ChatGPT and data protection at work: what does the GDPR require?

May a company use ChatGPT under the GDPR?

Yes, the GDPR bans no particular program. It governs how your company processes personal data, meaning any information about an identified or identifiable person (Art. 4(1) GDPR).

Such data gets into ChatGPT easily: a customer email to rephrase, a list of names, your staff's accounts with OpenAI. An answer can contain personal data even when the question did not, as Germany's data protection authorities (DSK) note in their AI guidance (para. 52).

Every step in which ChatGPT processes personal data needs a legal basis under Art. 6(1) GDPR. Health data and the other special categories are also covered by Art. 9.

Art. 4(1) · Art. 6(1) · Art. 9(1) GDPR

Which ChatGPT plan is meant for company data?

OpenAI names the plans Free, Go, Plus, Pro, Business, Edu and Enterprise. For Business, Enterprise and Edu workspaces, OpenAI's admin documentation says the data is encrypted in transit and at rest and is not used to train OpenAI models by default (as of October 2026).

For the API, through which your own software calls OpenAI's models directly, OpenAI writes that since 1 March 2023 data sent to the API is not used for training unless you explicitly opt in. Abuse monitoring logs, which can contain prompts and responses, are kept for up to 30 days by default.

For Free, Go, Plus and Pro, the training rules sit on OpenAI pages we could not open on 16 October 2026. The DSK advises providing work accounts and devices for professional use in any case, so nobody has to work with a private account (para. 41).

Do you need a DPA with OpenAI?

If OpenAI processes personal data on your behalf, it is your processor (Art. 4(8) GDPR). You then need a contract under Art. 28(3), usually called a DPA, which may be concluded electronically (Art. 28(9)). For cloud AI, the DSK often sees exactly this relationship (para. 32).

Among other things, the contract states that OpenAI processes only on your documented instructions (Art. 28(3)(a)). A processor that infringes the GDPR by deciding purposes and means itself is treated as a controller for that processing (Art. 28(10)). That is why the training question belongs in the check.

On its trust portal OpenAI writes that it can sign a DPA with customers, and points to a form for this and to its Data Processing Addendum under openai.com/policies. We could not read the text: openai.com refused us access on 16 and 17 October 2026. Check what it settles and which plans it covers in your contract with OpenAI.

Art. 4(8) · Art. 28(3), (9) and (10) GDPR

What applies when the data leaves the EU?

A transfer to a country outside the EU is allowed only under the conditions of Art. 44 onwards, for example with a Commission adequacy decision (Art. 45) or the Commission's standard data protection clauses (Art. 46(2)(c)), usually called standard contractual clauses.

For the API, OpenAI offers a region “Europe (EEA + Switzerland)” for storage and processing, subject to OpenAI's approval and excluding system data such as account and billing data. For ChatGPT, OpenAI says data residency depends on the agreement, region and configuration; we could not open its help page on this.

Which safeguard OpenAI relies on for transfers we could not check. Ask for it. The third country goes into your record of processing activities (Art. 30(1)(e)), the safeguard into your privacy notice (Art. 13(1)(f)).

Art. 44 · Art. 45(1) · Art. 46(2)(c) · Art. 13(1)(f) · Art. 30(1)(e) GDPR

An example, and what often goes wrong

Kemper Lohse GmbH, a made-up maker of conveyor belts, wants to use ChatGPT in sales. It sets up a Business workspace and puts in writing: quotes and product texts yes, applications and personnel files no.

It then adds OpenAI as a recipient to its record of processing activities, together with the transfer and the third country (Art. 30(1)(d) and (e)). Its privacy notice for customers names the recipients and the safeguard for the transfer (Art. 13(1)(e) and (f)).

Common mistakes: staff keep using private accounts. Names are deleted as if that made the text anonymous; the DSK considers that usually insufficient, because the context can give the person away (para. 49). And an AI that evaluates applications and sends the invitations itself infringes Art. 22(1), according to the DSK (para. 13).

Art. 13(1)(e) and (f) · Art. 22(1) · Art. 30(1) GDPR

With an AI assistant

An assistant such as ChatGPT or Claude can prepare this check. It compares a contract you hold with Art. 28(3), drafts an entry for your record and words a usage rule for staff.

Which plan, which data is allowed and whether the contract fits is decided by your company as controller (Art. 5(2)). Give the assistant contracts and policies for this, not personnel data, because its provider processes whatever it reads.

A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough. Through that server an AI assistant already enters information into the NIS 2 walkthrough today, with the rights of the person who connected it.