OpenAI makes a Data Processing Addendum available to enterprise and API customers, which establishes the contractual terms under which OpenAI processes personal data on behalf of business customers.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A signed DPA is the primary contractual instrument establishing GDPR Article 28 compliance and CCPA service provider status; without it, enterprise customers may lack documented legal basis for processing personal data through OpenAI services.
Interpretive note: The DPA availability is inferred from the document's stated enterprise privacy scope and OpenAI's publicly known practices; verbatim clause language was not available in the provided HTML.
Enterprise and API customers who process personal data of employees or end users through OpenAI products should confirm that a DPA is executed, as this document governs OpenAI's data processing obligations and the customer's controller responsibilities.
How other platforms handle this
Miro's processing of personal data on behalf of customers is governed by the Customer Data Processing Addendum, which is incorporated into these Terms by reference. A current list of subprocessors used by Miro is available at miro.com/legal/subprocessors-list/ and is updated from time to time.
We may access, preserve, and share information with regulators, law enforcement, or others if we believe it is reasonably necessary to: detect, prevent, and address fraud and other illegal activity; protect ourselves, you, and others, including as part of investigations; and prevent death or imminen...
Customer authorized Mistral AI to transfer Personal Data to any country deemed to have an adequate level of data protection by the European Commission. Customer also authorizes Mistral AI to perform International Data Transfers to (a) on the basis of adequate safeguards in accordance with Applicable...
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
(1) REGULATORY LANDSCAPE: GDPR Article 28 requires that processing by a processor be governed by a binding contract setting out the subject matter, duration, nature, and purpose of processing, along with processor obligations. CCPA requires a written contract between a business and its service providers restricting use of personal information. The relevant enforcement authorities are EU supervisory authorities and the California Privacy Protection Agency. (2) GOVERNANCE EXPOSURE: High for EU and California-based enterprise customers who have not executed a DPA. Without a signed DPA, processing of personal data through the API or ChatGPT Enterprise may lack a compliant legal basis under GDPR and may not satisfy CCPA service provider requirements. (3) JURISDICTION FLAGS: EU and EEA organizations face the highest exposure; UK GDPR imposes equivalent Article 28 requirements post-Brexit. California organizations must confirm CCPA service provider contractual provisions are in place. Organizations in other jurisdictions with analogous data processor laws (Brazil LGPD, Canada PIPEDA) should also evaluate local requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should treat DPA execution as a prerequisite for deploying ChatGPT Enterprise or the API in any context involving personal data. The DPA should be reviewed for subprocessor approval mechanisms, audit rights, breach notification timelines, and data deletion obligations. (5) COMPLIANCE CONSIDERATIONS: Data mapping exercises should record OpenAI as a subprocessor or processor and reference the executed DPA. Records of processing activities under GDPR Article 30 should reflect OpenAI's role. Annual vendor reviews should confirm the DPA remains current and reflects any changes to OpenAI's subprocessor list.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
A signed DPA is the primary contractual instrument establishing GDPR Article 28 compliance and CCPA service provider status; without it, enterprise customers may lack documented legal basis for processing personal data through OpenAI services.
Enterprise and API customers who process personal data of employees or end users through OpenAI products should confirm that a DPA is executed, as this document governs OpenAI's data processing obligations and the customer's controller responsibilities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.