ChatGPT (OpenAI) API DPA & GDPR Setup: 2026 Checklist

The overview article explains that the ChatGPT API can be used in compliance with the GDPR. This guide covers the practical setup: where to execute the data processing agreement, how to apply for zero data retention, how to minimise the data you send and what the DPIA should contain. It also explains how the EU AI Act applies, with transparency duties from 2 August 2026 and high-risk obligations from 2 December 2027 under the Digital Omnibus.

For a summary of OpenAI's data processing agreement, sub-processors and training policy, see the OpenAI compliance profile. Click paths and settings were current when this guide was last reviewed, and OpenAI changes its interface from time to time.

Get articles like this every Tuesday. Compliance Engineering, practical AI compliance for engineers and founders. Free and weekly, written by a CIPP/E certified practitioner.

Need the same setup reviewed for your system? A £500 scoping review covers your provider configuration, data processing agreement, data flows, DPIA and AI Act classification, with a written report within one week.

The six steps, in order

Six things should be in place before an integration with the ChatGPT API processes personal data in production:

1. The OpenAI data processing agreement is executed and on file.
2. Zero data retention has been requested, approved and confirmed, or the retention position is otherwise documented.
3. Your application minimises personal data before the API call.
4. The DPIA is written and signed off.
5. Your privacy notice describes the AI processing.
6. The EU AI Act classification of the integration is documented.

The steps should be taken in this order, because the data processing agreement is the contractual basis for everything that follows and the DPIA can only describe the data flows accurately once the minimisation step exists.

Step 1: Execute the OpenAI data processing agreement

You need a business OpenAI account, because the Data Processing Addendum cannot be executed from a personal account. If company work is being done through a personal account at platform.openai.com, move it to a business account first.

The steps at the time of writing:

1. Sign in at platform.openai.com.
2. Open Settings, then Organization.
3. Find the Compliance APIs or Data Processing Addendum section, depending on the account type.
4. Open openai.com/policies/data-processing-addendum and choose the option to execute it.
5. Enter the legal entity name, the signatory's name, title and email, and the billing entity if different.
6. Submit, and keep the countersigned copy where your data protection lead and legal team can find it.

The data processing agreement covers:

• the processing OpenAI carries out as your processor under Article 28 GDPR
• OpenAI's sub-processors
• data location, retention and deletion obligations
• notification obligations in the event of a security incident
• audit rights
• the transfer terms: for UK data, the Standard Contractual Clauses as amended by the UK Addendum, which the agreement treats as entered into; for EEA and Swiss data, OpenAI Ireland's commitment to transfer the data onward only under agreements containing the Standard Contractual Clauses or on the basis of an adequacy decision

OpenAI has no record on the EU-US Data Privacy Framework register, so the Standard Contractual Clauses carry the transfer. Note also which OpenAI entity you contract with: customers in the EEA and Switzerland contract with OpenAI Ireland Limited, and UK customers with OpenAI OpCo, LLC.

The DPA applies through OpenAI's business terms, and executing it gives you a signed record of the contract Article 28 requires, so this step should be completed before the integration processes any personal data.

Step 2: Apply for zero data retention and confirm it

By default, OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring, although it does not use API data for model training.

Where the integration handles customer support, customer-facing chat or document processing, zero data retention reduces the data held by the processor. The process at the time of writing:

1. From platform.openai.com, open Settings, then Organization, then Compliance APIs, and submit a zero data retention request, or contact OpenAI's API compliance team directly.
2. Explain that you require zero data retention to support data minimisation under Article 5(1)(c) of the GDPR, name the endpoints concerned (for example, /v1/chat/completions and /v1/embeddings), confirm that your data processing agreement is executed, and give your organisation ID.

OpenAI decides whether to approve the request, and approval is not automatic. Once it is approved, confirm the position in your account settings and keep the written confirmation. Do not describe the configuration as zero retention in your DPIA or privacy notice until you have that confirmation, and check it again at contract renewal.

Step 3: Minimise personal data before the API call

The DPIA can only state that personal data is minimised if the system is built that way, and the usual approach is a sanitisation step that runs before the prompt is constructed.

A minimal example:

import re

DIRECT_IDENTIFIER_PATTERNS = {
    "EMAIL": r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}",
    "UK_PHONE": r"\b(?:\+44|0)\s?\d{2,4}\s?\d{3,4}\s?\d{3,4}\b",
    "UK_NI": r"\b[A-CEGHJ-PR-TW-Z]{2}\d{6}[A-D]\b",
    "ACCOUNT_REF": r"\b[A-Z]{2,4}-?\d{6,10}\b",
}

def sanitise(text: str) -> tuple[str, dict[str, str]]:
    redactions = {}
    for label, pattern in DIRECT_IDENTIFIER_PATTERNS.items():
        for i, match in enumerate(re.finditer(pattern, text)):
            token = f"<{label}_{i}>"
            redactions[token] = match.group()
            text = text.replace(match.group(), token, 1)
    return text, redactions

The sanitised text is used to construct the prompt, and the redactions dictionary remains on your server. OpenAI receives only the placeholder version, and the placeholders are restored on your server before the response is shown to the user.

For more sensitive contexts, such as health, financial or special category data, add named-entity recognition (for example spaCy or Presidio) on top of the pattern matching, and have the output reviewed before the integration goes live.

With this step in place, the DPIA can document that direct identifiers matching the defined patterns are removed before data leaves your systems and that re-identification takes place within your own environment, which supports the data minimisation principle in Article 5(1)(c).

Step 4: Write the DPIA

A DPIA for a chatbot integration should describe the processing specifically enough to support its conclusions. The chatbot DPIA template, published under a CC BY licence, provides a structure.

For an OpenAI integration, the DPIA should give particular attention to the following sections.

System summary. Name the system, where it is deployed, the provider and the specific model, and the data sources.

Roles. You are the controller and OpenAI is the processor. List the sub-processors from the data processing agreement executed in step 1. CompanyScope's OpenAI profile can be used to cross-check the current list.

Lawful basis. For most customer support chatbots, the lawful basis is legitimate interests under Article 6(1)(f), which requires a documented balancing test. Where the support forms part of a contract with the customer, performance of a contract under Article 6(1)(b) may be more appropriate. Choose one and record the analysis.

Personal data inventory. Record what enters the prompt after sanitisation, what is returned, what you log and retain, and what is sent to OpenAI.

Risk assessment. Risks specific to these integrations include outputs exposing third-party data (very unlikely through the API with minimal retention), prompt injection causing unintended disclosure and conversation logs becoming a target for attack. The handling of data subject rights is a further risk, since erasure requests must reach any logs held by the provider.

Controls and mitigations. These typically include the data processing agreement, reduced retention, the sanitisation step, encrypted and access-controlled logging on your side, defined retention periods, and a deletion process that covers your own logs and any residual logs held by the provider.

Residual risk and sign-off. Record the residual risk after controls, the sign-off by the person responsible for data protection and by senior management, with dates, and a review date.

The DPIA is the record that the risks were considered before the system went live, and it is usually among the first documents a regulator asks for when reviewing an AI system.

Step 5: Update the privacy notice

Individuals need to be told that you use an AI processor. An example, to be adapted to your actual configuration:

"We use AI to help respond to support enquiries. The AI service is provided by OpenAI under a data processing agreement that meets the requirements of Article 28 of the GDPR. OpenAI does not use your data to train its models. You can ask for your enquiry to be handled without AI assistance by contacting [email]."

If zero data retention has been approved and confirmed, you can also state that OpenAI does not retain your conversation data beyond the request. Do not include that statement until the confirmation is in place.

The notice should explain what the AI does and why, name the processor and the contractual basis, and give a contact point. Where the AI is used in a chatbot, include a shorter version at the start of each conversation. If the notice was drafted with an AI tool, check it before publishing, particularly the statements about transfers and retention. Article 50 of the EU AI Act separately requires that people are told they are interacting with AI.

Step 6: Document the EU AI Act classification

The EU AI Act's transparency duties have applied since 2 August 2026, and its high-risk obligations apply from 2 December 2027 under the Digital Omnibus. For most chatbots, the main obligation is the Article 50 transparency disclosure covered in step 5. If your integration falls within Annex III, considerably more is required.

The Annex III high-risk categories include AI systems used for:

• creditworthiness assessment or credit scoring
• employment decisions, such as recruitment, termination or performance evaluation
• risk assessment and pricing for life and health insurance
• eligibility for essential public services or benefits
• law enforcement, migration and border control

A chatbot that supports credit decisions, screens job candidates or determines eligibility for benefits is likely to be high-risk. The obligations for high-risk systems include:

• conformity assessment before the system is placed on the market or put into service
• technical documentation under Annex IV
• a risk management system under Article 9
• data governance under Article 10
• human oversight under Article 14
• accuracy, robustness and cybersecurity under Article 15
• registration in the EU database
• post-market monitoring

Where only the transparency obligation applies, the disclosure and the GDPR steps above address the main obligations; record the classification and your reasoning in an addendum to the DPIA. Where the system is high-risk, a scoping review is a sensible first step.

Common gaps

The data processing agreement was never executed. The DPA applies through OpenAI's business terms, but without a signed copy the business has to rely on incorporation by reference when a regulator or customer asks for the contract. Executing it is straightforward and gives a signed record for the compliance file.

No minimisation step. Complete customer records are included in the prompt while the DPIA states that data is minimised, which can only be corrected by changing the architecture rather than the document.

Zero data retention assumed rather than confirmed. A request was submitted but never confirmed, so production traffic ran under the default 30-day retention while the DPIA stated zero. Confirm the position in writing and check it at renewal.

An assumption that no personal data is processed. Free-text inputs from customers often contain personal data, such as names, email addresses, phone numbers and location details, even when it is not requested. Treat input fields as containing personal data by default.

No erasure process. An erasure request must reach every system holding the individual's data, including your conversation logs and any residual logs held by the provider. Set up the process before it is needed.

Checklist before going live

• OpenAI data processing agreement executed under the correct legal entity and stored where it can be found
• Zero data retention requested, approved and confirmed, or the retention position documented
• Sanitisation step in place and tested against known direct identifiers
• DPIA written and signed off
• Privacy notice updated with the AI processing disclosure and the AI Act transparency statement
• EU AI Act classification documented, with reasoning
• Conversation logs on your side encrypted, access-controlled and subject to defined retention
• Erasure process tested end to end
• Breach response plan covering incidents at the AI processor

The documents on this checklist, as templates. The £49 AI API GDPR Compliance Pack contains editable Word templates for the contract review, the DPIA, the privacy notice wording and the retention and zero data retention record, with request letters for OpenAI and Anthropic. It also includes a go-live checklist and evidence log that covers the EU AI Act transparency and prohibited-practice checks. Provider positions are recorded as published on 4 October 2026.

Other providers

The steps transfer to other providers, although the contractual mechanics differ.

Anthropic (Claude API). The data processing addendum is incorporated into Anthropic's Commercial Terms when you accept them for the API or Claude for Work, so there is no separate signing step. Confirm that you are on commercial rather than consumer terms. Anthropic does not use API data for training by default, and its standard commercial terms include retention for trust and safety purposes. Zero data retention arrangements are available to some enterprise customers, so confirm the retention period in your own contract before describing it as zero. The minimisation step, DPIA, privacy notice and AI Act classification apply in the same way.

Google (Gemini API). The paid Gemini Developer API, billed through a Cloud project, is covered by Google's Data Processing Addendum for Products Where Google is a Data Processor, but offers no data residency option or zero data retention route. Vertex AI, now the Gemini Enterprise Agent Platform, is covered by the Cloud Data Processing Addendum and is the route to use where you need EU residency, which you configure by sending requests to the EU multi-region and record in the DPIA.

Self-hosted models (such as Llama). There is no external processor, so no third-party data processing agreement is needed. The DPIA, privacy notice and AI Act classification still apply. Minimisation is simpler because the data remains within your infrastructure, but the reasoning should still be recorded.

Further resources

The overview article explains why each step is needed in a shorter question-and-answer format. The chatbot DPIA template and a Nigeria-specific breach response template are available in the same open toolkit. For a comparison of the OpenAI and Anthropic agreements, see the OpenAI and Anthropic DPA comparison.

If you have a working integration that has not yet been documented, the scoping review provides a written assessment within a week, and the £500 fee is deducted from any full engagement that follows.

---

Michael K. Onyekwere is a CIPP/E certified data protection professional at Janus Compliance and writes Compliance Engineering, a weekly newsletter on practical AI compliance. For a review of your provider setup, transfers, DPIA, retention and AI Act classification, start with a £500 scoping review. If you also need the system built, see the AI Chatbot + Compliance Package.