ChatGPT / OpenAI DPA Explained (2026): What the Data Processing Agreement Covers, How to Sign It, and What It Leaves to You

OpenAI's Data Processing Addendum is the contract under which OpenAI acts as your processor when you use the OpenAI API to process personal data, and it is likely to be one of the first documents a regulator or an enterprise customer asks to see. This guide explains what it covers, how it takes effect and how to keep evidence of it, and which obligations remain with you as controller.

It accompanies the overview Can I use the ChatGPT API and stay GDPR compliant? and the GDPR-compliant setup guide. For a comparison with other providers, see OpenAI vs Anthropic vs Google.

Get articles like this. Compliance Engineering, practical AI compliance for engineers and founders, by a CIPP/E certified practitioner.

Why a DPA is required

Article 28 of the UK GDPR and the EU GDPR requires a written contract whenever another party processes personal data on your behalf, binding that party to act only on your instructions and setting out its obligations. Sending a customer's name or email address to the OpenAI API means OpenAI is processing personal data for you, so Article 28 applies, and without a processor contract in place the processing would not meet that requirement.

How the OpenAI DPA takes effect

The current DPA was updated on 1 December 2025 and took effect on 1 January 2026. It is incorporated into the OpenAI Services Agreement, which a business customer accepts by clicking to agree, by accepting an order form, or by using the services. For most API customers the current DPA therefore applies from 1 January 2026, or from the point at which they started using the API on business terms if that was later.

Because the DPA is part of the business terms, it is available only to business accounts on the OpenAI platform; there is no DPA for the consumer ChatGPT product. The DPA page at openai.com/policies/data-processing-addendum also includes a link to execute the DPA. Using it is worthwhile even though the agreement already applies, because a signed record in your compliance files is easier to produce for a regulator or a customer than an argument about incorporation by reference.

What the OpenAI DPA covers

The following eight areas determine how much protection the DPA gives you, and the same checklist applies to any AI provider:

1. Scope and instructions. Check that the DPA confines OpenAI to processing on your documented instructions.
2. Training. OpenAI states that, since 1 March 2023, data sent to the API has not been used to train or improve its models unless the customer opts in, which is the main point of difference from the consumer product.
3. Retention and deletion. By default, OpenAI generates abuse monitoring logs for API usage and retains them for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect its services or third parties. Zero Data Retention and Modified Abuse Monitoring are available to eligible customers, but only with OpenAI's prior approval and acceptance of additional requirements.
4. Sub-processors. The DPA authorises the sub-processors on OpenAI's published list, requires OpenAI to notify changes, and gives you 30 days from notice to object. Keep a dated copy of the list.
5. International transfers. The DPA treats EEA and Swiss data differently from UK data. Customers based in the EEA or Switzerland contract with OpenAI Ireland Limited, which processes their data and, where it transfers that data to OpenAI affiliates or third parties outside the EEA or Switzerland, commits to do so under agreements containing the Standard Contractual Clauses or on the basis of an adequacy decision under Article 45 of the GDPR. No clauses are entered into between the customer and OpenAI for EEA or Swiss data, and the DPA contains no Swiss addendum. UK data is processed by OpenAI OpCo, LLC under the Standard Contractual Clauses (Module Two, or Module Three where the customer is itself a processor) as amended by the UK Addendum, which the DPA treats as entered into for UK data only. OpenAI has no entry on the EU-US Data Privacy Framework register, so the Framework plays no part in either route.
6. Security and certifications. Review the technical and organisational measures and OpenAI's certifications, such as SOC 2.
7. Assistance with your obligations. Check that the DPA commits OpenAI to assist with data subject requests, breach notification and DPIAs.
8. Deletion or return at the end. Check that the DPA requires the data to be deleted or returned on termination.

CompanyScope maintains a current OpenAI compliance profile that sets out the sub-processor list and DPA terms, which is useful as a second source when checking the version you accepted.

DPIAs written in 2025 may still refer to the preservation order made in the New York Times litigation, which required OpenAI to retain API and ChatGPT content that would otherwise have been deleted. OpenAI states that its obligations under that order ended on 26 September 2025 and that it has returned to its standard retention practices. It continues to hold a limited set of historical data from April to September 2025, which excludes data from the EEA, Switzerland and the UK. A DPIA that still treats the order as a current risk should be updated to reflect that position.

The templates. The £49 AI API GDPR Compliance Pack contains, as editable Word documents, a provider contract review checklist that sets OpenAI's processing terms beside Anthropic's and Google's and a data processing agreement for organisations that provide AI-enabled services to clients. It also contains a DPIA for an LLM API integration, a legitimate interests assessment and privacy notice wording. Provider positions are recorded as published on 4 October 2026.

What the DPA does not cover

The DPA sets out OpenAI's obligations as processor, which means the controller's obligations, where most of the compliance work lies, remain with you. Having the DPA in place does not provide:

• A DPIA, which assesses the risks of your processing before it begins. The DPIA guide for AI systems sets out the structure. If it has not been written yet, our DPIA tool drafts one with you in a conversation, free to complete.
• Data minimisation, because the decision about what personal data goes into each prompt is yours, and sending a complete customer record when the model needs only part of it breaches the principle.
• A privacy notice explaining that you use an AI processor, what it does and where the data is processed.
• A lawful basis for the processing, usually legitimate interests or performance of a contract.
• An automated decision-making assessment. Where an output is used to make a significant decision about a person by solely automated means, the safeguards in Articles 22A to 22D apply.
• A transfer record in your records of processing activities.

Summary

For most business customers the OpenAI DPA already applies through the Services Agreement. It is still worth executing it through the DPA page so that you hold a signed record, and then reviewing the eight areas above. Request Zero Data Retention if your data warrants it, record the sub-processors and the transfer mechanism, and complete the controller work that the DPA does not address. Together those steps allow you to evidence that your use of the OpenAI API complies with the GDPR.

---

Michael K. Onyekwere is a CIPP/E certified data protection professional at Janus Compliance. For a review of your DPA position, transfers, retention and DPIA, start with a £500 scoping review.

Checked on 3 October 2026, with the transfer provisions re-checked on 4 October 2026, against OpenAI's Data Processing Addendum (updated 1 December 2025, effective 1 January 2026), OpenAI's data controls documentation, OpenAI's statement on the New York Times preservation order, and the Data Privacy Framework register. This page is general information, not legal advice. Provider terms change, so verify OpenAI's current DPA, retention, sub-processors and certifications before relying on them. See also: Can I use the ChatGPT API and stay GDPR compliant?, the GDPR-compliant setup guide, OpenAI vs Anthropic vs Google.