OpenAI Zero Data Retention and EU Data Residency: How to Get Them

The two are linked more tightly than most guides suggest: OpenAI requires an approved abuse monitoring control before it will let you use any region other than the United States. So for an EU company, the practical question is not “which one” but “how do I get both, and what is left once I have them”. For the wider picture of using OpenAI under GDPR, see our OpenAI and GDPR guide.

What OpenAI keeps by default

Without any special arrangement, OpenAI keeps abuse monitoring logs of API inputs and outputs for up to 30 days, “unless longer retention is required by law”. API data is not used to train OpenAI's models unless you opt in. Separately, some endpoints keep application state until you delete it: files, vector stores, batches, fine-tuning jobs, and conversations among them. The Responses API keeps application state for 30 days by default.

Zero Data Retention and Modified Abuse Monitoring

OpenAI offers two controls that take your content out of those abuse monitoring logs:

In OpenAI's words, these controls “are subject to prior approval by OpenAI and acceptance of additional requirements”. There is no toggle in the dashboard until you have been approved.

What OpenAI can still keep with Zero Data Retention

• —Anything it is legally required to keep, or that is reasonably necessary to protect its services or third parties from harm.
• —Images flagged by its CSAM scanning, which are retained for manual review even with Zero Data Retention enabled.
• —Content flagged under Safety Retention, for customers approved for ZDR or Modified Abuse Monitoring, where reasonably necessary to investigate or prevent severe risk.
• —Data on endpoints that are not ZDR-eligible, which keep application state regardless.

Which endpoints are eligible

EU data residency

OpenAI's Europe region covers the EEA and Switzerland. For supported endpoints, customer content is stored at rest in the region and inference runs there too. Other regions, including the United Kingdom, currently offer storage at rest only; in-region processing is listed only for the United States, Europe and the UAE.

The conditions

• —Eligibility is decided by OpenAI's sales team; it is not open to every account.
• —You must be approved for one of four retention controls: Zero Data Retention, Modified Abuse Monitoring, Private Retention with Private Safety Processing, or Safety Retention.
• —Residency is chosen when you create a project. Existing projects cannot be moved to Europe.
• —Eligible models released on or after 5 March 2026 cost 10% more on data residency endpoints.

What it does not cover

• —System data: account details, metadata, usage and billing data can be stored outside the EU.
• —Files and Vector Stores are stored in the region, but not processed there.
• —store=true cannot be set for Chat Completions outside the US.
• —Tracing for Realtime is not covered, and image inputs need an enhanced retention approval.
• —Third-party tools and MCP servers you connect are outside OpenAI's residency commitment.

On the ChatGPT side, European data residency is offered for eligible ChatGPT Enterprise and Edu workspaces. ChatGPT Business does not include it.

How to get both, step by step

1. Accept the DPA first. It is incorporated into the OpenAI Services Agreement; EEA and Swiss customers contract with OpenAI Ireland Ltd.
2. Contact OpenAI sales with the specifics they need to judge eligibility: what the system does, the categories of personal data involved, expected volume, and which endpoints you call. Ask for Zero Data Retention (or Modified Abuse Monitoring) and EU data residency in the same request.
3. Turn the control on once approved, under Settings → Organization → Data controls → Data Retention, for the whole organization or per project.
4. Create a new projectand select Europe as its region. Then send that project's requests to https://eu.api.openai.com/v1.
5. Verify that every endpoint your app uses is both ZDR-eligible and supported in the Europe region, and that nothing still calls the global base URL.

from openai import OpenAI

client = OpenAI(
    api_key=EU_PROJECT_KEY,                  # key from the Europe-region project
    base_url="https://eu.api.openai.com/v1",
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": prompt}],
    store=False,   # forced to False anyway once ZDR is enabled
)

What neither control solves

The CLOUD Act. OpenAI is a US company. An EU region controls where data is stored and processed, not who can be ordered to hand it over. Record the residual risk in your transfer impact assessment and DPIA, or use a provider with no US parent for the most sensitive workloads; our comparison of GDPR-compliant LLM APIs lists them.

Your own records. With Zero Data Retention, OpenAI keeps nothing you could later rely on as evidence of what your AI system did. If the system is high-risk under the EU AI Act, you must keep automatic logs yourself for at least six months; see our Article 12 guide and how to log LLM calls under GDPR.

Frequently asked questions

Sources

OpenAI changes these terms often. Check the current documentation before you apply or configure anything.

• OpenAI — Data controls in the OpenAI platform
• OpenAI — Data Processing Addendum
• OpenAI — Sub-processors