ChatGPT API and GDPR: How to Use It Compliantly in Six Steps

The ChatGPT API can be used in compliance with the GDPR, but compliance depends on how it is used. Using the API on OpenAI's business terms, with the right safeguards in place, is a very different arrangement from staff pasting customer information into the consumer chat interface. The consumer interface offers none of those safeguards.

This guide sets out the six steps for using the API with personal data, together with the documents you should be able to produce if a regulator or a client asks.

Get articles like this every Tuesday. Compliance Engineering, practical AI compliance for engineers and founders. Free and weekly, written by a CIPP/E certified practitioner.

Need the detailed setup walkthrough? Click paths, code, a worked DPIA and the EU AI Act overlay: the practitioner's setup guide for 2026.

Need this reviewed for your own setup? A £500 scoping review covers your provider configuration, data processing agreement, data flows and DPIA requirements, with a written report within one week.

The consumer service and the API are different products

Many GDPR problems with ChatGPT arise from treating the consumer product and the API as if they were the same.

Consumer ChatGPT (chat.openai.com):

• Conversations may be stored and used for training unless the user opts out
• No data processing agreement
• No guaranteed data residency
• No retention controls
• Suitable for personal use, but not for business data

ChatGPT API (api.openai.com):

• Data is not used for model training by default
• A data processing agreement is available
• Retention can be reduced, down to zero for approved accounts
• EU data processing options are available

Where staff enter customer names, order numbers or complaints into chat.openai.com, the risk arises from that use of the consumer service. If the data consists of client files rather than customer records, a duty of confidentiality applies in addition to the GDPR, which is covered in can my firm use Claude or ChatGPT on client files?

Step 1: Put the data processing agreement in place

Article 28 of the GDPR requires a written contract whenever a third party processes personal data on your behalf. These are the eight clauses to check when reviewing a data processing agreement with an AI provider.

OpenAI provides a standard data processing agreement in your account settings, and a current summary is available in the OpenAI compliance review. For the agreement in detail, including how to execute it, see the OpenAI DPA explained. It covers:

• the data processed and the purposes of processing
• the security measures OpenAI applies
• the list of sub-processors
• OpenAI's obligations in the event of a personal data breach
• your audit rights

The agreement should be in place before development starts, because Article 28 requires it for any processing of personal data by OpenAI, and it is likely to be one of the first documents a regulator asks for when reviewing the use of an AI processor.

Step 2: Minimise retention and apply for zero data retention

By default, OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring, and it does not use API data for model training.

For sensitive data, apply for zero data retention. It is available for qualifying and enterprise accounts and is subject to approval by OpenAI, so it is a request you submit (through the Compliance APIs settings, or by contacting OpenAI) rather than a setting you can switch on. Once approved, confirm in your dashboard that retention shows as zero on the relevant endpoints, and keep the written confirmation.

Reducing what the processor retains supports compliance with the storage limitation principle, which requires that personal data is not kept longer than necessary for its purpose.

Step 3: Send only the data the task requires

A common error is sending complete customer records to the API when the task needs only part of the information.

Excessive:

"Customer John Smith (john@email.com, account #45678,
DOB 15/03/1985, address: 42 Oak Street, London)
is asking about their recent order."

Minimised:

"A customer is asking about order status. Their question:
'When will my order arrive?' Order date: March 10.
Expected delivery: March 15."

Data minimisation in this context is therefore a design decision about how each API call is constructed. In practice it means removing names, email addresses, account numbers and other identifiers that the model does not need to answer the question.

Where personal data must be included, for example in medical, legal or financial queries, record the reason in your DPIA.

Step 4: Carry out a DPIA

A data protection impact assessment documents that you identified and addressed the risks before the system went live.

For an AI API integration, the DPIA should cover:

The personal data that passes through the API. Be specific: "customer first name, support query text and order reference number" rather than "customer data".

The lawful basis and necessity. For most business chatbots, the lawful basis will be legitimate interests (providing efficient customer support) or performance of a contract (providing a service the customer has signed up for).

The risks. These include a breach at the processor, retention beyond what you expect, and the possibility of outputs exposing other users' data, which is very unlikely with the API but worth recording as considered.

The safeguards. For example: the data processing agreement, reduced retention, data minimisation in API calls, encryption in transit, access controls on your side and staff training.

If you are unsure whether a DPIA is required, this explains the Article 35 test for AI systems. If one is required, this guide sets out how to write it.

Step 5: Update your privacy notice

Individuals need to be told that you use an AI processor, in a clear and concise explanation that covers:

• the AI processing you carry out (for example, "We use AI to help answer your support questions")
• the processor (OpenAI, or whichever provider you use)
• where the data is processed, which is relevant to international transfers
• how long the data is retained
• the individual's rights, including access, erasure and objection

This information belongs in your privacy notice. Where AI is used in a chatbot, it is also good practice to say so at the start of the conversation.

Step 6: Document the international transfer mechanism

Because OpenAI is a US company, processing UK or EU personal data through its API involves an international transfer, and the EU-US Data Privacy Framework register should be checked before the transfer mechanism is recorded. OpenAI has no entry on the register, active or inactive, so the Framework does not cover these transfers, although a number of published vendor summaries state otherwise.

OpenAI's data processing agreement treats EEA and Swiss data differently from UK data. Customers in the EEA and Switzerland contract with OpenAI Ireland Limited, which commits to transfer their data outside the EEA or Switzerland only under agreements containing the Standard Contractual Clauses or on the basis of an adequacy decision. UK data is processed by OpenAI OpCo, LLC under the Standard Contractual Clauses as amended by the UK Addendum, which the agreement treats as entered into for UK data.

Record the mechanism that applies to your data in your records of processing activities (for UK data, the Standard Contractual Clauses with the UK Addendum; for EEA and Swiss data, OpenAI Ireland's commitment to transfer onward only under the Standard Contractual Clauses or an adequacy decision), and carry out a transfer risk assessment. If your records currently name the Data Privacy Framework for OpenAI, correct the entry.

The EU AI Act: Article 50 transparency duties (in force since 2 August 2026)

The GDPR is not the only regime that applies. Where the ChatGPT API powers a system that interacts with people, such as a support chatbot, an assistant or an intake tool, Article 50 of the EU AI Act has required since 2 August 2026 that users are told they are interacting with an AI system. Where the system generates synthetic content, marking obligations also apply. These are transparency obligations, separate from the GDPR steps above, and they apply regardless of how the data processing is configured.

The Article 50 guide explains who owes which duty and the relevant exemptions, and the free Article 50 Duty Mapper identifies your duties in a few questions. If you would like your setup reviewed against them, the £250 Article 50 compliance check provides a fixed-fee written gap note within 72 hours of confirmation.

Other providers

OpenAI is one of several providers, and the OpenAI, Anthropic and Google comparison sets out the main differences side by side, and CompanyScope publishes a vendor profile for each of the major AI vendors.

Anthropic (Claude API): transfers rely on the Standard Contractual Clauses, with the UK and Swiss addenda and Irish law governing the clauses. Anthropic has no Data Privacy Framework record, so the Standard Contractual Clauses carry the transfer. API data is not used for training by default. Configuration details are in is the Claude API GDPR compliant.

Microsoft 365 Copilot: not an API, but included because many organisations already use it. Microsoft acts as processor under its Data Protection Addendum, and Graph data is not used for training, so the main exposure lies in your own SharePoint permissions. Two administrative settings move processing outside the EU Data Boundary. See the Copilot guide.

Google (Gemini API): on the unpaid tier, Google uses submitted content to improve its products and it may be reviewed by people, although for users in the EEA, Switzerland and the UK the paid-tier data terms apply to all services. The paid Gemini Developer API does not use your data for training and is covered by Google's Data Processing Addendum, but offers no data residency or zero data retention route. Vertex AI, now the Gemini Enterprise Agent Platform, adds the Cloud Data Processing Addendum, EU data residency and zero data retention, each subject to conditions. Both routes rely on Google LLC's Data Privacy Framework certification, which was active on the register when checked on 4 October 2026, with the Standard Contractual Clauses as a fallback. Configuration details are in is the Gemini API GDPR compliant.

Mistral: a French company based in the EU, which simplifies data residency questions. A data processing agreement is available.

Self-hosted open models (such as Llama): the data remains within your own infrastructure, so there is no external processor and no international transfer, at the cost of higher infrastructure and maintenance effort.

The right choice depends on your requirements. Where data residency is the main concern, a self-hosted model or an EU-based provider simplifies the analysis. Where model performance is the priority, OpenAI or Anthropic, correctly configured, is a reasonable choice.

Regulatory attention

Data protection authorities are paying attention to AI, and in 2023 the Italian data protection authority temporarily restricted ChatGPT over GDPR concerns relating to the consumer service.

Enforcement for failing to put governance measures in place does not depend on AI either. In February 2026 the ICO fined MediaLab.AI, which operated Imgur in the UK until September 2025, £247,590. Imgur allowed children under 13 onto the platform without any means of establishing their age, so it had no valid lawful basis for processing their data, and it had not carried out a DPIA before offering the service to children. The penalty notice cites Articles 5(1)(a), 6, 8 and 35 of the UK GDPR, including the missing DPIA.

Using an AI API without a data processing agreement, a DPIA or data minimisation leaves the same kind of gap. The risk increases further once a system can take actions rather than only return text: this Register entry analyses how liability was allocated when an autonomous coding agent deleted a live database during an explicit change freeze.

Checklist before going live

Before using the ChatGPT API, or any similar model, with personal data in production:

• Data processing agreement in place with the provider
• Zero or minimum retention configured
• Data minimisation applied to API calls
• DPIA completed and recorded
• Privacy notice updated to describe the AI processing
• Lawful basis identified (legitimate interests or contract)
• Transfer mechanism recorded (for UK data, the Standard Contractual Clauses with the UK Addendum; for EEA and Swiss data, OpenAI Ireland's onward transfer terms)
• Staff instructed not to use the consumer service for business data
• Deletion process in place for data you store
• Breach response plan covers incidents at the AI processor

The documents on this checklist, as templates. The £49 AI API GDPR Compliance Pack contains editable Word templates for the provider contract review, the DPIA, the legitimate interests assessment, the privacy notice wording, the transfer assessment and the staff AI use policy. OpenAI's position is recorded as published on 4 October 2026, alongside Anthropic's and Google's, each with its source.

Summary

Using the ChatGPT API does not prevent GDPR compliance, provided the service is used on its business terms and the governance steps are completed. Those steps are the data processing agreement, reduced retention, data minimisation, a DPIA, an updated privacy notice and a documented transfer mechanism.

If you are building an AI system that processes personal data and want the compliance documentation prepared alongside it, see our services.

---

Michael K. Onyekwere is a CIPP/E certified data protection professional at Janus Compliance. For a review of your provider setup, transfers, DPIA and retention, start with a £500 scoping review. If you also need the system built, see our AI Chatbot + Compliance Package.