OpenAI's enterprise privacy framework includes disclosure of the third-party subprocessors it uses to deliver ChatGPT Enterprise and API services, allowing enterprise customers to assess the data sharing chain.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Interpretive note: The subprocessor disclosure provision is inferred from the document's enterprise privacy scope; the specific mechanism and notification requirements were not available in the provided HTML.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This provision addressing subprocessor transparency was removed entirely from the current policy, potentially weakening disclosure commitments around third-party processing.
View full change record →Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
How other platforms handle this
To opt out of the offline disclosure of your information to third parties for these purposes, please email us at privacy@makenotion.com.
We may provide an option for users to opt into the disclosure of their demographic data in a manner and to an extent that may lead to loss of their anonymity.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) and (4) require that subprocessors be subject to the same data protection obligations as the primary processor, and that the controller be informed of and able to object to …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.