Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that OpenAI offers a Data Processing Addendum for customers using ChatGPT Business, ChatGPT Enterprise, and the API, available through a DPA form, to support GDPR compliance.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that GDPR-compliant data processing terms are available upon request rather than automatically incorporated into the service agreement, requiring EU and EEA customers to proactively execute a DPA to establish GDPR Article 28 compliant controller-processor terms.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →Current version specifies DPA availability for three specific products (ChatGPT Business, ChatGPT Enterprise, API), references other privacy laws beyond GDPR, and provides a process link to request execution.
View full change record →Under this provision, GDPR compliance support through a Data Processing Addendum requires active completion of a DPA form by the customer. The document does not specify whether the DPA covers ChatGPT for Healthcare, ChatGPT Edu, or ChatGPT for Teachers under the same mechanism, referencing a Student Data Privacy Agreement separately for those products.
Cross-platform context
See how other platforms handle GDPR Data Processing Addendum Availability and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Yes, we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API in support of their compliance with GDPR and other privacy laws. Please complete our DPA form to execute a DPA with OpenAI.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28, which requires that processing by a processor on behalf of a controller be governed by a binding contract. The Irish Data Protection Commission is the lead supervisory authority for OpenAI's EU operations. Customers who have not executed a DPA and are processing personal data of EU or EEA residents through covered services may lack the contractual safeguards required by GDPR Article 28. (2) GOVERNANCE EXPOSURE: High for EU and EEA customers who have not yet executed a DPA. Operating covered services involving EU personal data without an executed DPA creates direct GDPR Article 28 non-compliance exposure. The document indicates DPA coverage applies to ChatGPT Business, ChatGPT Enterprise, and the API, but references a separate Student Data Privacy Agreement for Edu and Teachers, requiring separate assessment for those deployments. (3) JURISDICTION FLAGS: All EU and EEA customers are directly affected. UK customers should assess whether a UK-specific data processing addendum or UK GDPR-compliant terms are available or required. Swiss customers should assess Swiss Data Protection Act applicability. Non-EU customers using OpenAI on behalf of EU data subjects should also assess DPA execution requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm DPA execution status as a prerequisite for deploying covered services involving personal data of EU or EEA residents. Legal teams should review the DPA terms for consistency with organizational data processing records and sub-processor disclosure obligations. The document does not reproduce DPA terms within this document, requiring separate review of the DPA instrument itself. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain records of DPA execution dates and ensure that the product tiers covered by any executed DPA match the organization's actual service usage. Organizations that have deployed ChatGPT Edu or ChatGPT for Teachers should ensure the Student Data Privacy Agreement has been executed separately. DPA review should be triggered whenever new product tiers or API capabilities are added to the organization's OpenAI deployment.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that GDPR-compliant data processing terms are available upon request rather than automatically incorporated into the service agreement, requiring EU and EEA customers to proactively execute a DPA to establish GDPR Article 28 compliant controller-processor terms.
Under this provision, GDPR compliance support through a Data Processing Addendum requires active completion of a DPA form by the customer. The document does not specify whether the DPA covers ChatGPT for Healthcare, ChatGPT Edu, or ChatGPT for Teachers under the same mechanism, referencing a Student Data Privacy Agreement separately for those products.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.