OpenAI and GDPR: What EU Companies Actually Need to Know

Still choosing a provider? Our comparison of GDPR-compliant LLM APIs sets OpenAI against Azure OpenAI, Amazon Bedrock, Google Vertex AI, Mistral and four EU clouds.

This guide cuts through the marketing language and explains exactly what OpenAI's GDPR measures cover, what they do not cover, what the CLOUD Act means for EU companies, and what you need to do yourself regardless of what OpenAI offers.

The two completely different products

The first thing to understand is that “OpenAI” is not one product with one compliance posture. There are two fundamentally different products with different GDPR implications.

Consumer ChatGPT (chatgpt.com)

Using the free consumer ChatGPT for business purposes is risky and likely non-compliant. User conversations may be stored and used for model training, there is no Data Processing Agreement available, and you have no control over data residency or retention.

If your employees are pasting customer data, patient records, employee information, or financial data into chatgpt.com as part of their work — even to help them draft emails or summarise documents — you are almost certainly in breach of GDPR. There is no DPA, so OpenAI is not acting as your processor under Article 28. You are disclosing personal data to a third party that sets its own purposes, which needs a lawful basis you almost certainly do not have.

This is not theoretical. In December 2024, Italy's data protection authority announced a €15 million fine against OpenAI for GDPR violations related to consumer ChatGPT, identifying training data without lawful basis as the primary breach, alongside failure to notify a data breach and inadequate age verification. The Court of Rome annulled the fine in March 2026, but the findings show exactly where regulators look.

OpenAI API

The API is a different matter. With the correct configuration, using the OpenAI API can be made GDPR compliant for many use cases. The key word is “configuration” — the defaults are not compliant without additional steps.

What OpenAI now offers for EU compliance

OpenAI has taken meaningful steps toward GDPR compliance following European regulatory pressure. Here is what is available as of 2026.

Data Processing Agreement (DPA)

Under Article 28 GDPR, any time you use a third party to process personal data on your behalf, you need a written contract — a Data Processing Agreement. OpenAI's Data Processing Addendum covers the API, ChatGPT Business and ChatGPT Enterprise. It is incorporated into the OpenAI Services Agreement, so it applies once you accept those terms. If your company is based in the EEA or Switzerland, your contracting party is OpenAI Ireland Ltd, not the US entity.

The DPA is not a lawful basis — it covers the processor relationship only. What it does and does not commit OpenAI to is covered in detail below.

Zero data retention

By default, OpenAI keeps abuse monitoring logs of API inputs and outputs for up to 30 days, but does NOT use API data for model training. Zero Data Retention (ZDR) and the lighter Modified Abuse Monitoring remove your content from those logs.

Neither is a self-serve setting. Both require prior approval from OpenAI: you contact OpenAI's sales team and ask whether your organisation is eligible. Once approved, a Data Retention tab appears under Settings → Organization → Data controls, where you configure retention for the whole organisation or per project.

ZDR covers the core inference endpoints, including Chat Completions, Responses, Embeddings, image generation and audio. Endpoints that store state by design are not eligible: Assistants, Threads, Conversations, Files, Vector Stores, Batch, Fine-tuning and Evals. If your feature relies on them, your data is stored at OpenAI regardless.

With ZDR on eligible endpoints, your data passes through OpenAI's systems and is not kept in its logs, apart from legal and safety exceptions. This significantly reduces — but does not eliminate — GDPR exposure. What those exceptions are, and how to apply for ZDR together with EU data residency, is covered step by step in our guide to OpenAI Zero Data Retention and EU data residency.

European data residency

In February 2025, OpenAI introduced data residency in Europe for ChatGPT Enterprise, ChatGPT Edu, and the API Platform. The Europe region covers the EEA and Switzerland. Customer content is stored at rest in the region, and eligible endpoints are also processed there.

It is also not self-serve. To use any region other than the US, you must first be approved for the retention controls above and sign a Modified Retention amendment. Approval comes first; configuration comes after:

• —Create a new Project in the API Platform dashboard and select Europe as the region. The region is chosen when the project is created.
• —Send that project's requests to https://eu.api.openai.com/v1 instead of the default api.openai.com.
• —Expect a 10% price uplift on data residency endpoints for models released on or after 5 March 2026.

Two limits matter for GDPR. Residency does not apply to system data (account details, usage metrics, billing, support requests), which may be stored outside the EU. And Assistants, Threads, Conversations and Vector Stores do not support regional processing.

Source: OpenAI's data controls documentation. Check it before you configure anything, because eligibility and endpoint lists change.

What zero retention means for logging

Zero retention at OpenAI means OpenAI does not keep your prompts and responses. It does not mean you should not keep them. If your AI system is high-risk under the EU AI Act, Article 12 requires you to maintain your own tamper-evident logs for at least six months.

Those logs would contain the same personal data as your prompts. To keep it out of them, redact personal data before storing conversations — inside your own infrastructure, before anything is written to disk.

The six things you must do to use OpenAI's API compliantly

OpenAI's DPA: what it covers, SCCs and Article 28

This section is for legal and procurement teams. It is based on version v.010126 of OpenAI's Data Processing Addendum; section numbers refer to that document.

Who you contract with

Customers based in the EEA or Switzerland contract with OpenAI Ireland Ltd. Everyone else contracts with OpenAI OpCo, LLC in the US. UK data is processed by OpenAI OpCo, LLC under the EU Standard Contractual Clauses with the UK Addendum (Module 2 where you are the controller, Module 3 where you are a processor), governed by the law of England and Wales.

How transfers to the US are covered

Because EEA customers contract with an Irish entity, you do not sign SCCs with OpenAI yourself. The transfer happens one step later: when OpenAI Ireland passes your data to OpenAI affiliates or third parties outside the EEA, it relies on SCCs or an EU adequacy decision under Article 45 GDPR, such as the EU-US Data Privacy Framework for certified recipients (section 4.1).

That has two consequences. You cannot see those onward-transfer agreements. And you remain responsible, as controller, for understanding the transfer — so document it in your transfer impact assessment and DPIA. Neither SCCs nor the Data Privacy Framework changes the CLOUD Act position described in the next section.

Article 28(3) checklist

Article 28(3) GDPR lists what a processor contract must contain. Here is where OpenAI's DPA addresses each point:

Three clauses to read closely

• —Government access (2.2).OpenAI will tell you about a legally binding disclosure request from law enforcement only “to the extent legally permitted”. There is no commitment to challenge such requests. This is where CLOUD Act risk shows up in the contract.
• —Sensitive data (Schedule 1).The DPA states that “no sensitive data is intended to be transferred unless the user includes it unexpectedly in unstructured data.” If you process special category data under Article 9 — health data in a healthcare product, for example — the DPA's description of the processing does not match yours. Raise it with OpenAI and address it in your DPIA.
• —Your configuration (3.3). You are responsible for configuration choices such as retention periods and deletion. Zero data retention and EU residency are on you to request and set up.

The CLOUD Act: the gap OpenAI cannot close

This is the most important section for EU companies that have been told “EU data residency solves our compliance problem.”

It does not. Not completely.

What the CLOUD Act is

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) is a US federal law that allows US law enforcement to compel American companies to provide access to data stored anywhere in the world — including on servers physically located in the European Union.

The legal jurisdiction follows the company, not the data centre. Selecting “EU region” in AWS, Azure, Google Cloud, or OpenAI does NOT guarantee sovereignty if the provider is US-headquartered.

What this means for OpenAI specifically

OpenAI is a US company. Its European data residency means your data is processed on servers physically located in Europe. But OpenAI remains subject to US jurisdiction. Under the CLOUD Act, US authorities can compel OpenAI to produce data stored in those EU servers.

Standard Contractual Clauses — which OpenAI's DPA relies on — reduce the legal risk of cross-border transfers but do not eliminate CLOUD Act exposure. The legal challenges to SCC-based transfers with US providers — so-called “Schrems III” litigation — are expected to intensify.

The sovereignty gap

For many EU companies, this gap is an acceptable residual risk — they sign the DPA, enable EU data residency and zero retention, document the CLOUD Act risk in their DPIA, and proceed.

For companies in regulated sectors — banking, healthcare, government — the CLOUD Act gap is not acceptable. These organisations need providers with no US parent company, operating EU-only infrastructure with no US legal exposure.

Where your AI compliance logs must live

Even if you use OpenAI with EU data residency and zero retention for inference, the logs you maintain for Article 12 compliance must not rely on OpenAI's infrastructure.

Your Article 12 logs are your evidence. They must be on infrastructure you control or, if outsourced, with a provider that has no US parent and keeps the data in the EU — so it is not subject to CLOUD Act compulsion.

The ongoing regulatory scrutiny of OpenAI in the EU

OpenAI's compliance situation in Europe is active, not settled.

Italy's €15 million fine

In December 2024, Italy's data protection authority announced a €15 million fine against OpenAI for GDPR violations related to consumer ChatGPT. The Italian DPA identified training data without lawful basis as the primary breach, alongside failure to notify a March 2023 breach involving user data and inadequate age verification. OpenAI challenged the sanction, and on 18 March 2026 the Court of Rome annulled it. The court's full reasoning was not public at the time, and the Garante may still appeal.

The annulment does not make the underlying questions go away. Lawful basis for training data, transparency and age verification remain the issues European regulators keep returning to.

EDPB task force

The European Data Protection Board has established a cross-border task force on ChatGPT involving multiple national data protection authorities. Civil society groups plan additional complaints in 2026. The enforcement trajectory is toward increased scrutiny, not reduced.

The hallucination problem

The EDPB Opinion 28/2024 addressed concerns that LLMs generate false personal data about real individuals — so-called hallucinations. The Board stated that anonymisation of training data must be proven, not assumed. This creates a continuing legal question about whether LLMs trained on personal data can ever fully satisfy GDPR's requirements — an issue OpenAI has not resolved and cannot resolve through configuration alone.

OpenAI vs EU-incorporated LLM providers

For EU companies in regulated sectors, EU-incorporated LLM providers eliminate the CLOUD Act problem entirely.

Mistral AI is incorporated in France, operates EU infrastructure, and is not subject to the CLOUD Act. For companies where the CLOUD Act gap is not acceptable, Mistral is the most capable EU-sovereign alternative. EU cloud providers such as IONOS, STACKIT, OVHcloud and Scaleway also serve open-weight models through OpenAI-compatible APIs without storing prompts.

The complete compliance picture for OpenAI API users

If you are an EU company using the OpenAI API and want to be as compliant as possible:

Practical implementation: routing OpenAI calls through EU

import openai
import os
import time

# API key from a Project created with Europe as its region
# (requires prior approval from OpenAI). EU-region projects
# must send requests to the EU domain, not api.openai.com.
eu_client = openai.OpenAI(
    api_key=os.environ["OPENAI_EU_PROJECT_API_KEY"],
    base_url="https://eu.api.openai.com/v1",
)

def call_openai_eu_compliant(prompt: str, system_id: str) -> str:
    """
    Makes an OpenAI call through EU data residency.
    Logs to EU-hosted compliance infrastructure.
    PII scrubbed before logging.
    """
    start = time.time()

    # Call OpenAI through EU-region project
    response = eu_client.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": prompt}]
    )

    latency_ms = (time.time() - start) * 1000
    content = response.choices[0].message.content

    # Log to EU-hosted compliance logging independently of OpenAI.
    # This is YOUR responsibility — OpenAI cannot do this for you.
    compliance_logger.log(
        prompt=prompt,           # PII scrubbed inside logger
        response=content,        # PII scrubbed inside logger
        model=response.model,
        usage={
            "prompt_tokens": response.usage.prompt_tokens,
            "completion_tokens": response.usage.completion_tokens,
            "total_tokens": response.usage.total_tokens,
        },
        latency_ms=latency_ms,
        finish_reason=response.choices[0].finish_reason
    )

    return content

Frequently asked questions

Summary

The compliance picture for OpenAI in the EU is meaningfully better than it was two years ago. It is not fully settled. Treat it as an acceptable risk with proper documentation, not as a solved problem.