Is ChatGPT GDPR Compliant? Free, Plus, Business and Enterprise Compared

Whether your use of ChatGPT complies with the UK GDPR or the EU GDPR depends on what you use it for, the personal data involved, the plan and the safeguards you put in place. Both your organisation and OpenAI have obligations, and the plan decides which terms OpenAI offers. Those terms differ considerably between its consumer plans and its business plans.

On ChatGPT Business, ChatGPT Enterprise and the API, OpenAI acts as your processor under a Data Processing Addendum (DPA) and does not train its models on your content by default. The DPA supplies the processor terms that Article 28 requires, although it does not by itself establish that your use is lawful. On the Free, Go, Plus and Pro plans, OpenAI is the controller under its own privacy policy, conversations may be used for training unless the user switches that off, and there is no DPA at all.

This guide sets out what OpenAI's own documents say about each plan: training, retention, the contract and contracting entity, data residency, administrative controls, certifications and international transfers. All quotations were taken from OpenAI's pages on 27 October 2026, and where a page shows its own date, that date is given.

Get articles like this. Compliance Engineering, practical AI compliance for founders and the people who sign off AI tools, by a CIPP/E certified practitioner.

Need your own position checked? A £500 scoping review covers which ChatGPT plans your staff actually use, your DPA and transfer position, and what your records and DPIA need to say, with a written report within one week.

The plans OpenAI offers

OpenAI's pricing page lists six plans: Free, Go, Plus, Pro, Business and Enterprise. It also states how they are intended to be used: "Go, Free, and Plus plans are designed to be used by individuals. Business and Enterprise are for businesses."

ChatGPT Business is the plan previously called ChatGPT Team. OpenAI's help centre records that "ChatGPT Team was renamed to ChatGPT Business on August 29, 2025." ChatGPT Edu, for universities, is described as "a variant of the ChatGPT Enterprise plan specific to educational institutions."

OpenAI treats Free, Go, Plus and Pro together as plans for individuals, and no page sets out separate data terms for Pro. In this guide they are called the consumer plans.

The plans compared

	Free, Go, Plus, Pro	Business	Enterprise	API
Training on your content	On by default, user can opt out (feedback still used)	No	No, unless you opt in	No, unless you opt in
OpenAI's role	Controller	Processor	Processor	Processor
DPA	None	Available	Available	Available
UK contracting party	OpenAI OpCo, LLC	OpenAI OpCo, LLC	OpenAI OpCo, LLC	OpenAI OpCo, LLC
Retention	Until deleted, then 30 days (subject to de-identification, security and legal exceptions)	Admin controlled, 30 days after deletion (subject to legal and harm-prevention exceptions)	Admin controlled, 30 days after deletion (subject to legal exceptions)	Abuse logs up to 30 days, Zero Data Retention by approval, application state varies by feature
UK or EU data residency	No	Not listed	Storage in Europe or UK, inference in Europe	Storage in Europe or UK, processing in Europe
Audit logs (Compliance API)	No	No	Yes	Audit Logs API
ISO 27001 and 27701	Not in scope	No (SOC 2 Type 2 only)	Yes	Yes
Transfer mechanism	Adequacy where it applies, otherwise SCCs and UK Addendum	SCCs and UK Addendum	SCCs and UK Addendum	SCCs and UK Addendum

ChatGPT Edu follows Enterprise on residency, the Compliance API and certification. In place of the DPA, OpenAI processes Edu data under its Student Data Privacy Agreement, which we have not reviewed, so the Enterprise column's contract and transfer entries should not be assumed for Edu.

The consumer plans: Free, Go, Plus and Pro

Training

Conversations on the consumer plans can be used to train OpenAI's models unless the user changes a setting. OpenAI's data controls FAQ states: "On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default. You can turn off Improve the model for everyone and keep your chat history." Go follows the same approach.

A Temporary Chat "is not used to improve OpenAI models while it remains temporary". However, feedback overrides the opt-out. OpenAI's help article on model improvement states that "if you submit feedback on a response—for example, by selecting thumbs up or thumbs down—we may use the entire conversation associated with that feedback to improve our models, even if you have opted out of model training."

For users in the UK and EU, OpenAI's privacy policy (updated 24 August 2026) gives legitimate interests as the lawful basis for training, "such as when we train and improve our models for everyone."

Retention

A chat stays in the account until the user deletes it. Once deleted, "OpenAI schedules it for permanent deletion from its systems within 30 days, unless the chat was already de-identified and disassociated from your account or OpenAI must retain it longer for security or legal obligations." OpenAI "may keep a copy of a temporary chat for up to 30 days for safety purposes."

The contract

There is no DPA for the consumer plans. OpenAI's statement on DPAs names only ChatGPT Business, ChatGPT Enterprise and the API. Instead, the privacy policy makes OpenAI the controller of the personal data it processes. For users in the EEA or Switzerland, the controller is OpenAI Ireland Limited, and for anyone else, including users in the UK, it is OpenAI OpCo, LLC. The Terms of Use for Europe and the UK say the same: UK residents contract with "OpenAI OpCo, LLC, a Delaware company".

The Terms of Use do contemplate business use of a consumer account ("If you use our Services for commercial or business use, the following terms apply"), but the terms that follow cover liability, indemnity and governing law. They contain no data processing terms.

This is the main reason the consumer plans are unsuitable for business use involving personal data. When a member of staff pastes a customer email, a CV or a client file into a personal ChatGPT account, the business discloses that personal data to OpenAI, which processes it as a controller under its own policy and may use it for training. Because OpenAI acts as an independent controller, no Article 28 processor contract exists for these accounts, and the disclosure to OpenAI needs its own lawful basis. Personal accounts also give the business no central retention controls or audit records.

ChatGPT Business (formerly Team)

Training and retention

OpenAI states on the Business help page that "OpenAI won't train on your workspace's data." Unlike the consumer plans, feedback does not change this: "response feedback (submitting thumbs up or thumbs down) does not permit training on the associated conversation."

On retention, OpenAI's enterprise privacy page (updated 8 January 2026) states that "Your workspace admins can control how long your data is retained. Any deleted or unsaved conversations are removed from our systems within 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."

The contract and the contracting entity

OpenAI states: "Yes, we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API in support of their compliance with GDPR and other privacy laws." The OpenAI Services Agreement, which applies to ChatGPT Business, also provides that where the customer processes personal data, "OpenAI and Customer will comply with the DPA, which is incorporated by this reference into the Agreement." Under the DPA, OpenAI "acts as a Data Processor on the Customer's behalf".

OpenAI describes two routes to the DPA. The enterprise privacy page asks customers to complete a DPA form, while the Services Agreement incorporates the DPA by reference. Our guide to the OpenAI DPA sets out its terms in detail. Keeping a signed copy on file is the easier position to evidence.

The contracting entity is often misstated. The Services Agreement defines the OpenAI contracting party as "OpenAI OpCo, LLC, for Customers located outside the EEA or Switzerland" and "OpenAI Ireland Ltd. for Customers located in the EEA or Switzerland". A UK business therefore contracts with the US company, and its records of processing should name OpenAI OpCo, LLC.

Controls, residency and certification

Business has fewer controls than Enterprise. OpenAI's Compliance Platform, which gives administrators audit logs of conversations, is "available to ChatGPT Enterprise and Edu workspaces." Zero Data Retention is not available on self-serve Business: OpenAI's Business FAQ directs customers who need it to "use a contracted offering instead of self-serve ChatGPT Business."

OpenAI's pages disagree on whether Business administrators can read members' chats. The enterprise privacy page states that "Workspace admins have control over workspaces and can view, access, export, and delete end user conversations in the workspace." The Business general FAQ states that "By default, admins and owners cannot see all private member chats." If administrator access matters to your staff privacy notice or acceptable use policy, ask OpenAI to confirm the position for your workspace in writing.

Data residency is not offered for Business in any page we found. OpenAI names "Eligible ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, and API platform customers" as eligible, and Business is absent from that list.

On certification, OpenAI's product compliance matrix (version 1.1, updated 4 August 2026) shows ChatGPT Business with a SOC 2 Type 2 report but without ISO/IEC 27001 or ISO/IEC 27701 certification. Those two certifications cover the API, ChatGPT Enterprise and ChatGPT Edu. A supplier questionnaire answer that ChatGPT is ISO 27001 certified is accurate for Enterprise and not for Business.

ChatGPT Enterprise and Edu

On training, OpenAI states for Enterprise: "By default, we do not use your business data for training our models." The Services Agreement makes that contractual: "OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use." Administrators set retention, and deleted conversations "are removed from our systems within 30 days, unless we are legally required to retain them."

Enterprise adds controls that Business lacks: audit logs through the Compliance API (the Compliance Logs Platform retains data for 30 days) and Enterprise Key Management, through which "customers can control their own encryption keys". Its administration features also include domain verification, single sign-on, SCIM and usage insights.

Data residency is available to eligible new Enterprise and Edu customers "at no additional cost". Storage regions include "Europe (EEA + Switzerland)" and "United Kingdom". Inference residency, which governs where the model processes the request, is offered in Europe, the United States and the UAE, but not in the UK. A UK organisation can therefore keep stored content in the UK, but UK processing of requests is not offered. OpenAI describes inference residency as covering "model inference (GPU execution)" on in-scope customer content, and external integrations follow their own providers' terms. OpenAI also states what residency does not cover: "Account data, billing details, high-level usage statistics, logs without content, and other metadata used to operate and secure the service."

Edu has one difference from Enterprise. OpenAI states that "For ChatGPT Edu and for Teachers, we process your data pursuant to our Student Data Privacy Agreement." Universities should therefore review that agreement rather than the standard DPA.

The API

The API is the route most businesses use to build ChatGPT's models into their own products. Data sent to the API is not used for training unless the organisation opts in. Abuse monitoring logs are kept for up to 30 days by default, and approved customers can obtain Zero Data Retention. The API has the same DPA and contracting entities as Business and Enterprise, together with SOC 2 Type 2, ISO/IEC 27001 and ISO/IEC 27701 coverage. Some API features also store application state, in some cases until it is deleted, and some endpoints are not eligible for Zero Data Retention, so check the features you use against OpenAI's table.

Data residency is available on the API, although outside the United States it requires approval for abuse monitoring controls and a Modified Retention amendment. The UK endpoint stores data in the UK but does not process requests there. The API is covered in detail in our ChatGPT API compliance guide and the API setup guide.

International transfers

All the plans involve transfers of personal data outside the UK and the EEA. For the consumer plans, OpenAI's privacy policy states that "OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK". For the business plans, the DPA provides for transfers to OpenAI affiliates and third parties outside the EEA, and UK data is processed by the US company.

OpenAI does not rely on the EU-US Data Privacy Framework. A search of the Framework's participant register on 27 October 2026 found no OpenAI entity, either active or inactive. OpenAI relies instead on the Standard Contractual Clauses. Under the DPA, EEA and Swiss data is processed by OpenAI Ireland Limited, which transfers it onward on the basis of agreements containing the Clauses. UK data is processed by OpenAI OpCo, LLC "in compliance with this DPA and with the SCCs as amended by the UK Addendum", with the Clauses governed by the laws of England and Wales and the Information Commissioner's Office as the supervisory authority.

The record of processing should therefore name the Standard Contractual Clauses (with the UK Addendum for UK data), never the Data Privacy Framework. Because the Clauses are the transfer mechanism, a transfer risk assessment is also needed. The ICO's guidance, updated on 15 January 2026, explains that following the Data (Use and Access) Act 2025, a transfer risk assessment "is now referred to in UK legislation as a 'data protection test'". Under the EU GDPR the equivalent is usually called a transfer impact assessment.

The New York Times preservation order

In 2025 a US court order in the New York Times litigation required OpenAI to retain ChatGPT and API content indefinitely. OpenAI's statement on the order (updated 22 October 2025) reports that "Our obligations under the earlier order ended on September 26, 2025." It adds that OpenAI is no longer required to retain new data "or any conversations originating from the European Economic Area, Switzerland, or the United Kingdom", although it "will securely store limited historical April–September 2025 user data."

OpenAI also stated that the order "does not impact ChatGPT Enterprise or ChatGPT Edu customers." The order did apply to the consumer plans, the plan then called Team, and the API without Zero Data Retention. OpenAI's October 2025 update states that conversations originating from the EEA, Switzerland and the UK are excluded from the continuing preservation requirement.

What a business should do

Identify which accounts your staff use and what personal data they enter. Personal Free or Plus accounts used for work carry the weakest terms, and the rest of the analysis depends on that answer.

Where staff need ChatGPT for work involving personal data, provide a Business or Enterprise workspace and prohibit personal accounts for that work in your acceptable use policy. Put the DPA in place, retain the applicable terms and evidence that you accepted them, and record OpenAI OpCo, LLC (or OpenAI Ireland Ltd if you are based in the EEA) as your processor.

Record the Standard Contractual Clauses as the transfer mechanism and complete the transfer risk assessment (the data protection test). If the use involves special category data, monitoring of staff or decisions about individuals, assess whether a data protection impact assessment is required before the processing begins.

Choose the plan to match the requirement. If a customer or regulator requires ISO 27001 certification or audit logs through the Compliance API, Business does not provide them and Enterprise does, subject to eligibility and configuration. OpenAI's pages do not list Business as eligible for data residency.

For firms handling client files, our guide on using Claude or ChatGPT on client files covers confidentiality, lawful basis and the documents to prepare.

Checked on 27 October 2026 against OpenAI's pricing page, enterprise privacy page (updated 8 January 2026), product compliance status page (version 1.1, updated 4 August 2026), security and privacy page, EU privacy policy (updated 24 August 2026), Terms of Use (updated 16 January 2026), Services Agreement and Data Processing Addendum (both effective 1 January 2026), statement on the New York Times data demands (updated 22 October 2025), API data controls guide and help centre articles, and the Data Privacy Framework participant register. OpenAI's help centre articles show no date.