 2026/1744), a deployer of a high-risk Annex III system carries the obligations in Article 26, which include using the system in line with its instructions for use, assigning human oversight, monitoring its operation, keeping the logs under its control for at least six months and, as an employer, informing workers' representatives and affected workers before use at work. An Annex III system is not high-risk where the Article 6(3) exception applies, but a system that "performs profiling of natural persons" is always high-risk.
• When a buyer becomes the provider: under Article 25(1)(c), a deployer is treated as "a provider of a high-risk AI system" if it modifies the intended purpose of an AI system, "including a general-purpose AI system", that has not been classified as high-risk, so that it becomes high-risk under Article 6. A buyer that puts ChatGPT or the API to an Annex III use should assess whether it has become the provider. If it has, conformity assessment and registration in the EU database are its duties as provider (Article 16(f) and (i)). Article 25 applies to Annex III systems from 2 December 2027.
• Fundamental rights impact assessment (FRIA): Article 27(1) requires one only from "deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III", which cover creditworthiness and credit scoring of natural persons, and risk assessment and pricing for life and health insurance. Systems used in critical infrastructure (Annex III, point 2) are excluded. Deployers that are public authorities must also register their use in the EU database (Article 49(3)).

DPIA prompts (for your use case)

Answer these before deploying OpenAI in production:

1. Are users likely to enter Article 9 special-category data (health, biometric, criminal, religion, etc.) into the prompt? If yes, your lawful basis and safeguards must cover that - UI controls and staff training matter.
2. Are you using the API or a consumer ChatGPT account? If staff are using personal ChatGPT Plus, conversations may be retained and used for training. Your data governance must address shadow AI use.
3. Is your use case in AI Act Annex III (recruitment, credit, education, law enforcement, migration, justice, critical infrastructure)? If yes, the deployer obligations in Article 26 apply from 2 December 2027, whichever model is used, unless the Article 6(3) exception applies (it never covers a system that profiles people). Assess whether putting ChatGPT or the API to that use has made you the provider under Article 25(1)(c), in which case conformity assessment and registration in the EU database are your duties as provider. A fundamental rights impact assessment is needed only if you are one of the deployers Article 27 names (see the AI Act section above).
4. Have you configured EU residency if you have EU subjects? Default API processing is not EU-resident, residency requires approval for abuse-monitoring controls, and the UK region does not process data in the UK.
5. Have you applied for Zero Data Retention if your data sensitivity warrants it? The 30-day default abuse-monitoring window is a real retention period.

Unresolved questions / red flags

• Consumer-tier shadow use is the biggest unmanaged risk. Most SMEs have staff using ChatGPT Plus on personal accounts, which fall under consumer terms. The compliance posture of paid API / Enterprise is irrelevant to that traffic.
• EU residency is not the default. Buyers frequently assume that "OpenAI Enterprise" implies EU processing, which is only the case once residency has been approved and configured for the project. For UK buyers, the UK region keeps data at rest in the UK but does not process it there.
• Zero Data Retention is approval-gated. The sales process can be slow. Plan timing.
• Buyer records frequently name the wrong transfer mechanism. The DPF is widely cited against OpenAI in records of processing and vendor questionnaires. It is not available to OpenAI. The transfer runs on the SCCs, so Article 46 documentation has to exist, including a transfer impact assessment.

Related profiles

• Anthropic - same general-purpose LLM category, different defaults
• Microsoft 365 Copilot - embeds OpenAI models with different EU Data Boundary commitments
• Perplexity - routes to OpenAI models, applying OpenAI's terms transitively

Sources checked

• https://openai.com/policies/data-processing-addendum/ (updated 1 December 2025, effective 1 January 2026) and https://openai.com/policies/services-agreement/ - checked 2026-10-04
• https://platform.openai.com/subprocessors - checked 2026-10-04 (could not be captured on 2026-10-15)
• https://openai.com/policies/sub-processor-list/ (last updated 14 October 2026) - checked 2026-10-15
• https://developers.openai.com/api/docs/guides/your-data - retention, ZDR, Modified Abuse Monitoring and data residency - checked 2026-10-04, and for the endpoints not eligible for zero data retention, including the Assistants endpoints, on 2026-10-15
• https://developers.openai.com/api/docs/deprecations - removal of the Assistants API on 26 August 2026 - checked 2026-10-15
• https://openai.com/security-and-privacy/, https://openai.com/product-compliance-status/ and https://openai.com/business-data/ - checked 2026-10-04, and the security page's certification text and the product compliance status page's ISO list on 2026-10-15
• https://openai.com/enterprise-privacy/ - checked 2026-10-04, and for ChatGPT Edu and the Student Data Privacy Agreement on 2026-10-15
• https://trust.openai.com/ - ISO/IEC certifications listed and the ISO/IEC 27001 certificate scope - checked 2026-10-15 (rendered in a headless browser)
• https://help.openai.com/en/articles/8660679 (BAA for the API, ChatGPT Enterprise, Edu and Business), https://help.openai.com/en/articles/20001202 (ChatGPT for Clinicians) and https://help.openai.com/en/articles/12111915 (ChatGPT Team renamed ChatGPT Business) - checked 2026-10-15
• dataprivacyframework.gov participant registry, active and inactive, with a control query - checked 2026-10-04 and 2026-10-15
• Regulation (EU) 2024/1689 (the AI Act), Articles 3, 6, 16, 25 to 27 and 49 and Annex III, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Article 25(2) and (4) and setting 2 December 2027 for Annex III high-risk systems in Article 113, both from the Publications Office (https://publications.europa.eu/resource/celex/32024R1689 and https://publications.europa.eu/resource/celex/32026R1744) - checked 2026-10-15

Related reading

• DPA for AI vendors - the eight clauses to check before signing any AI vendor DPA, OpenAI included
• EU AI Act for AI buyers - deployer-side obligations for any UK or EU buyer running ChatGPT or the API
• HIPAA for AI tools - BAA gate and Security Rule checklist for US healthcare buyers
• OpenAI vs Anthropic DPA - head-to-head on the two most-asked-about API vendors
• OpenAI vs Copilot enterprise compliance - direct ChatGPT Enterprise vs the Copilot route
• Perplexity vs ChatGPT for regulated industries - research workflows with citation evidence trail
• Practitioner how-to (Janus Compliance): Can I use the ChatGPT / OpenAI API and stay GDPR compliant? - configuring the GDPR-compliant path step by step (DPA, residency, DPIA, transfers)
• Templates (Janus Compliance, which publishes CompanyScope; £49): AI API GDPR Compliance Pack - editable Word templates for the provider contract review, DPIA, transfer assessment, privacy notice wording and records of processing, covering OpenAI, Anthropic and Google, with provider positions as published on 4 October 2026

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.