Is ChatGPT GDPR Compliant? What Companies Must Know in 2026

In many companies ChatGPT has long been part of everyday work: drafting emails, shortening texts, preparing quotes, summarising research. It often starts with individual employees' private accounts, without data protection or IT knowing about it. As soon as names, customer data or internal documents end up in the prompt, the GDPR applies.

Whether that use is lawful is decided in three places. None of them sits with OpenAI alone.

OpenAI distinguishes between personal plans and plans for organisations. From a data protection perspective the difference is fundamental, not a question of features.

For Business, Enterprise, Edu and the API, OpenAI commits not to use inputs and outputs for training by default, and points to SOC 2 Type 2 audits and ISO/IEC 27001, 27017, 27018 and 27701 certifications. Those are good foundations. They do not replace the obligations that rest with the company itself.

Since February 2024, the contracting party for customers in the European Economic Area has been OpenAI Ireland Limited. For its business plans, OpenAI offers a data processing agreement, the Data Processing Addendum. The current version has applied since 1 January 2026.

A data processing agreement governs how OpenAI handles your data. It does not settle whether you may process the data with ChatGPT in the first place. For that you still need your own legal basis, in day-to-day business usually legitimate interest under Art. 6(1)(f) GDPR. And your privacy notice has to name OpenAI as a recipient and mention the transfer to the US.

Since 2025, business customers can have OpenAI store their content in Europe. For new Enterprise and Edu workspaces this can be selected; for Business it is being rolled out gradually and is not yet available to every account. With the API, processing in Europe can also be selected for supported endpoints.

Data residency is real progress. It does not solve every question.

How much the plan matters became clear in 2025 in a US copyright dispute. In May 2025 a New York court ordered OpenAI to preserve even deleted conversations. Free, Plus, Pro, Team and API customers without a zero data retention arrangement were affected. Enterprise and Edu were excluded. The obligation ended on 26 September 2025, and according to OpenAI, conversations from the EEA are excluded from any further retention. The case shows that storage questions also depend on proceedings outside the EU, and that the plan helps decide them.

According to OpenAI, deleted conversations are removed within 30 days unless a legal obligation prevents it. For your deletion policy, that means setting and documenting retention periods in ChatGPT deliberately.

The contract sets the framework. Whether day-to-day use is lawful is decided at the prompt. A simple traffic light helps more than a blanket ban.

Two features deserve particular attention: memory, which stores information beyond individual conversations, and connections to email, drives or calendars. Both expand the scope of data processed considerably and should only be enabled after review. And for every output: statements about people can be wrong. They have to be checked before use, because the GDPR requires personal data to be accurate.

In March 2026, a court in Rome annulled the €15 million fine the Italian data protection authority had imposed on OpenAI at the end of 2024. The reason was not the substance but jurisdiction: since OpenAI Ireland became its main establishment in the EU in February 2024, the Irish Data Protection Commission has been the lead authority. The court did not rule on the substantive allegations.

For companies in Germany, a different distinction matters more. The Irish authority supervises OpenAI. Your use of ChatGPT is supervised by the data protection authority of your federal state. Whether OpenAI itself gets everything right does not release you from your own obligations.

The German supervisory authorities summarised what they expect in their guidance on AI and data protection from May 2024, complemented by a checklist from the Hamburg data protection commissioner for chatbots based on large language models:

On impact assessments: the authorities' list of processing operations requiring a data protection impact assessment expressly includes the use of AI to steer interaction with data subjects or to evaluate personal aspects. A chatbot in customer contact or AI-assisted pre-selection of applicants typically falls under it. Rewording internal texts does not.

The GDPR changes planned in the Digital Omnibus do not change this for now. They are still being negotiated, and until they are concluded the GDPR applies unchanged.

Alongside the GDPR, the AI Act applies. A company using ChatGPT is the deployer of an AI system. Most obligations fall on OpenAI as the provider, but some fall on you.

ChatGPT therefore belongs in two registers: the AI inventory under the EU AI Act and, as soon as personal data is processed, the record of processing activities under Art. 30 GDPR.

The supervisory authorities recommend prohibiting private accounts and providing company licences. Under German employment law, that step has a consequence many people have not considered.

In January 2024, the Hamburg Labour Court ruled that the works council has no co-determination right when employees use ChatGPT voluntarily through private accounts (case no. 24 BVGa 1/24). The key reason: the usage data is generated at the provider, the employer has no access to it and therefore cannot monitor behaviour.

With company accounts the picture changes. Business plans come with an admin console through which the employer can manage accounts and usage and, depending on the plan, evaluate further log data. Under established case law, co-determination under section 87(1) no. 6 of the German Works Constitution Act applies as soon as software is objectively capable of monitoring. That strongly suggests it applies to company accounts. The Hamburg ruling was also issued in summary proceedings and at first instance.

ChatGPT can be used in a GDPR-compliant way. But not with the account someone set up privately two years ago, and not without a rule on what may go into the prompt.

The GDPR question is only part of the answer. The same tool is an AI system under the EU AI Act, a processing operation under the GDPR and a matter for the works council. Handling these three perspectives separately means doing the work three times. Bringing them together in one place means doing it once.

This article is for general information only and does not constitute legal advice. Information on OpenAI's plans and features is based on the provider's own publications and may change. Last updated: 5 October 2026.