OpenAI's enterprise privacy framework includes disclosure of the third-party subprocessors it uses to deliver ChatGPT Enterprise and API services, allowing enterprise customers to assess the data sharing chain.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Interpretive note: The subprocessor disclosure provision is inferred from the document's enterprise privacy scope; the specific mechanism and notification requirements were not available in the provided HTML.
This provision addressing subprocessor transparency was removed entirely from the current policy, potentially weakening disclosure commitments around third-party processing.
View full change record →Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
How other platforms handle this
In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your personal data may be transferred to a successor entity or third party as part of that transaction.
We may disclose your information if we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. We may also disclose your information if we believe it...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) and (4) require that subprocessors be subject to the same data protection obligations as the primary processor, and that the controller be informed of and able to object to subprocessor changes. UK GDPR imposes equivalent requirements. CCPA requires that service provider agreements flow down restrictions to any third parties that access personal information. (2) GOVERNANCE EXPOSURE: Medium. Subprocessor lists are standard in enterprise AI service agreements, but the risk level depends on whether the DPA includes prior notice or prior consent mechanisms for subprocessor changes and whether the list is kept current. (3) JURISDICTION FLAGS: EU and UK customers face the highest exposure if subprocessor changes occur without adequate notice or if subprocessors lack compliant data transfer mechanisms (SCCs, adequacy decisions) for cross-border transfers. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm whether the DPA requires prior consent or only prior notice for subprocessor additions, and should track the subprocessor list as part of ongoing vendor management. Any subprocessors processing EU personal data should have compliant transfer mechanisms documented. (5) COMPLIANCE CONSIDERATIONS: Legal teams should incorporate subprocessor change notification monitoring into their GDPR compliance workflows and maintain records of any objections raised to subprocessor changes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.