OpenAI makes a Data Processing Addendum available to enterprise and API customers, which establishes the contractual terms under which OpenAI processes personal data on behalf of business customers.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A signed DPA is the primary contractual instrument establishing GDPR Article 28 compliance and CCPA service provider status; without it, enterprise customers may lack documented legal basis for processing personal data through OpenAI services.
Interpretive note: The DPA availability is inferred from the document's stated enterprise privacy scope and OpenAI's publicly known practices; verbatim clause language was not available in the provided HTML.
This high-severity provision with no excerpt was replaced by more detailed GDPR and DPA-specific language, reducing emphasis on generic DPA availability.
View full change record →Enterprise and API customers who process personal data of employees or end users through OpenAI products should confirm that a DPA is executed, as this document governs OpenAI's data processing obligations and the customer's controller responsibilities.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
(1) REGULATORY LANDSCAPE: GDPR Article 28 requires that processing by a processor be governed by a binding contract setting out the subject matter, duration, nature, and purpose of processing, along with processor obligations. CCPA requires a written contract between a business and its service providers restricting use of personal information. The relevant enforcement authorities are EU supervisory authorities and the California Privacy Protection Agency. (2) GOVERNANCE EXPOSURE: High for EU and California-based enterprise customers who have not executed a DPA. Without a signed DPA, processing of personal data through the API or ChatGPT Enterprise may lack a compliant legal basis under GDPR and may not satisfy CCPA service provider requirements. (3) JURISDICTION FLAGS: EU and EEA organizations face the highest exposure; UK GDPR imposes equivalent Article 28 requirements post-Brexit. California organizations must confirm CCPA service provider contractual provisions are in place. Organizations in other jurisdictions with analogous data processor laws (Brazil LGPD, Canada PIPEDA) should also evaluate local requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should treat DPA execution as a prerequisite for deploying ChatGPT Enterprise or the API in any context involving personal data. The DPA should be reviewed for subprocessor approval mechanisms, audit rights, breach notification timelines, and data deletion obligations. (5) COMPLIANCE CONSIDERATIONS: Data mapping exercises should record OpenAI as a subprocessor or processor and reference the executed DPA. Records of processing activities under GDPR Article 30 should reflect OpenAI's role. Annual vendor reviews should confirm the DPA remains current and reflects any changes to OpenAI's subprocessor list.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
A signed DPA is the primary contractual instrument establishing GDPR Article 28 compliance and CCPA service provider status; without it, enterprise customers may lack documented legal basis for processing personal data through OpenAI services.
Enterprise and API customers who process personal data of employees or end users through OpenAI products should confirm that a DPA is executed, as this document governs OpenAI's data processing obligations and the customer's controller responsibilities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.