ChatGPT and data privacy: what companies really need to check.
Whether ChatGPT can be used at work in line with data protection law depends less on the tool than on the plan, the contract, the settings and the rules for your team. This guide shows what happens to your inputs, which privacy settings to use and what your data protection officer will check.
As of 5 November 2026 · sources: OpenAI · not legal advice
Key points
- On
personal plans (Free, Go, Plus, Pro), chats can be used for training until you turn it off. These plans are not meant for company data: no DPA, no central administration. Business, Enterprise and Edu do not use your data for training by default, according to OpenAI, and OpenAI offers a data processing agreement.- GDPR responsibility stays with you: legal basis, transfers to the US, informing the people concerned and often a data protection impact assessment.
- The most effective step is a simple
traffic-light rule for which data may go into which tool. For personal and confidential data, your own AI platform in Germany or on your servers is the obvious choice.
Is ChatGPT GDPR-compliant? The honest answer.
The question “Is ChatGPT GDPR-compliant?” has no yes-or-no answer. The GDPR obliges your company as the controller, not the tool. An AI service can only be used in line with data protection law if the contract, settings and rules are right.
German data protection authorities published guidance on AI and data protection in 2024. Its key points: define the purpose, do not enter personal data without a legal basis, rule out training on inputs, train staff and set binding rules.
| Plan | Training on inputs | DPA | Administration | EU data residency |
|---|---|---|---|---|
| Free, Go, Plus, Pro (personal) | possible, can be turned off | no | none central | no |
| Business | not by default | yes | workspace, roles, SSO | not named by OpenAI |
| Enterprise, Edu | not by default | yes | + SSO, retention controls | yes, for new workspaces; storage and GPU inference in Europe available |
| API | not by default | yes | projects, keys | yes, for new projects |
Sources: OpenAI, “Business data privacy, security, and compliance” and “Data Controls FAQ” (retrieved 30 October 2026); OpenAI, “Introducing data residency in Europe” (updated 16 January 2026).
ChatGPT privacy settings: the four you should know.
If you use ChatGPT on a personal account or in a trial, you can change a few things yourself. Settings do not replace a contract, but they limit what happens to your inputs.
Turn off training
Profile picture › Settings › Data Controls › turn off “Improve the model for everyone”. Applies to the account and to new chats.
Use temporary chat
Temporary chats do not appear in history, are not used for training and, according to OpenAI, are deleted within 30 days.
Check memory
With memory, ChatGPT keeps details about you. Turn it off or delete stored memories.
Delete shared links
Shared chats can be read by anyone with the link. Check regularly which links are still active.
Court preservation orders can delay deletion: because of a US lawsuit, OpenAI had to keep even deleted chats for a time in 2025; the duty ended for new data on 26 September 2025, with exceptions.
Which data may go into ChatGPT: the traffic-light rule.
Most data protection problems come not from the provider but from what people type in. A traffic-light rule is quick to explain and fits on one page of your AI usage policy.
| Light | Examples | Rule |
|---|---|---|
| Green | Public information, general texts, ideas with no company link | Allowed in any approved tool |
| Amber | Internal, non-personal content: drafts, process descriptions, code without secrets | Only on a company plan with a DPA, never a personal account |
| Red | Personal data, customer and HR data, health data, trade secrets, credentials | Only after review by data protection, preferably in your own platform in Germany or on your servers |
What your data protection officer checks for ChatGPT.
Before ChatGPT is approved for company use, data protection reviews these points. Plan time for this, because they depend on your purpose, not only on the provider.
Data processing agreement
OpenAI offers a DPA for Business, Enterprise, Edu and the API. Check the contracting entity, instructions, sub-processors and deletion.
The contracting party in the EEA is OpenAI Ireland, a subsidiary of the US group. Check the basis for the transfer and possible access by US authorities.
The CLOUD Act →Legal basis and notice
Every processing of personal data needs a legal basis, and the people concerned, including staff, must be informed.
A DPIA is required when the risk is likely to be high. That is often the case with new AI services.
DPIA template →Using ChatGPT under the GDPR: what you have to arrange yourself.
No plan makes using ChatGPT GDPR-compliant on its own. Use becomes defensible when your company arranges the following six points itself and puts them in writing. You need these records anyway: under Art. 5(2) GDPR you must be able to demonstrate that you comply with the principles.
The list complements the review by your data protection officer; it does not replace it.
| Point | What you arrange | What you document |
|---|---|---|
| Company plan with a DPA | Business, Enterprise or Edu instead of personal accounts. OpenAI says it supports customers in signing a Data Processing Addendum. | Signed DPA, contracting entity, sub-processors, basis for transfers out of the EEA |
| Personal data only with a legal basis | Names, customer, HR or health data belong in prompts only if there is a legal basis for that purpose under Art. 6 GDPR, plus Art. 9 for special categories. Otherwise anonymise or leave them out. | Purpose and legal basis in the record of processing activities, notice to the people concerned |
| Rule out training | According to OpenAI, it does not train on your organisation’s data by default on company plans. On personal accounts, each person has to turn off “Improve the model for everyone” themselves, which is one more reason they are unsuitable for company data. | State of the admin settings with the date checked |
| Retention and deletion | Decide how long chats and uploaded files are kept. According to OpenAI, qualifying organisations can configure how long it retains business data; temporary chats are deleted within 30 days. | Period in the deletion concept, who owns the setting |
| Usage policy for staff | Which data may go into which tool (see the traffic-light rule), who gets access and how results are checked. The free AI usage policy template creates a draft. | Notice to all staff, training records |
| Involve the works council | If the tool can monitor staff behaviour or performance, for example through histories and logs, an existing works council usually has a co-determination right (Section 87(1) No. 6 of the German Works Constitution Act). The AI works agreement template gives you a draft. | Works agreement or documented consent |
OpenAI details per OpenAI, “Business data privacy, security, and compliance” and “Data Controls FAQ” (retrieved 5 November 2026) and “Data Processing Addendum” (updated 1 December 2025, effective 1 January 2026). Not legal advice: your data protection officer makes the case-by-case assessment.
Check AI use against the GDPR →ChatGPT alternative from Germany →Personal data in AI systems →AI and data protection at work →
For confidential data: your own AI platform.
For the red category, meaning customer, HR and contract data, a public AI chat is rarely the right choice. With RAGSuite your team asks questions just like in ChatGPT but gets answers from your own documents, with a source to check.
You run RAGSuite in the RAGSuite Engine with a data centre in Germany and a DPA with us, or free as the Community Edition on your servers. RAGSuite does not train any model on your data. You choose which language model answers, including a local one; with an external model provider, that provider’s terms also apply.
Before you approve ChatGPT for your company.
Tick what is done. Nothing is stored.
Questions about ChatGPT and data privacy.
Is ChatGPT GDPR-compliant?
There is no blanket answer. Your company is responsible under the GDPR, not the tool. What matters is the plan, a data processing agreement, the legal basis, transfers to the US, information duties and clear rules on what data may be entered. Personal plans are not meant for company data.
Can ChatGPT be used in line with the GDPR?
Defensible use is possible, but it is not automatic and not a feature of the plan. You need a company plan with a DPA, enter personal data only with a legal basis, rule out training on your data, set retention periods, give staff a usage policy and involve the works council if you have one. Responsibility stays with your company.
Does OpenAI train on my inputs?
Not by default in Business, Enterprise, Edu and the API, according to OpenAI. On personal plans, chats can be used for training until you turn off “Improve the model for everyone” under Settings › Data Controls.
How do I turn off training in ChatGPT?
On the web: profile picture › Settings › Data Controls › turn off “Improve the model for everyone”. In the apps, the same setting is in the menu. It applies to the account and to new chats.
Is there a DPA with OpenAI?
Yes. OpenAI offers a Data Processing Addendum for Business, Enterprise, Edu and the API. There is none for personal plans. Check the contracting entity, sub-processors and the basis for transfers to the US in the agreement.
Is ChatGPT data stored in Europe?
OpenAI offers data residency in Europe for new ChatGPT Enterprise and Edu workspaces and for API projects. Since January 2026, eligible Enterprise and Edu customers can also choose in-region GPU inference in Europe; according to OpenAI, authentication, routing and other processing may still happen outside the region. OpenAI currently names no data residency for ChatGPT Business. The contracting party in the EEA is OpenAI Ireland, a subsidiary of the US group, so US law can still play a role.
May staff use ChatGPT with private accounts?
For company data, you should rule it out. Private accounts have no DPA and no central administration. It is better to provide an approved tool with a clear usage policy; otherwise you get shadow AI.
When do I need a DPIA?
When the processing is likely to pose a high risk to people, for example with large amounts of personal data, sensitive data or decisions about people. That is common with new AI services. Your data protection officer decides.
AI for confidential data, run in Germany.
Jürgen shows you how your team works with its own documents, without private AI accounts and without training on your data.