The document states that stored conversations may be accessed by authorized OpenAI employees for engineering support, abuse investigation, and legal compliance, and by third-party contractors bound by confidentiality obligations solely for abuse and misuse review.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision defines the conditions under which human access to stored business conversation data is permitted, identifying three purposes for employee access and one purpose for contractor access, with contractor access described as subject to confidentiality and security obligations.
Interpretive note: The document does not specify the number of authorized individuals, the technical controls limiting access, notification procedures, or the retention period for access logs, creating ambiguity relevant to GDPR Article 28 and HIPAA compliance assessments.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision explicitly discloses internal and third-party human access to stored conversations, establishing clear limitations and purposes for such access.
View full change record →Under this provision, stored conversations in ChatGPT Business, ChatGPT for Teachers, and API contexts may be accessed by authorized employees and third-party contractors under the stated conditions. The agreement does not specify in this document the number of authorized individuals, the technical controls limiting access, or the notification mechanisms if access occurs.
Cross-platform context
See how other platforms handle Authorized Employee and Contractor Access to Stored Conversations and similar clauses.
Compare across platforms →"Our access to conversations stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages GDPR data minimization and access limitation principles, particularly where third-party contractors constitute sub-processors requiring disclosure and contractual safeguards under GDPR Article 28.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision defines the conditions under which human access to stored business conversation data is permitted, identifying three purposes for employee access and one purpose for contractor access, with contractor access described as subject to confidentiality and security obligations.
Under this provision, stored conversations in ChatGPT Business, ChatGPT for Teachers, and API contexts may be accessed by authorized employees and third-party contractors under the stated conditions. The agreement does not specify in this document the number of authorized individuals, the technical controls limiting access, or the notification mechanisms if access occurs.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.