Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that stored conversations may be accessed by authorized OpenAI employees for engineering support, abuse investigation, and legal compliance, and by third-party contractors bound by confidentiality obligations solely for abuse and misuse review.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision defines the conditions under which human access to stored business conversation data is permitted, identifying three purposes for employee access and one purpose for contractor access, with contractor access described as subject to confidentiality and security obligations.
Interpretive note: The document does not specify the number of authorized individuals, the technical controls limiting access, notification procedures, or the retention period for access logs, creating ambiguity relevant to GDPR Article 28 and HIPAA compliance assessments.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision explicitly discloses internal and third-party human access to stored conversations, establishing clear limitations and purposes for such access.
View full change record →Under this provision, stored conversations in ChatGPT Business, ChatGPT for Teachers, and API contexts may be accessed by authorized employees and third-party contractors under the stated conditions. The agreement does not specify in this document the number of authorized individuals, the technical controls limiting access, or the notification mechanisms if access occurs.
Cross-platform context
See how other platforms handle Authorized Employee and Contractor Access to Stored Conversations and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Our access to conversations stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages GDPR data minimization and access limitation principles, particularly where third-party contractors constitute sub-processors requiring disclosure and contractual safeguards under GDPR Article 28. For ChatGPT for Healthcare and API users executing BAAs, HIPAA minimum necessary access standards apply to any human access to data that may contain PHI. The FTC has general authority over representations about data access practices. (2) GOVERNANCE EXPOSURE: Medium. The provision identifies three purposes for employee access but does not define what constitutes an authorized employee, what access logging or auditing controls are in place, or how long accessed data records are retained following an access event. Contractor access for abuse review represents a sub-processor relationship requiring contractual documentation under GDPR. (3) JURISDICTION FLAGS: EU and EEA customers face heightened exposure because GDPR Article 28 requires that sub-processors be identified or identifiable and that data processing agreements cover sub-processor obligations. Healthcare organizations using the API under a BAA should assess whether contractor access for abuse review is consistent with BAA terms and HIPAA minimum necessary standards. California organizations should assess CPRA service provider obligations relative to contractor access. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that executed DPAs identify or categorize the third-party contractors as sub-processors and include the required contractual safeguards. BAA agreements for healthcare use should be reviewed to confirm that contractor access is addressed and consistent with HIPAA Business Associate obligations. Vendor assessments should request documentation of technical access controls and access logging practices. (5) COMPLIANCE CONSIDERATIONS: Organizations should update their vendor risk management documentation to reflect authorized human access as a disclosed processing activity. Data subject access requests under GDPR or CPRA that involve conversation data may need to account for this access pathway in response procedures. Incident response plans should address scenarios in which employee or contractor access results in unauthorized disclosure.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision defines the conditions under which human access to stored business conversation data is permitted, identifying three purposes for employee access and one purpose for contractor access, with contractor access described as subject to confidentiality and security obligations.
Under this provision, stored conversations in ChatGPT Business, ChatGPT for Teachers, and API contexts may be accessed by authorized employees and third-party contractors under the stated conditions. The agreement does not specify in this document the number of authorized individuals, the technical controls limiting access, or the notification mechanisms if access occurs.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.