Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that workspace administrators in ChatGPT Business have the ability to view, access, export, and delete any end user conversations within their workspace.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that within ChatGPT Business deployments, individual end user conversations are accessible to workspace administrators without further restriction stated in this document, which has implications for employee privacy in organizational deployments.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision discloses administrative access capabilities in ChatGPT Business, addressing organizational governance and data control for workspace administrators.
View full change record →Under this provision, end users in ChatGPT Business workspaces should be aware that their conversations may be viewed, accessed, exported, or deleted by their workspace administrators. The agreement does not specify in this document any notification requirement to end users when such access occurs.
Cross-platform context
See how other platforms handle Workspace Admin Conversation Access in ChatGPT Business and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Workspace admins have control over workspaces and can view, access, export, and delete end user conversations in the workspace.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages employee privacy frameworks in multiple jurisdictions, including the EU Working Party guidelines on employee monitoring, national implementations of GDPR in EU member states, and applicable U.S. state employee privacy laws. Employers deploying ChatGPT Business should assess whether employees have been informed of administrator access capabilities through appropriate workforce notices, as GDPR Article 13 and 14 require transparency with data subjects about processing of their personal data. (2) GOVERNANCE EXPOSURE: Medium. Employers in the EU or EEA who deploy ChatGPT Business may need to conduct a Data Protection Impact Assessment if administrator access to employee conversations constitutes systematic monitoring of employee communications. Works council or employee representative consultation may be required in certain EU member states before deploying this capability. (3) JURISDICTION FLAGS: EU and EEA employers face heightened exposure due to member state-level employee monitoring regulations that may restrict or condition administrator access to employee communications. California employers should assess whether the California Consumer Privacy Act or California labor law creates notification obligations. Illinois, New York, and Connecticut have specific employee monitoring notification requirements that may apply. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should ensure that the DPA executed with OpenAI addresses the employer-as-controller relationship for employee conversation data and the administrator access capability as a documented processing activity. HR and employment law teams should be included in deployment assessments to confirm workforce notice obligations are met. (5) COMPLIANCE CONSIDERATIONS: Organizations deploying ChatGPT Business should update acceptable use policies and employee privacy notices to disclose administrator access capabilities. Data subject access request procedures should account for the possibility that employee conversation data accessible to administrators may be subject to GDPR or CPRA access rights. IT governance policies should define the conditions under which administrator access to individual conversations will be exercised and logged.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that within ChatGPT Business deployments, individual end user conversations are accessible to workspace administrators without further restriction stated in this document, which has implications for employee privacy in organizational deployments.
Under this provision, end users in ChatGPT Business workspaces should be aware that their conversations may be viewed, accessed, exported, or deleted by their workspace administrators. The agreement does not specify in this document any notification requirement to end users when such access occurs.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.